Function at 0x4286d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x463f4b
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x103c
call fcn.004412d0
mov eax, dword [0x47a4a4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1030], ebx
mov dword [ebp - 0x1024], 0
mov esi, dword [ebx + 0x54]
neg esi
sbb esi, esi
and esi, 0x100
or esi, 0x20019
lea edi, [ebx + 0x20]
push 0
push 0x4669cc
mov eax, dword [edi + 0x14]
push eax
push 0
mov ecx, edi
call fcn.004027b0
test eax, eax
jne 0x428788
mov dword [ebp - 0x1018], eax
cmp dword [ebx + 0x1c], 8
jb 0x428757
mov eax, dword [ebx + 8]
jmp 0x42875a
lea eax, [ebx + 8]
lea ecx, [ebp - 0x1018]
push ecx
push esi
push 0
push eax
mov edx, dword [ebx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42877c
mov dword [ebp - 0x1024], 1
mov eax, dword [ebp - 0x1018]
push eax
jmp 0x4288f4
mov dword [ebp - 0x1020], 0
cmp dword [ebx + 0x1c], 8
jb 0x42879d
mov eax, dword [ebx + 8]
jmp 0x4287a0
lea eax, [ebx + 8]
lea ecx, [ebp - 0x1020]
push ecx
push esi
push 0
push eax
mov edx, dword [ebx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4288ed
xor ecx, ecx
mov dword [ebp - 0x1018], ecx
mov dword [ebp - 0x101c], ecx
cmp dword [edi + 0x18], 8
jb 0x4287d5
mov eax, dword [edi + 4]
jmp 0x4287d8
lea eax, [edi + 4]
lea edx, [ebp - 0x101c]
push edx
push ecx
lea edx, [ebp - 0x1018]
push edx
push ecx
push eax
mov eax, dword [ebp - 0x1020]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
je 0x428807
cmp eax, 0xea
jne 0x4288ed
cmp dword [ebp - 0x101c], 0x1000
jae 0x4288ed
mov ecx, dword [ebp - 0x1018]
mov dword [ebx + 0x4c], ecx
mov byte [ebp - 0x1014], 0
push 0xfff
push 0
lea edx, [ebp - 0x1013]
push edx
call fcn.00440910
add esp, 0xc
cmp dword [edi + 0x18], 8
jb 0x428848
mov edi, dword [edi + 4]
jmp 0x42884b
add edi, 4
lea eax, [ebp - 0x101c]
push eax
lea ecx, [ebp - 0x1014]
push ecx
lea edx, [ebp - 0x1018]
push edx
push 0
push edi
mov eax, dword [ebp - 0x1020]
push eax
call esi
mov eax, dword [ebx + 0x4c]
dec eax
cmp eax, 6
ja case.0x428875.3
jmp dword [eax*4 + 0x4289d8]
lea ecx, [ebp - 0x1014]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx + 0x44], eax
test eax, eax
jne case.0x428875.3
mov dword [ebp - 0x1028], str.failed
push 0x474300
lea edx, [ebp - 0x1028]
push edx
call fcn.00440801
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx + 0x44], eax
test eax, eax
jne case.0x428875.3
mov dword [ebp - 0x102c], str.failed
push 0x474300
lea ecx, [ebp - 0x102c]
push ecx
call fcn.00440801
mov edx, dword [ebp - 0x1014]
mov dword [ebx + 0x44], edx
mov dword [ebp - 0x1024], 1
mov edx, dword [ebp - 0x1020]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1024]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00440721
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
lea esi, [ebp - 0x1014]
lea esp, [esp]
cmp dword [ebp - 0x101c], 0
jbe 0x4289ae
cmp word [esi], 0
je 0x42896d
push esi
lea ecx, [ebp - 0x104c]
call fcn.00409040
mov byte [ebp - 4], 1
lea eax, [ebp - 0x104c]
push eax
lea ecx, [ebx + 0x5c]
call fcn.0040f370
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x104c]
call fcn.004052b0
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428972
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x428990
sub eax, edx
sar eax, 1
mov ecx, 0xffffffff
sub ecx, eax
add dword [ebp - 0x101c], ecx
jmp 0x428930
mov dword [ebp - 4], 0xffffffff
jmp case.0x428875.3