Function at 0x42d840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x474ad9
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x107c
call fcn.00462790
mov eax, dword [0x48a3c0]
xor eax, esp
mov dword [esp + 0x1078], eax
push ebx
push esi
push edi
mov eax, dword [0x48a3c0]
xor eax, esp
push eax
lea eax, [esp + 0x1090]
mov dword fs:[0], eax
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, 1
mov dword [0x49125c], eax
mov dword [0x4912a4], eax
lea eax, [esp + 0x10]
push eax
push 0x4912a4
lea ecx, [esp + 0x20]
push ecx
push str.poprate
xor esi, esi
push str.SOFTWARE360SafeLeak
mov ebx, 4
push SysReAllocStringLen
mov dword [0x490c28], esi
mov dword [0x490c2c], esi
mov dword [0x491254], esi
mov dword [0x491258], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
lea edx, [esp + 0x10]
push edx
push 0x4912a8
lea eax, [esp + 0x20]
push eax
push str.c_poprate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x4912a8], 1
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x47c5bc
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x490c34], 1
mov dword [0x490c30], esi
mov dword [0x490c38], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x42d97c
cmp dword [esp + 0x14], ebx
jne 0x42d97c
mov eax, dword [esp + 0x1c]
cmp eax, 2
jne 0x42d970
mov dword [0x490c34], esi
jmp 0x42d986
cmp eax, 1
jne 0x42d986
mov dword [0x490c30], eax
jmp 0x42d986
mov dword [0x490c38], 1
lea ecx, [esp + 0x10]
push ecx
push 0x48ccfc
lea edx, [esp + 0x20]
push edx
push str.sendlevel
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x48ccfc], 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
lea eax, [esp + 0x10]
push eax
push 0x491288
lea ecx, [esp + 0x20]
push ecx
push str.autofixtip
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x491288], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
lea edx, [esp + 0x10]
push edx
push 0x491264
lea eax, [esp + 0x20]
push eax
push str.ExaminScan
push str.SOFTWARE360SafeLeak
mov esi, 1
push SysReAllocStringLen
mov dword [0x491264], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
lea ecx, [esp + 0x10]
push ecx
push 0x491260
lea edx, [esp + 0x20]
push edx
push 0x47c610
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x491260], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
call edi
lea eax, [esp + 0x10]
push eax
push 0x491290
lea ecx, [esp + 0x1c]
push ecx
push str.popwidth
push str.SOFTWARE360SafeLeak
mov esi, 0x17d
push SysReAllocStringLen
mov dword [0x491290], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x42da9a
cmp dword [esp + 0x14], ebx
jne 0x42da9a
mov eax, dword [0x491290]
cmp eax, 0x3e8
ja 0x42da94
cmp eax, esi
jae 0x42da9a
mov dword [0x491290], esi
lea edx, [esp + 0x10]
push edx
push 0x491294
lea eax, [esp + 0x1c]
push eax
push str.popheight
push str.SOFTWARE360SafeLeak
mov esi, 0x1a9
push SysReAllocStringLen
mov dword [0x491294], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x42daed
cmp dword [esp + 0x14], ebx
jne 0x42daed
mov eax, dword [0x491294]
cmp eax, 0x3e8
ja 0x42dae7
cmp eax, esi
jae 0x42daed
mov dword [0x491294], esi
lea ecx, [esp + 0x10]
push ecx
push 0x491298
lea edx, [esp + 0x1c]
push edx
push str.poppos
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x491298], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x42db48
cmp dword [esp + 0x14], ebx
jne 0x42db48
mov eax, dword [0x491298]
cmp eax, 1
jge 0x42db48
mov esi, 5
cmp eax, esi
jle 0x42db4d
mov dword [0x491298], 1
jmp 0x42db4d
mov esi, 5
lea eax, [esp + 0x10]
push eax
push 0x49129c
lea ecx, [esp + 0x1c]
push ecx
push str.edgedistx
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x49129c], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x42db94
cmp dword [esp + 0x14], ebx
jne 0x42db94
cmp dword [0x49129c], 0x32
jbe 0x42db94
mov dword [0x49129c], esi
lea edx, [esp + 0x10]
push edx
push 0x4912a0
lea eax, [esp + 0x1c]
push eax
