Function at 0x428ebe
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
xor ebx, ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x614], ebx
inc edi
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 0x628], ebx
mov dword [ebp - 0x624], ebx
mov dword [ebp - 0x620], ebx
mov dword [ebp - 0x61c], ebx
mov dword [ebp - 0x618], ebx
test ecx, ecx
je 0x429388
push ecx
push 0x403130
push 0x409814
lea eax, [ebp - 0x4d4]
push 0x103
push eax
call fcn.00418481
add esp, 0x14
test eax, eax
js 0x429388
lea eax, [ebp - 0x614]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x4d4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x429388
lea eax, [ebp - 0x610]
mov dword [ebp - 0x608], ebx
push eax
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0x610], 0x208
push eax
lea eax, [ebp - 0x60c]
mov dword [ebp - 0x60c], edi
push eax
push ebx
push 0x403074
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42907a
cmp dword [ebp - 0x60c], edi
jne 0x42907a
lea esi, [ebp - 0x4d4]
push esi
mov edx, 0x95
lea ecx, [ebp - 0x13c]
call fcn.00418392
lea eax, [ebp - 0x13c]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x428fe9
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x13c]
push eax
push 0x403130
push 0x4045a8
lea eax, [ebp - 0x2cc]
push 0xc7
push eax
call fcn.00418481
add esp, 0x14
test eax, eax
js 0x42905f
push ebx
lea eax, [ebp - 0x608]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2cc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x429061
push 8
push 0x401b58
push 1
push ebx
push 0x403eb0
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x429061
mov edi, ebx
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42907a
add esi, 2
jmp 0x428fbe
lea eax, [ebp - 0x610]
mov dword [ebp - 0x610], 0x208
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x60c]
push eax
push ebx
push 0x406438
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42917a
cmp dword [ebp - 0x60c], 1
jne 0x42917a
lea esi, [ebp - 0x4d4]
push esi
mov edx, 0x95
lea ecx, [ebp - 0x13c]
call fcn.00418392
lea eax, [ebp - 0x13c]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4290f1
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x13c]
push eax
push 0x403130
push 0x4066b4
lea eax, [ebp - 0x2cc]
push 0xc7
push eax
call fcn.00418481
add esp, 0x14
lea eax, [ebp - 0x608]
push ebx
push eax
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2cc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x429161
push 8
push 0x401b58
push 1
push ebx
push 0x403eb0
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42917a
add esi, 2
jmp 0x4290c6
lea eax, [ebp - 0x610]
mov dword [ebp - 0x610], 0x208
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x60c]
push eax
push ebx
push 0x406450
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42927a
cmp dword [ebp - 0x60c], 1
jne 0x42927a
lea esi, [ebp - 0x4d4]
push esi
mov edx, 0x95
lea ecx, [ebp - 0x13c]
call fcn.00418392
lea eax, [ebp - 0x13c]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4291f1
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x13c]
push eax
push 0x403130
push 0x40414c
lea eax, [ebp - 0x2cc]
push 0xc7
push eax
call fcn.00418481
add esp, 0x14
lea eax, [ebp - 0x608]
push ebx
push eax
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2cc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x429261
push 8
push 0x401b58
push 1
push ebx
push 0x403eb0
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42927a
add esi, 2
jmp 0x4291c6
lea eax, [ebp - 0x610]
mov dword [ebp - 0x610], 0x208
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x60c]
push eax
push ebx
push 0x406464
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42937a
cmp dword [ebp - 0x60c], 1
jne 0x42937a
lea esi, [ebp - 0x4d4]
push esi
mov edx, 0x95
lea ecx, [ebp - 0x604]
call fcn.00418392
lea eax, [ebp - 0x604]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4292f1
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x604]
push eax
push 0x403130
push 0x40676c
lea eax, [ebp - 0x2cc]
push 0xc7
push eax
call fcn.00418481
add esp, 0x14
lea eax, [ebp - 0x608]
push ebx
push eax
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2cc]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x429361
push 8
push 0x401b58
push 1
push ebx
push 0x403eb0
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x608]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x42937a
add esi, 2
jmp 0x4292c6
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42938a
mov edi, ebx
lea ecx, [ebp - 0x634]
call fcn.00424aa4
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret 4