Function at 0x428eb3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0x38
mov eax, 0x49ec85
call fcn.0048a2c9
call fcn.0047727e
push eax
lea ecx, [ebp - 0x14]
call fcn.0042049e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], ebx
call fcn.0047727e
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042049e
mov byte [ebp - 4], 1
push dword [0x4c8960]
lea eax, [ebp - 0x20]
push str.SoftwareVOS_s
push eax
call fcn.00452370
push str.IntegratedExt
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.00423a96
add esp, 0x18
lea ecx, [ebp - 0x28]
push ecx
push 9
mov byte [ebp - 4], 3
mov eax, dword [eax]
push ebx
push eax
call fcn.00469660
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0042001a
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
cmp esi, ebx
je 0x428f69
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0042001a
mov eax, ebx
call fcn.0048a3a1
ret
mov dword [ebp - 0x24], ebx
mov esi, str.SoftwareClasses_s
mov edi, 0x104
push edi
lea ecx, [ebp - 0x14]
call fcn.004204c6
push edi
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.00423b0a
cmp edi, ebx
jne 0x4291b6
push 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00423a58
push 0x4ab944
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00422668
mov ebx, eax
neg ebx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.0042001a
test bl, bl
je 0x4291ac
mov ebx, 0x4a94b0
push ebx
lea ecx, [ebp - 0x18]
call fcn.004211c4
push 0
push 1
push ecx
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x3c], esp
push ebx
lea edi, [ebp - 0x1c]
call fcn.004211c4
push ecx
mov byte [ebp - 4], 6
mov eax, esp
mov dword [ebp - 0x40], esp
push dword [ebp - 0x14]
push esi
push eax
call fcn.00452370
add esp, 0xc
mov byte [ebp - 4], 7
call fcn.00469660
mov edx, eax
mov byte [ebp - 4], 5
call fcn.004531d0
add esp, 0x10
test eax, eax
je 0x42919d
push dword [0x4c8960]
lea eax, [ebp - 0x20]
push dword [0x4c87bc]
push 0x4abad0
push eax
call fcn.00452370
add esp, 0x10
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x20]
push dword [eax - 0xc]
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.00423a58
push dword [ebp - 0x20]
mov eax, dword [eax]
push eax
call fcn.00485d30
pop ecx
pop ecx
mov ecx, dword [ebp - 0x30]
test eax, eax
setne byte [ebp - 0xd]
add ecx, 0xfffffff0
call fcn.0042001a
cmp byte [ebp - 0xd], 0
jne 0x429192
push 0
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x40], esp
push str.Backup
push 0x4c87bc
push eax
lea edi, [ebp - 0x18]
call fcn.00423a96
add esp, 8
mov byte [ebp - 4], 9
mov eax, esp
mov dword [ebp - 0x3c], esp
push dword [ebp - 0x14]
push esi
push eax
call fcn.00452370
add esp, 0xc
mov byte [ebp - 4], 0xa
call fcn.00469660
mov edx, eax
mov byte [ebp - 4], 8
call fcn.004531d0
add esp, 0x10
test eax, eax
je 0x429133
push 0
push ecx
mov eax, edi
mov dword [ebp - 0x40], esp
mov ecx, esp
push eax
call fcn.00421355
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x3c], esp
push ebx
call fcn.004211c4
push ecx
mov byte [ebp - 4], 0xc
mov eax, esp
mov dword [ebp - 0x44], esp
push dword [ebp - 0x14]
push esi
push eax
call fcn.00452370
add esp, 0xc
mov byte [ebp - 4], 0xd
call fcn.00469660
push eax
mov byte [ebp - 4], 8
call fcn.004534a0
add esp, 0x14
jmp 0x429164
push dword [ebp - 0x14]
lea eax, [ebp - 0x34]
push esi
push eax
call fcn.00452370
add esp, 0xc
mov byte [ebp - 4], 0xe
push dword [eax]
call fcn.00469660
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
push dword [ebp - 0x1c]
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.00452370
add esp, 0xc
mov byte [ebp - 4], 0xf
push dword [eax]
call fcn.00469660
push eax
call fcn.00453630
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0042001a
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0042001a
inc dword [ebp - 0x24]
xor ebx, ebx
jmp 0x428f71
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x4c8960]
lea eax, [ebp - 0x34]
push str.SoftwareVOS_s
push eax
call fcn.00452370
push str.IntegratedExt
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0x10
call fcn.00423a96
add esp, 0x18
mov byte [ebp - 4], 0x11
push dword [eax]
call fcn.00469660
push eax
call fcn.00453630
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0042001a
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0042001a
xor ebx, ebx
inc ebx
jmp 0x428f4b