Function at 0x427120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bab60
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push esi
push edi
mov eax, dword [0x4e949c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x80], vtable.CMininewsCommon.0
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x427368
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x58], eax
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x427372
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x48], 0x493e0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], eax
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x42737c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], eax
push ebx
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], ebx
call fcn.00427f00
test eax, eax
je 0x42734c
mov dword [ebp - 0x14], ebx
call fcn.0040c140
mov ecx, eax
test ecx, ecx
je 0x427386
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, str.SOFTWAREQiLu_Inc.mininews_lite
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x10]
test eax, 0xffff0000
jne 0x42721f
movzx eax, ax
push eax
call fcn.004150e0
jmp 0x42722b
push 0x20
push str.SOFTWAREQiLu_Inc.mininews_lite
call fcn.0040c380
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
push str.lite_show
push esi
push SysReAllocStringLen
mov dword [ebp - 0x1c], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edi, eax
neg edi
sbb edi, edi
add esi, 0xfffffff0
inc edi
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42727c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x42728a
cmp dword [ebp - 0x14], 0
je 0x42734c
push 1
lea ecx, [ebp - 0x80]
call fcn.00427f00
lea ecx, [ebp - 0x80]
test eax, eax
je 0x42734f
push 0
push 3
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 0
push eax
call fcn.00426d10
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x1c], 4
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 4
push ecx
push str.desktop_show
push dword [eax]
push SysReAllocStringLen
call edi
mov edx, dword [ebp - 0x10]
neg eax
sbb esi, esi
add edx, 0xfffffff0
inc esi
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x427301
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x42730b
cmp dword [ebp - 0x14], 0
je 0x42734c
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], 4
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x24], 4
push eax
push str.Mask_Flag
push str.SOFTWARELuDaShi
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x427347
test byte [ebp - 0x18], 1
jne 0x42734c
mov ebx, 1
lea ecx, [ebp - 0x80]
call fcn.004245e0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
push 0x80004005
call fcn.00401af0
int3