push str.edgedisty
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [0x4912a0], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x42dbdb
cmp dword [esp + 0x14], ebx
jne 0x42dbdb
cmp dword [0x4912a0], 0x32
jbe 0x42dbdb
mov dword [0x4912a0], esi
xor esi, esi
push 0xffe
lea edx, [esp + 0x8a]
xor ecx, ecx
push esi
push edx
mov dword [0x4912ac], esi
mov dword [esp + 0x54], 1
mov word [esp + 0x90], cx
call fcn.00462160
add esp, 0xc
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x50]
push edx
push str.pday_s
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x64], 0x1000
call edi
test eax, eax
jne 0x42e025
cmp dword [esp + 0x48], 1
jne 0x42e025
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x42e025
lea ecx, [esp + 0x30]
push ecx
call fcn.004442c0
push ecx
mov dword [esp + 0x109c], esi
mov edx, esp
mov dword [esp + 0x28], esp
push edx
mov ecx, 0x47aeb0
call fcn.00454940
lea eax, [esp + 0x34]
push eax
push ecx
mov ecx, esp
mov byte [esp + 0x10a4], 1
mov dword [esp + 0x1c], esp
push ecx
lea ecx, [esp + 0x94]
call fcn.00454940
mov byte [esp + 0x10a4], 0
call fcn.00427320
mov eax, dword [esp + 0x4c]
sub eax, dword [esp + 0x48]
add esp, 0xc
sar eax, 2
cmp eax, 7
jb 0x42e00f
cmp eax, esi
ja 0x42dcd0
call fcn.004605e2
mov eax, dword [esp + 0x3c]
mov edi, 0x4912b8
call fcn.00452c80
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x3c]
sar edx, 2
cmp edx, 1
ja 0x42dcf3
call fcn.004605e2
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 4]
push eax
call fcn.00461172
mov ecx, dword [esp + 0x44]
sub ecx, dword [esp + 0x40]
add esp, 4
sar ecx, 2
mov dword [esp + 0x24], eax
cmp ecx, 2
ja 0x42dd1c
call fcn.004605e2
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + 8]
sub eax, 0x10
call fcn.00452ce0
add eax, 0x10
mov dword [esp + 0x10], eax
mov byte [esp + 0x1098], 2
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
cmp eax, 3
ja 0x42dd4f
call fcn.004605e2
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx + 0xc]
sub eax, 0x10
call fcn.00452ce0
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x1098], 3
mov edx, dword [esp + 0x40]
sub edx, dword [esp + 0x3c]
sar edx, 2
cmp edx, ebx
ja 0x42dd81
call fcn.004605e2
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 0x10]
sub eax, 0x10
call fcn.00452ce0
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x1098], bl
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
sar ecx, 2
cmp ecx, 5
ja 0x42ddb3
call fcn.004605e2
mov edx, dword [esp + 0x3c]
mov eax, dword [edx + 0x14]
sub eax, 0x10
call fcn.00452ce0
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0x1098], 5
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x3c]
sar eax, 2
cmp eax, 6
ja 0x42dde6
call fcn.004605e2
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx + 0x18]
sub eax, 0x10
call fcn.00452ce0
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x1098], 6
mov edx, dword [0x48e57c]
mov eax, dword [edx + 0xc]
mov ecx, 0x48e57c
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
mov byte [esp + 0x1098], 7
mov dword [esp + 0x4c], 0x7d0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x3e8
or eax, ecx
jge 0x42de51
mov ecx, 0x3e8
lea eax, [esp + 0x1c]
call fcn.004547f0
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x4c]
push ecx
push esi
lea edx, [esp + 0x50]
push edx
push str.lastpdaydate
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0046113d
add esp, 8
test eax, eax
jl 0x42e0db
cmp eax, dword [esi - 8]
jg 0x42e0db
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [0x4912b8]
cmp dword [eax - 0xc], ecx
jle 0x42dfd3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42dfd3
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea esi, [esp + 0x2c]
call fcn.00456120
mov byte [esp + 0x1098], 8
movzx eax, word [esp + 0x5e]
movzx ecx, word [esp + 0x5a]
movzx edx, word [esp + 0x58]
push eax
push ecx
push edx
