Function at 0x428a70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x244
mov eax, 0x59f150
call fcn.005693c7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0xc]
push 0x208
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0056f390
push 0x5a0a54
lea eax, [ebp - 0x218]
push 0x5a0b58
push eax
call fcn.00408d5e
add esp, 0x18
lea ecx, [ebp - 0x250]
call fcn.00403ac6
and dword [ebp - 4], 0
call fcn.0042ab6b
test al, al
je 0x428af0
and ebp, 0xffffffee
mov esi, 0x4ba74288
sub dword [edi], edx
sbb dword [ecx + 0x52], esp
inc esp
pop ebp
sub eax, dword [ebx + 0x55]
sti
fcompi st(7)
ret 0x1bb
call fcn.0042aa12
test al, al
je 0x428b17
invalid
lea ecx, [ebp - 0x250]
call fcn.00403b8c
test eax, eax
je 0x428bf2
lea eax, [ebp - 0x21c]
mov esi, 0xf013f
push eax
push esi
xor ebx, ebx
push ebx
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428cc1
pop edx
add byte [ebp + 0x6f850fc0], al
add dword [eax], eax
add byte [ebx - 0x73], dl
test eax, esp
std
invalid
push ebx
lea eax, [ebp - 0x220]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x428c59
call fcn.0042acc4
test al, al
je 0x428b9a
add byte [edi - 0x710b3fd5], 0xc0
dec esi
loopne 0x428b48
scasb al, byte es:[edi]
mov al, byte [edx + 0x21]
add byte [edi - 0x77], dh
mov word [eax + edx - 0x1759ac2d], ss
mov eax, 0x8400001e
sal byte [eax + ebx + 0x16], 0x45
call fcn.0042aa57
test al, al
je 0x428bbb
push ss
inc ebp
fistp dword [edi + 0xc49202f]
das
mov esp, 0x448d401a
adc cl, dh
xchg ebp, eax
aam 0xa7
movsd dword es:[edi], dword [esi]
jne 0x428c26
popal
call fcn.0042aae1
test al, al
je 0x428bdc
in eax, dx
movsd dword es:[edi], dword [esi]
ret
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
push 0
push 0
jmp 0x428c8f
call fcn.0042ac7f
test al, al
je 0x428c0d
sar byte [ecx + 0x5486a018], cl
dec eax
mov bh, 0x56
xor al, 0xdf
inc ecx
and byte [ebx - 0x67], cl
test eax, 0xfde4858d
invalid
lea eax, [ebp - 0x21c]
mov esi, 0xf003f
push eax
push esi
xor edi, edi
push edi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp bh, 0x15
inc eax
add byte [edx], bl
test eax, eax
jne 0x428cc1
push edi
lea eax, [ebp - 0x220]
push eax
push edi
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x428c67
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428cc1
call fcn.0042aeec
test al, al
je 0x428c80
push eax
jno 0x428cb5
cwde
dec ebx
popfd
in al, dx
ja 0x428c1c
mov byte [0xc16c3001], al
dec edx
inc ecx
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x228]
push edi
push edi
push dword [ebp - 0x22c]
mov dword [ebp - 0x224], 0x104
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x220]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
pop edx
add bh, bh
salc
push dword [ebp - 0x21c]
call esi
lea ecx, [ebp - 0x250]
call fcn.00403ad9
call fcn.00569382
ret 8