Function at 0x4289b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b15d7
mov eax, dword fs:[0]
push eax
sub esp, 0x30c
mov eax, dword [0x503074]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4c965c
push str.hpqEnumerateRegisteredEvents
push 0
call fcn.00422b80
push eax
call fcn.0047bd80
xor esi, esi
add esp, 0x10
mov dword [ebp - 0x310], esi
mov dword [ebp - 4], esi
call fcn.00422b80
mov al, byte [eax + 0x38]
test al, al
je 0x428a3f
push 0x28
call fcn.00475970
mov esi, eax
add esp, 4
mov dword [ebp - 0x308], esi
push str.hpqEnumerateRegisteredEvents
mov byte [ebp - 4], 1
call fcn.00422b80
push eax
mov ecx, esi
call fcn.00477bf0
mov esi, eax
mov dword [ebp - 0x310], esi
push 0x208
lea eax, [ebp - 0x258]
push 0
push eax
call fcn.0048b3f0
lea eax, [ebp - 0x2fc]
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x27c], eax
add esp, 0xc
lea eax, [ebp - 0x280]
mov dword [ebp - fcn.0042e220], vtable.std::_Func_impl_class__lambda_23fed804204fb186211c115d448799db___class_std::allocator_int___void___.0
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x308], eax
push eax
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 3
call fcn.0042e220
mov dword [ebp - 0x2d4], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x25c]
test ecx, ecx
je 0x428ad7
mov edx, dword [ecx]
lea eax, [ebp - 0x280]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor ecx, ecx
mov dword [ebp - 0x25c], ecx
mov byte [ebp - 4], 7
test ecx, ecx
je 0x428afd
mov edx, dword [ecx]
lea eax, [ebp - 0x280]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x25c], 0
push ecx
push str.SoftwareHP_
push ecx
mov ebx, 0x104
mov byte [ebp - 4], 6
mov edx, ebx
lea ecx, [ebp - 0x258]
call fcn.004304d0
mov edi, eax
test edi, edi
js 0x428b85
lea eax, [ebp - 0x304]
mov edx, ebx
push eax
lea ecx, [ebp - 0x258]
call fcn.00430480
mov edi, eax
test edi, edi
js 0x428b85
mov eax, dword [ebp - 0x304]
sub ebx, eax
push ecx
push str.20ED5D44_3C74_4E20_B62A_4FB59ED919B0
push ecx
lea ecx, [ebp - 0x258]
mov edx, ebx
lea ecx, [ecx + eax*2]
call fcn.004304d0
mov edi, eax
test edi, edi
js 0x428b85
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2fc]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x258]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov edi, eax
jmp 0x428b8b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test edi, edi
jne 0x428dc9
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x30c], 0x20
push edi
push eax
call fcn.0048b3f0
add esp, 0xc
lea eax, [ebp - 0x318]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
mov dword [ebp - 0x300], 0
lea eax, [ebp - 0x300]
mov dword [ebp - fcn.0042e1f0], vtable.std::_Func_impl_class__lambda_2974929dd70df8f88ca8f693d5dba5f1___class_std::allocator_int___void___.0
mov dword [ebp - 0x2a4], eax
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x308], eax
push eax
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 9
call fcn.0042e1f0
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x284]
test ecx, ecx
je 0x428c52
mov edx, dword [ecx]
lea eax, [ebp - 0x2a8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
xor ecx, ecx
mov dword [ebp - 0x284], ecx
mov byte [ebp - 4], 0xd
test ecx, ecx
je 0x428c78
mov edx, dword [ecx]
lea eax, [ebp - 0x2a8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x284], 0
mov byte [ebp - 4], 0xc
xor esi, esi
nop
test edi, edi
je 0x428c90
cmp edi, 0x103
je 0x428db4
lea eax, [ebp - 0x300]
mov dword [ebp - 0x300], 0
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x2fc]
call ebx
mov edi, eax
test edi, edi
jne 0x428db4
lea eax, [ebp - 0x308]
mov dword [ebp - 0x308], 4
push eax
lea eax, [ebp - 0x304]
push eax
push edi
push edi
push str.hpqBEvntID
push dword [ebp - 0x300]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x428db4
push dword [ebp - 0x304]
lea eax, [ebp - 0x50]
push eax
push str.RegisteredEvents__Event_Name:__s____ID:_0x_x
push str.hpqEnumerateRegisteredEvents
push 2
call fcn.00422b80
push eax
call fcn.0047bd80
mov edi, dword [ebp - 0x304]
add esp, 0x18
cmp edi, 0xff
ja 0x428d7d
shl edi, 5
add edi, 0x509ec0
cmp dword [edi], 0
je 0x428d7d
push 0x208
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x428d77
push str.Global_
push 0x104
push ebx
call fcn.004924d3
lea eax, [ebp - 0x50]
push eax
push 0x104
push ebx
call fcn.00492537
mov eax, dword [edi + 8]
add esp, 0x18
mov dword [edi + eax*4 + 0xc], ebx
inc dword [edi + 4]
dec dword [edi]
inc dword [edi + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x318]
mov dword [ebp - 0x30c], 0x20
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x30c]
inc esi
push eax
lea eax, [ebp - 0x50]
push eax
push esi
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
jmp 0x428c80
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 6
call fcn.00402190
mov esi, dword [ebp - 0x310]
push edi
push str.lRet:__ld
push str.hpqEnumerateRegisteredEvents
push 1
call fcn.00422b80
push eax
call fcn.0047bd80
add esp, 0x14
lea ecx, [ebp - 0x2f8]
call fcn.00402190
test esi, esi
je 0x428e05
mov ecx, esi
call fcn.00478c00
push 0x28
push esi
call fcn.00475d73
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004756da
mov esp, ebp
pop ebp
ret