Function at 0x427d40
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x224], ecx
push esi
xor ecx, ecx
push edi
mov dword [ebp - 0x22c], eax
mov esi, edx
cmp eax, ecx
je 0x427f8e
cmp esi, ecx
je 0x427f8e
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x21c], ecx
or eax, edx
cmp dword [ebp + 0xc], 0
mov ecx, 0x82
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x228], 0x104
je 0x427e0d
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push esi
push ebx
call edi
test eax, eax
jne 0x427e0d
mov ecx, dword [ebp - 0x220]
push esi
push str.In_CAERnswareManager::BackupRegKey_____Backup_exist_already_:__s
call fcn.004015d0
mov ecx, dword [ebp - 0x218]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x218]
push edx
push 1
push 0
push eax
push ebx
call edi
push 0
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 2
push 0
push 0
push 0
push esi
push ebx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test edi, edi
jne 0x427f23
test eax, eax
jne 0x427f23
mov edi, dword [ebp - 0x220]
push str.In_CAERnswareManager::BackupRegKey_____going_to_create_backup_keys
mov ecx, edi
call fcn.004015d0
mov esi, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x218]
add esp, 4
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x224], eax
test eax, eax
jne 0x427edb
lea edx, [ebp - 0x214]
push edx
push esi
push str.In_CAERnswareManager::BackupRegKey_____backing_key:_s__value:_s
mov ecx, edi
call fcn.004015d0
mov eax, dword [ebp - 0x228]
mov edx, dword [ebp - 0x21c]
add esp, 0xc
push eax
lea ecx, [ebp - 0x214]
push ecx
push 4
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x427f38
mov dword [ebp - 0x230], 1
jmp 0x427f38
cmp dword [ebp + 0xc], 0
jne 0x427f0b
mov eax, dword [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, edi
test eax, eax
jne 0x427efd
push esi
push str.End_CAERnswareManager::BackupRegKey_____Deleting_value__because_it_wasnt_present_originally_source:_s
jmp 0x427f03
push eax
push str.End_CAERnswareManager::BackupRegKey_____Restoring_the_original_key_failed_error_:__d
call fcn.004015d0
add esp, 8
mov ecx, dword [ebp - 0x224]
push ecx
push str.End_CAERnswareManager::BackupRegKey_____failed_with_src_keys__error:_d
mov ecx, edi
call fcn.004015d0
add esp, 8
jmp 0x427f38
mov ecx, dword [ebp - 0x220]
push eax
push edi
push str.End_CAERnswareManager::BackupRegKey_____failed_with_src_destn_keys__error:_d___d
call fcn.004015d0
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x427f4c
mov edx, dword [ebp - 0x22c]
push edx
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [ebp - 0x218]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x427f69
push eax
call esi
mov dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x427f76
push eax
call esi
mov eax, dword [ebp - 0x230]
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004d5564
mov esp, ebp
pop ebp
ret 0xc