Function at 0x4288c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50aa65
mov eax, dword fs:[0]
push eax
mov eax, 0x1ca0
call fcn.00435340
mov eax, dword [0x53b0f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c88], 0
push 0x5112de
lea ecx, [ebp - 0x1c2c]
call fcn.00423820
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c68], 0
lea ecx, [ebp - 0x1c80]
call fcn.0042b5d0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1c68]
push eax
push 8
push 0
push str.SOFTWAREPerfect_World_EntertainmentCore
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42895c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c80]
call fcn.0042b920
jmp 0x428c0f
push 0x400
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.004a2c70
add esp, 0xc
mov dword [ebp - 0x1c74], 0x200
mov dword [ebp - 0x1c6c], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1c74]
push edx
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x1c6c]
push ecx
mov edx, dword [ebp - 0x1c68]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x428b32
mov eax, dword [ebp - 0x1c6c]
add eax, 1
mov dword [ebp - 0x1c6c], eax
push 0x1000
push 0
lea ecx, [ebp - 0x1c10]
push ecx
call fcn.004a2c70
add esp, 0xc
push str.SOFTWAREPerfect_World_EntertainmentCore
lea edx, [ebp - 0x1c10]
push edx
call fcn.004d2ba6
add esp, 8
push 0x5120c4
lea eax, [ebp - 0x1c10]
push eax
call fcn.004d2b75
add esp, 8
lea ecx, [ebp - 0x410]
push ecx
lea edx, [ebp - 0x1c10]
push edx
call fcn.004d2b75
add esp, 8
mov dword [ebp - 0x1c70], 0
lea eax, [ebp - 0x1c70]
push eax
push 1
push 0
lea ecx, [ebp - 0x1c10]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x428b0b
push 0x800
push 0
lea edx, [ebp - 0xc10]
push edx
call fcn.004a2c70
add esp, 0xc
mov dword [ebp - 0x1c84], 0x400
mov dword [ebp - 0x1c8c], 1
mov dword [ebp - 0x1c84], 0x400
lea eax, [ebp - 0x1c84]
push eax
lea ecx, [ebp - 0xc10]
push ecx
lea edx, [ebp - 0x1c8c]
push edx
push 0
push 0x5120c8
mov eax, dword [ebp - 0x1c70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428afe
lea ecx, [ebp - 0xc10]
push ecx
lea ecx, [ebp - 0x1c48]
call fcn.00423890
mov dword [ebp - 0x1c90], eax
mov edx, dword [ebp - 0x1c90]
mov dword [ebp - 0x1c94], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1c94]
push eax
lea ecx, [ebp - 0x1cac]
push ecx
lea ecx, [ebp - 0x1c80]
call fcn.0042b2f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c48]
call fcn.00422090
mov edx, dword [ebp - 0x1c70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c74], 0x200
mov eax, dword [ebp - 0x1c74]
push eax
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.004a2c70
add esp, 0xc
jmp 0x428986
lea ecx, [ebp - 0x1c80]
call fcn.0042c780
test eax, eax
jbe 0x428bf8
lea edx, [ebp - 0x1c78]
push edx
lea ecx, [ebp - 0x1c80]
call fcn.0042c5f0
lea ecx, [ebp - 0x1c78]
call fcn.0042ba30
add eax, 4
push eax
lea ecx, [ebp - 0x1c28]
call fcn.0040c930
push 0x5120dc
lea ecx, [ebp - 0x1c64]
call fcn.00423820
mov dword [ebp - 0x1c98], eax
mov eax, dword [ebp - 0x1c98]
mov dword [ebp - 0x1c9c], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1c9c]
add ecx, 4
push ecx
lea ecx, [ebp - 0x1c28]
call fcn.0040c930
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c64]
call fcn.00422090
push 0
lea edx, [ebp - 0x1ca0]
push edx
lea ecx, [ebp - 0x1c78]
call fcn.0042ba50
lea eax, [ebp - 0x1ca4]
push eax
lea ecx, [ebp - 0x1c80]
call fcn.0042c6b0
push eax
lea ecx, [ebp - 0x1c78]
call fcn.0042b9c0
movzx ecx, al
test ecx, ecx
jne 0x428b57
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c80]
call fcn.0042b920
xor edx, edx
jne 0x42891a
cmp dword [ebp - 0x1c68], 0
je 0x428c2f
mov eax, dword [ebp - 0x1c68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c68], 0
lea ecx, [ebp - 0x1c2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00423970
mov edx, dword [ebp - 0x1c88]
or edx, 1
mov dword [ebp - 0x1c88], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c2c]
call fcn.00422090
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434475
mov esp, ebp
pop ebp
ret