Function at 0x428a70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x244
mov eax, 0x59f150
call fcn.005693c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056f390
push 0x5a0a54
lea eax, [ebp - 0x218]
push 0x5a0b58
push eax
call fcn.00408d5e
add esp, 0x18
lea ecx, [ebp - 0x250]
call fcn.00403ac6
and dword [ebp - 4], 0
call fcn.0042ab6b
test al, al
je 0x428af0
sub eax, 0x7619369a
insb byte es:[edi], dx
or ebx, dword [ecx - 0x55]
jae 0x428b52
lodsb al, byte [esi]
sti
mov ebp, dword [bx - 0x4f4d]
scasb al, byte es:[edi]
pop es
aas
or cl, byte [esi + ecx*2 - 0x31]
call fcn.0042aa12
test al, al
je 0x428b17
mov ch, 0x68
sar byte [edx + 0xc], 1
lodsb al, byte fs:[esi]
and al, 0xaf
fnstsw word [esi]
mov dword fs:[0x134dd84d], eax
invalid
lea ecx, [ebp - 0x250]
call fcn.00403b8c
test eax, eax
je 0x428bf2
lea eax, [ebp - 0x21c]
mov esi, 0xf013f
push eax
push esi
add dword [edi], ecx
add byte [eax + 0x56], dl
xor ebx, ebx
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428cc1
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x428c59
call fcn.0042acc4
test al, al
je 0x428b9a
aaa
jae 0x428b32
push ds
xor eax, 0xfeb668db
mov al, 0x62
and byte [ecx], 0xfd
xor ah, bl
inc edx
lcall 0xb8e8, 0xad0fee2d
push ds
add byte [eax], al
call fcn.0042aa57
add byte [eax + eax*8 + 0x5fe71874], al
test al, al
je 0x428bbb
out 0x5f, eax
out dx, eax
mov ebx, 0x9741ecaf
sahf
loope 0x428c09
cwde
mov al, byte [0xc3daa58e]
mov bh, byte [ecx + esi - 7]
insd dword es:[edi], dx
mov eax, dword [0x1f21e8a4]
add byte [eax], al
call fcn.0042aae1
test al, al
je 0x428bdc
scasd eax, dword es:[edi]
dec ebp
sub byte [ebx - 0x1a], al
pushal
cmpsd dword [esi], dword es:[edi]
jne 0x428b9e
rol byte [ebp + 0x57], cl
dec ebp
push edx
xor al, 0xbc
fstp qword [edi + 0x5a]
mov dh, 0xd1
pop ebp
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
push 0
push 0
jmp 0x428c8f
call fcn.0042ac7f
test al, al
je 0x428c0d
dec esi
and dword [ebx - 0x14], ebp
or esp, eax
sbb byte [esi + 0x66a04169], cl
in eax, 0x64
mov ah, 0xd1
lea eax, [ebp - 0x21c]
mov esi, 0xf003f
push eax
push esi
xor edi, edi
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428cc1
push edi
lea eax, [ebp - 0x220]
push eax
push edi
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x428c67
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428cc1
call fcn.0042aeec
test al, al
je 0x428c80
or byte [esi - 0x10], al
push 0x9e30ad64
xor dl, byte [ebp + eax*4 - 0x2449a57e]
add ecx, dword [ebp - 0x2237b]
call dword [eax - 1]
mov ch, 0xd8
std
invalid
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
push edi
push edi
push dword [ebp - 0x22c]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x250]
call fcn.00403ad9
call fcn.00569382
ret 8