Function at 0x427e10
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48ae82
push eax
mov dword fs:[0], esp
sub esp, 0x120
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004834fa
mov ebp, dword [eax + 4]
mov ebx, 1
cmp dword [ebp + 0x104], ebx
jne 0x427e4d
push 0x4af518
jmp 0x427e52
push 0x4af50c
push 0x47f
mov ecx, esi
call fcn.0047b5e7
cmp dword [ebp + 0xfc], ebx
jne 0x427e6d
push 0x4af504
jmp 0x427e72
push 0x4af4f8
push 0x481
mov ecx, esi
call fcn.0047b5e7
mov eax, dword [ebp + 0xe8]
test eax, eax
jne 0x427f37
cmp dword [ebp + 0x104], ebx
jne 0x427f37
cmp dword [ebp + 0xfc], ebx
jne 0x427f37
push 5
push 0x4f4
mov ecx, esi
mov dword [esi + 0x131c], ebx
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 5
push 0x473
mov ecx, esi
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 0
push 0x4f5
mov ecx, esi
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 0x4afd08
push 0x471
mov ecx, esi
call fcn.0047b5e7
push 0x4afcdc
push 0x472
mov ecx, esi
call fcn.0047b5e7
push ebx
push 0x44
lea edi, [esi + 0x5c]
push 0x40
push 0x37
push 0x11
mov ecx, edi
call fcn.0047b777
push 0xbc
push 0xbc
push 0xbc
push 0xbc
jmp 0x4280a6
cmp eax, ebx
jne 0x428003
mov eax, dword [ebp + 0x104]
test eax, eax
jne 0x428003
mov eax, dword [ebp + 0xfc]
test eax, eax
jne 0x428003
push 0
push 0x4f4
mov ecx, esi
mov dword [esi + 0x131c], 3
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 0
push 0x473
mov ecx, esi
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 5
push 0x4f5
mov ecx, esi
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 0x4afcd4
push 0x471
mov ecx, esi
call fcn.0047b5e7
push 0x4afcac
push 0x472
mov ecx, esi
call fcn.0047b5e7
push 0x4afc80
push 0x4f5
mov ecx, esi
call fcn.0047b5e7
push ebx
push 0x44
lea edi, [esi + 0x5c]
push 0x43
push 0x37
push 0x11
mov ecx, edi
call fcn.0047b777
push 0xbe
push 0xbe
push 0xbe
push 0xbe
jmp 0x4280a6
push 0
push 0x4f4
mov ecx, esi
mov dword [esi + 0x131c], 2
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 0
push 0x473
mov ecx, esi
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 5
push 0x4f5
mov ecx, esi
call fcn.0047b58f
mov ecx, eax
call fcn.0047b807
push 0x4afc78
push 0x471
mov ecx, esi
call fcn.0047b5e7
push 0x4afc4c
push 0x472
mov ecx, esi
call fcn.0047b5e7
push 0x4afc80
push 0x4f5
mov ecx, esi
call fcn.0047b5e7
push ebx
push 0x44
lea edi, [esi + 0x5c]
push 0x43
push 0x37
push 0x11
mov ecx, edi
call fcn.0047b777
push 0xbd
push 0xbd
push 0xbd
push 0xbd
mov ecx, edi
call fcn.00459400
mov eax, dword [0x4b20c8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x138], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xd4]
lea ecx, [esp + 0x1c]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x144], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42824d
lea edx, [esp + 0x28]
lea eax, [esp + 0x30]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x30]
push eax
push ecx
push 0
push str.Adware_Scan_Day
push edx
mov dword [esp + 0x40], 0xff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42821e
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push 0x4ad12c
push ecx
call fcn.0047617b
add esp, 0xc
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push 0xa
push edx
call fcn.00475d5b
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x13c], 2
call fcn.0047c22c
lea ecx, [esp + 0x18]
mov byte [esp + 0x138], bl
call fcn.0047c0f3
lea eax, [esp + 0x24]
push 2
push eax
lea ecx, [esp + 0x18]
call fcn.00475cdf
mov edi, eax
push 2
lea ecx, [esp + 0x24]
push 5
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x144], 3
call fcn.00475c49
mov ebp, eax
lea edx, [esp + 0x18]
push 4
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x140], 4
call fcn.00475d5b
mov ecx, dword [edi]
mov edx, dword [ebp]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
push 0x4af4e8
push ecx
mov byte [esp + 0x14c], 5
call fcn.0047617b
add esp, 0x14
lea ecx, [esp + 0x18]
mov byte [esp + 0x138], 4
call fcn.0047c0f3
lea ecx, [esp + 0x20]
mov byte [esp + 0x138], 3
call fcn.0047c0f3
lea ecx, [esp + 0x24]
mov byte [esp + 0x138], bl
call fcn.0047c0f3
mov edx, dword [esp + 0x14]
mov ecx, esi
push edx
push 0x473
call fcn.0047b5e7
mov eax, dword [esp + 0x14]
push eax
push 0x483
jmp 0x428239
push 0x4af4d8
push 0x483
mov ecx, esi
call fcn.0047b5e7
push 0x4af4d8
push 0x473
mov ecx, esi
call fcn.0047b5e7
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42826f
push 0x4af4d8
push 0x483
mov ecx, esi
call fcn.0047b5e7
push 0x4af4d8
push 0x473
mov ecx, esi
call fcn.0047b5e7
lea ecx, [esp + 0x14]
mov byte [esp + 0x138], 0
call fcn.0047c0f3
lea ecx, [esp + 0x10]
mov dword [esp + 0x138], 0xffffffff
call fcn.0047c0f3
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x12c
ret