Function at 0x428120
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80
mov esi, ecx
mov ecx, dword [0x49803c]
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, edi
push eax
call fcn.0042abb0
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x428181
xor ecx, ecx
mov dword [esi + 4], ecx
mov dword [esi], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045fb40
mov eax, esi
add esp, 0x80
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd xmm2, qword [ebp - 0x2c]
movsd xmm1, qword [ebp - 0x24]
xor ebx, ebx
lea edi, [ebp - 0x5c]
mov eax, 7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], bx
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ebx
mov word [edi], bx
movsd qword [ebp - 0x34], xmm0
movsd qword [ebp - 0x3c], xmm1
movsd qword [ebp - 0x44], xmm2
sub esp, 0xc
mov al, byte [ebp - 0x80]
mov ecx, edi
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
call fcn.00424520
cmp dword [ebp + 0xc], 0
je 0x428255
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
cmp ecx, eax
je 0x428445
lea edx, [eax + 1]
cmp ecx, 7
mov dword [ebp - 0x4c], edx
jbe 0x4281fe
mov edi, dword [ebp - 0x5c]
mov word [edi + eax*2], 0x5c
mov word [edi + eax*2 + 2], 0
push dword [ebp + 0xc]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x42846e
lea edi, [ecx + eax]
cmp edx, 7
mov dword [ebp - 0x4c], edi
jbe 0x428238
mov ebx, dword [ebp - 0x5c]
jmp 0x42823b
lea ebx, [ebp - 0x5c]
add eax, eax
lea ecx, [ebx + ecx*2]
push eax
push dword [ebp + 0xc]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [ebx + edi*2], 0
xor ebx, ebx
cmp dword [ebp - 0x30], 7
mov dword [ebp - 0x84], ebx
jbe 0x428266
mov eax, dword [ebp - 0x44]
jmp 0x428269
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], 7
jbe 0x428274
mov ecx, dword [ebp - 0x5c]
jmp 0x428277
lea ecx, [ebp - 0x5c]
lea edi, [ebp - 0x84]
push edi
push ebx
push ebx
push 2
push eax
push ecx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x4282ba
cmp eax, 2
jne 0x4282ee
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov byte [esi + 0x18], 0
jmp 0x4285be
mov ebx, dword [ebp - 0x84]
shr ebx, 1
inc ebx
xor eax, eax
dec eax
add ebx, ebx
cmovb ebx, eax
push ebx
call fcn.0045fd21
add esp, 4
xor ecx, ecx
push ebx
mov ebx, eax
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp - 0x30], 7
jbe 0x42832b
mov eax, dword [ebp - 0x44]
jmp 0x42832e
movzx edi, ax
mov edx, str.RegistryGetValueString
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
push 0x45
call fcn.00428eb0
add esp, 4
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edi
jmp 0x4285be
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], 7
jbe 0x428339
mov ecx, dword [ebp - 0x5c]
jmp 0x42833c
lea ecx, [ebp - 0x5c]
push edi
push ebx
xor edx, edx
push edx
push 2
push eax
push ecx
push SysReAllocString
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
je 0x428395
mov edi, ebx
movzx ebx, ax
mov edx, str.RegistryGetValueString
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
push 0x54
call fcn.00428eb0
add esp, 4
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov ebx, edi
jmp 0x4285b5
xor edi, edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push ebx
push edi
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
mov dword [ebp - 0x88], ebx
je 0x428493
mov ebx, eax
push eax
call fcn.0045fd21
add esp, 4
xor ecx, ecx
mov edi, eax
push ebx
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
push eax
push eax
xor eax, eax
push ebx
mov dword [ebp - 0x8c], edi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x88]
push eax
push 0xfde9
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
je 0x4284da
mov edi, dword [ebp - 0x8c]
mov dword [ebp - 0x6c], 0xf
mov dword [ebp - 0x70], 0
mov byte [ebp - 0x80], 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
cmp eax, 0xf
mov ecx, edi
ja 0x428523
lea eax, [ebp - 0x80]
mov dword [eax + 0x10], ebx
push ebx
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + ebx - 0x80], 0
jmp 0x42853c
sub esp, 0x10
mov al, byte [ebp - 0x80]
lea ecx, [ebp - 0x5c]
mov byte [esp + 4], al
xor eax, eax
mov dword [esp + 8], 0x493a50
inc eax
mov dword [esp + 0xc], eax
mov dword [esp], eax
call fcn.00423e40
jmp 0x42820b
sub esp, 0x10
mov cl, byte [ebp - 0x80]
mov byte [esp + 4], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], ecx
lea ecx, [ebp - 0x5c]
call fcn.00423e40
jmp 0x428255
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
mov edx, str.RegistryGetValueString
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
push 0x5d
call fcn.00428eb0
add esp, 4
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp - 0x88]
jmp 0x4285b5
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
mov edx, str.RegistryGetValueString
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
push 0x67
call fcn.00428eb0
add esp, 4
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov ebx, dword [ebp - 0x88]
jmp 0x4285a6
sub esp, 0xc
mov al, byte [ebp - 0x68]
mov byte [esp + 4], al
mov dword [esp + 8], ecx
lea ecx, [ebp - 0x80]
mov dword [esp], ebx
call fcn.00435250
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x80]
xor edi, edi
movsd xmm0, qword [ebp - 0x7c]
mov edx, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x88]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x18], edi
mov dword [ebp - 0x60], ecx
mov dword [esi], eax
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], 0xf
mov byte [ebp - 0x80], 0
movsd qword [ebp - 0x68], xmm0
mov eax, dword [ebp - 0x60]
movsd xmm0, qword [ebp - 0x68]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x6c]
movsd qword [esi + 4], xmm0
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov byte [esi + 0x18], 1
cmp eax, 0x10
jae 0x428619
mov eax, dword [ebp - 0x8c]
push eax
call fcn.0045f40c
add esp, 4
push ebx
call fcn.0045f40c
add esp, 4
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x4285df
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x428636
push edx
push eax
call fcn.0045fd21
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x428600
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx + 2]
cmp edx, 0x1000
jae 0x42864e
push edx
push eax
call fcn.0045fd21
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], 0
jmp 0x42816a
mov ecx, dword [ebp - 0x80]
lea edi, [eax + 1]
cmp edi, 0x1000
jae 0x428666
push edi
push ecx
call fcn.0045fd21
add esp, 8
jmp 0x4285a6
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x428682
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4285d5
mov edx, eax
mov eax, dword [eax - 4]
add edx, 0xfffffffc
sub edx, eax
cmp edx, 0x20
jae 0x428682
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x4285f6
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x428682
mov ebx, dword [ebp - 0x88]
add eax, 0x24
mov ecx, edx
mov edi, eax
jmp 0x428627
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3