push str._04d_02d_02d
mov edi, esi
call fcn.004543e0
mov eax, dword [0x4912b8]
mov edi, dword [esp + 0x3c]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
add esp, 0x10
push 8
push eax
push edi
call ebx
mov ecx, dword [esp + 0x10]
push 8
push ecx
push edi
mov esi, eax
call ebx
test esi, esi
jne 0x42df29
movzx edx, word [esp + 0x60]
cmp dword [esp + 0x24], edx
jg 0x42df55
lea eax, [esp + 0x20]
jmp 0x42df33
jle 0x42df55
test eax, eax
jg 0x42df55
lea eax, [esp + 0x50]
mov edi, 0x4912b0
mov dword [0x4912ac], 1
call fcn.00452c80
lea eax, [esp + 0x14]
mov edi, 0x4912b4
call fcn.00452c80
cmp dword [0x4912ac], 0
je 0x42dfca
lea eax, [esp + 0x6c]
push eax
call fcn.004442c0
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1098], 9
call fcn.0042d490
lea ecx, [esp + 0x6c]
push ecx
call fcn.0042d620
mov eax, dword [esp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
call fcn.00452ce0
add eax, 0x10
lea ebx, [esp + 0x70]
mov dword [esi], eax
call fcn.0042d7b0
test eax, eax
jne 0x42dfc1
mov esi, 0x4912b0
mov dword [0x4912ac], eax
call fcn.004546d0
mov esi, 0x4912b4
call fcn.004546d0
lea esi, [esp + 0x6c]
call fcn.00440f60
lea eax, [esp + 0x2c]
call fcn.004568e0
lea eax, [esp + 0x1c]
call fcn.004568e0
lea eax, [esp + 0x14]
call fcn.004568e0
lea eax, [esp + 0x50]
call fcn.004568e0
lea eax, [esp + 0x20]
call fcn.004568e0
lea eax, [esp + 0x18]
call fcn.004568e0
lea eax, [esp + 0x10]
call fcn.004568e0
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea esi, [esp + 0x30]
mov dword [esp + 0x1098], 0xffffffff
call fcn.00440f60
xor esi, esi
push 0xffe
lea eax, [esp + 0x8a]
xor edx, edx
push esi
push eax
mov word [esp + 0x90], dx
call fcn.00462160
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0x18]
push eax
push str.topmostproc_s
push str.SOFTWARE360SafeLeak
push SysReAllocStringLen
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 0x1000
call edi
test eax, eax
jne 0x42e0e5
cmp dword [esp + 0x10], 1
jne 0x42e0e5
cmp dword [esp + 0x18], esi
jbe 0x42e0e5
lea ecx, [esp + 0x24]
push ecx
lea esi, [esp + 0x88]
call fcn.0043bc60
mov dword [esp + 0x1098], 0xa
mov eax, dword [eax]
push eax
mov ecx, 0x490608
call fcn.00439940
mov dword [esp + 0x1098], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42e135
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x42e135
push 0x80070057
call fcn.0045bda0
mov ecx, dword [0x491394]
mov eax, dword [0x491390]
mov dword [esp + 0x24], ecx
cmp eax, ecx
jbe 0x42e108
call fcn.004605e2
mov ecx, dword [0x491394]
mov eax, dword [0x491390]
mov esi, dword [0x491384]
mov ebx, eax
cmp eax, ecx
jbe 0x42e119
call fcn.004605e2
mov ecx, dword [esp + 0x24]
mov edx, dword [0x491384]
push ecx
push esi
push ebx
push edx
push 0x491384
lea ebx, [esp + 0x38]
call fcn.00439880
push 0x208
push 0
push 0x49104c
call fcn.00462160
add esp, 0xc
lea eax, [esp + 0x54]
push eax
push 0x49104c
lea ecx, [esp + 0x70]
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push SysReAllocStringLen
mov dword [esp + 0x6c], 0x208
call edi
test eax, eax
jne 0x42e192
push 0x49104c
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x104
push 0x49104c
push 0x49104c
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp dword [0x49186c], 0
mov dword [esp + 0x20], 0
jne 0x42e1c3
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49186c], eax
test eax, eax
je 0x42e1d5
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x49186c]
cmp dword [esp + 0x20], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
je 0x42e1fa
push str.libleak_64_dif.dat
push 0x49104c
push 0x490c3c
call esi
push str.libleak_64_dif.cab
jmp 0x42e210
push str.libleak_dif.dat
push 0x49104c
push 0x490c3c
call esi
push str.libleak_dif.cab
push 0x49104c
push 0x490e44
call esi
mov ecx, dword [esp + 0x1090]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1078]
xor ecx, esp
call fcn.00460259
mov esp, ebp
pop ebp
ret