Function at 0x427e30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x4b6148
push SysReAllocStringLen
call ebx
mov esi, eax
test esi, esi
jne 0x427f2e
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x4b61e4
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x427f2e
push 0x4b4d48
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00493457
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x20c]
push eax
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x427f8c
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push esi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x427f8c
lea eax, [ebp - 0x210]
push eax
push 0x20019
push 0
push 0x4b61f4
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x427f84
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x42810a
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427f95
sub ecx, edx
mov edx, edi
sar ecx, 1
lea esi, [edx + 2]
lea esp, [esp]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x427fb0
sub edx, esi
sar edx, 1
lea eax, [edx + 6]
add eax, ecx
mov dword [ebp - 0x218], eax
add eax, eax
push eax
call fcn.0048fb2f
mov esi, eax
add esp, 4
cmp word [ebp - 0x20c], 0x22
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], eax
jne 0x428003
lea eax, [ebp - 0x20a]
mov dword [ebp - 0x224], eax
push 0x22
jmp 0x42800b
push 0x20
lea eax, [ebp - 0x20c]
push eax
call fcn.0049110f
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x428022
xor eax, eax
mov word [ebx], ax
add ebx, 2
cmp byte [ebp + 0xc], 0
je 0x4280c3
lea eax, [ebp - 0x20c]
push 0x4b6224
push eax
call fcn.004913b3
add esp, 8
mov dword [ebp - 0x21c], eax
test eax, eax
je 0x4280ac
mov esi, eax
sub esi, ebx
sar esi, 1
lea ecx, [esi + 1]
push ecx
push ebx
push dword [ebp - 0x218]
mov ebx, dword [ebp - 0x220]
push ebx
call fcn.0049124f
mov eax, dword [ebp - 0x218]
add ebx, 2
sub eax, esi
dec eax
push 0x4b6230
push eax
lea eax, [ebx + esi*2]
push eax
call fcn.004911bd
mov ebx, dword [ebp - 0x218]
mov esi, dword [ebp - 0x220]
push edi
push ebx
push esi
call fcn.00493457
mov eax, dword [ebp - 0x21c]
add eax, 6
push eax
push ebx
push esi
call fcn.00493457
add esp, 0x34
jmp 0x4280e0
push edi
push 0x4b6238
push dword [ebp - 0x218]
push esi
call fcn.00492202
add esp, 0x10
jmp 0x4280e0
mov ecx, esi
sub ecx, edi
jmp 0x4280d0
movzx eax, word [edi]
lea edi, [edi + 2]
mov word [ecx + edi - 2], ax
test ax, ax
jne 0x4280d0
push 0
push esi
push dword [ebp - 0x224]
call fcn.00428140
push esi
call fcn.0048faf7
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret
push 0x10
push 0x4b6248
push 0x4b6278
push dword [ebp - 0x21c]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048fc6c
mov esp, ebp
pop ebp
ret