Function at 0x426840
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x57ed89
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x6531f0]
xor eax, esp
mov dword [esp + 0x81c], eax
push ebx
push ebp
push edi
mov eax, dword [0x6531f0]
xor eax, esp
push eax
lea eax, [esp + 0x830]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x838], edi
lea eax, [esp + 0x18]
push eax
mov ecx, str.SoftwareSshXHome
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edi
call fcn.004026a0
mov ebx, 1
mov dword [esp + 0x838], ebx
push ebx
push str.IsGlobal
push str.Update
call fcn.00402260
mov byte [esp + 0x1f], al
test al, al
je 0x4268cc
push 7
push 0x632d1c
lea ecx, [esp + 0x20]
push ecx
jmp 0x4268d8
push 4
push str.Nus
lea edx, [esp + 0x20]
push edx
call fcn.00411d70
push esi
call fcn.00426ba0
mov edx, dword [esp + 0x18]
mov ebp, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push edi
push 0x632d38
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], ebx
mov byte [esi + 0xc], 0
mov dword [esp + 0x2c], 0x400
call ebp
test eax, eax
jne 0x426952
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x2c], cx
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x426930
sub eax, edx
sar eax, 1
lea edx, [esp + 0x2c]
mov ebx, eax
push edx
mov eax, esi
call fcn.004028e0
mov ebx, 1
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push 0x632d44
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x400
call ebp
test eax, eax
jne 0x4269b2
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x2c], cx
lea ecx, [esp + 0x2c]
lea eax, [esi + 4]
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x426992
sub ecx, edi
sar ecx, 1
lea edx, [esp + 0x2c]
push edx
mov ebx, ecx
call fcn.004028e0
mov ebx, 1
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push 0x632d50
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x400
call ebp
test eax, eax
jne 0x426a51
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x2c]
shr eax, 1
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0x30], cx
call fcn.004fe155
lea ecx, [esp + 0x30]
mov edi, eax
add esp, 4
lea eax, [esi + 8]
lea ebx, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x426a01
sub ecx, ebx
sar ecx, 1
lea edx, [esp + 0x2c]
push edx
mov ebx, ecx
call fcn.004028e0
test edi, edi
jbe 0x426ae2
push 0
call fcn.004fef09
xor ecx, ecx
add esp, 4
add edi, 0x278d00
cmp edx, ecx
jg 0x426ae2
jl 0x426a48
cmp eax, edi
jae 0x426ae2
mov byte [esi + 0xc], 1
jmp 0x426ae2
cmp byte [esp + 0x1f], 0
je 0x426ae2
lea eax, [esp + 0x20]
push eax
call fcn.0040cb50
mov byte [esp + 0x838], 2
push 0
call fcn.004fef09
add esp, 4
push edx
push eax
push 0x632d5c
lea edi, [esp + 0x2c]
call fcn.0042e800
add esp, 0xc
lea edi, [esi + 8]
lea eax, [esp + 0x20]
call fcn.0040e9d0
mov eax, dword [esp + 0x20]
cmp dword [eax - 4], ebx
mov edi, dword [eax - 0xc]
jle 0x426ab4
mov ecx, edi
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00402a30
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
lea ecx, [edi + edi]
push ecx
push eax
push ebx
push 0x632d50
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [esi + 0xc], bl
mov byte [esp + 0x838], bl
lea ecx, [esp + 0x20]
call fcn.00402750
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x30]
push ecx
push 0
push str.Date
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0x400
call ebp
test eax, eax
jne 0x426b3d
mov eax, dword [esp + 0x14]
shr eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x2c], cx
lea ecx, [esp + 0x2c]
lea eax, [esi + 8]
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x426b22
sub ecx, edi
sar ecx, 1
lea edx, [esp + 0x2c]
push edx
mov ebx, ecx
call fcn.004028e0
cmp byte [esi + 0xc], 0
je 0x426b5e
call fcn.00426e90
mov bl, al
call fcn.00426f90
test bl, bl
jne 0x426b5a
cmp eax, 0x278d00
jle 0x426b5e
mov byte [esi + 0xc], 0
mov byte [esp + 0x838], 0
lea ecx, [esp + 0x18]
call fcn.00402750
mov eax, esi
mov ecx, dword [esp + 0x830]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x81c]
xor ecx, esp
call fcn.004fdb4a
add esp, 0x82c
ret