Function at 0x4288c5
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push 0x43c
mov eax, 0x4694d8
call fcn.004517f7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x448], eax
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x440], esi
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x434]
call fcn.00402773
mov byte [ebp - 4], 1
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x42c]
call fcn.00402773
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], esi
je 0x428e13
push 0x47a6e4
lea esi, [ebp + 0xc]
call fcn.004068da
mov edi, eax
mov eax, dword [ebp + 0xc]
mov esi, dword [eax - 0xc]
push edi
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp + 0xc]
call fcn.00402e80
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 3
call fcn.0040270e
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.0040285d
sub esi, edi
dec esi
push esi
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040692c
push eax
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 4
call fcn.0040270e
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.0040285d
mov ebx, dword [ebp - 0x434]
xor eax, eax
cmp dword [ebx - 0xc], eax
je 0x428bed
mov ecx, dword [ebp - 0x42c]
cmp dword [ecx - 0xc], eax
je 0x428bed
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x424]
call fcn.00402773
mov byte [ebp - 4], 5
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x430]
call fcn.00402773
push 0x4778ac
lea esi, [ebp - 0x434]
mov byte [ebp - 4], 6
call fcn.004068da
mov esi, dword [ebx - 0xc]
mov edi, eax
push edi
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x434]
call fcn.00402e80
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 7
call fcn.0040270e
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.0040285d
sub esi, edi
dec esi
push esi
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x434]
call fcn.0040692c
push eax
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 8
call fcn.0040270e
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x428]
add ecx, 0xfffffff0
call fcn.0040285d
mov esi, dword [ebp - 0x424]
cmp dword [esi - 0xc], 0
je 0x428bd2
mov eax, dword [ebp - 0x430]
cmp dword [eax - 0xc], 0
je 0x428bd2
push eax
lea eax, [ebp - 0x420]
xor ecx, ecx
push 0x4774a8
push eax
mov word [ebp - 0x218], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.HKEY_USERS
lea ecx, [ebp - 0x424]
call fcn.00408c1b
test eax, eax
jne 0x428ac0
mov edi, SysStringLen
jmp 0x428b14
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x424]
call fcn.00408c1b
test eax, eax
jne 0x428adb
mov edi, SysReAllocString
jmp 0x428b14
push 0x47b664
lea ecx, [ebp - 0x424]
call fcn.00408c1b
test eax, eax
jne 0x428af6
mov edi, SysStringLen
jmp 0x428b14
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x424]
call fcn.00408c1b
mov edi, eax
neg edi
sbb edi, edi
neg edi
add edi, 0x80000001
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x438]
call fcn.00402773
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
mov byte [ebp - 4], 9
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x428bb8
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push dword [ebp - 0x42c]
mov dword [ebp - 0x444], 0x208
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428bb8
mov ecx, dword [ebp - 0x444]
mov word [ebp + ecx*2 - 0x218], ax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x428bb8
lea eax, [ebp - 0x218]
push eax
push 0x4774a8
push dword [ebp - 0x448]
call fcn.0040314f
add esp, 0xc
mov dword [ebp - 0x440], 1
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [esi - 0x10]
call fcn.0040285d
jmp 0x428e19
mov ecx, dword [ebp - 0x42c]
cmp dword [ecx - 0xc], eax
je 0x428e19
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x424]
call fcn.00402773
mov byte [ebp - 4], 0xa
call fcn.0042a8d7
push eax
lea ecx, [ebp - 0x430]
call fcn.00402773
push 0x4778ac
lea esi, [ebp - 0x42c]
mov byte [ebp - 4], 0xb
call fcn.004068da
mov edi, eax
mov eax, dword [ebp - 0x42c]
mov esi, dword [eax - 0xc]
push edi
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x42c]
call fcn.00402e80
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 0xc
call fcn.0040270e
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.0040285d
sub esi, edi
dec esi
push esi
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040692c
push eax
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 0xd
call fcn.0040270e
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, dword [ebp - 0x424]
xor esi, esi
cmp dword [eax - 0xc], esi
je 0x428df7
mov eax, dword [ebp - 0x430]
cmp dword [eax - 0xc], esi
je 0x428df7
push eax
lea eax, [ebp - 0x420]
xor ecx, ecx
push 0x4774a8
push eax
mov word [ebp - 0x218], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.HKEY_USERS
lea ecx, [ebp - 0x424]
call fcn.00408c1b
test eax, eax
jne 0x428d08
mov eax, SysStringLen
jmp 0x428d59
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x424]
call fcn.00408c1b
test eax, eax
jne 0x428d23
mov eax, SysReAllocString
jmp 0x428d59
push 0x47b664
lea ecx, [ebp - 0x424]
call fcn.00408c1b
test eax, eax
jne 0x428d3e
mov eax, SysStringLen
jmp 0x428d59
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x424]
call fcn.00408c1b
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
lea ecx, [ebp - 0x420]
push ecx
push eax
lea esi, [ebp - 0x43c]
mov byte [ebp - 4], 0xe
call fcn.0040c3bc
test eax, eax
jne 0x428de1
mov eax, esi
push 0x47741c
push eax
lea esi, [ebp - 0x428]
lea edi, [ebp - 0x218]
mov dword [ebp - 0x428], 0x104
call fcn.0040c3f3
mov ecx, dword [ebp - 0x428]
xor eax, eax
mov word [ebp + ecx*2 - 0x218], ax
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x428de1
mov eax, edi
push eax
push 0x4774a8
push dword [ebp - 0x448]
call fcn.0040314f
add esp, 0xc
mov dword [ebp - 0x440], 1
lea ecx, [ebp - 0x43c]
call fcn.0040c3a1
lea ecx, [ebp - 0x43c]
call fcn.0040c3a1
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.0040285d
mov ecx, dword [ebp - 0x424]
add ecx, 0xfffffff0
jmp 0x428be3
mov ebx, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x42c]
add ecx, 0xfffffff0
call fcn.0040285d
lea ecx, [ebx - 0x10]
call fcn.0040285d
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.0040285d
mov eax, dword [ebp - 0x440]
call fcn.0045187a
ret