Function at 0x426382
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27ac
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push ecx
push eax
push 0x66c218
mov dword [ebp - 0x27a4], eax
mov esi, 0x400
lea eax, [ebp - 0x278c]
mov dword [ebp - 0x27a0], ecx
push esi
push eax
call fcn.00445d6d
lea eax, [ebp - 0x278c]
mov ebx, str.RecoverDream10PasswordFromRegKey
push eax
push ebx
push str._s_:_Opening_URL__s
call fcn.00449974
add esp, 0x20
lea eax, [ebp - 0x2794]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x278c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x42641f
push eax
lea eax, [ebp - 0x278c]
push eax
push ebx
push str._s_:_Failed_to_open_the_host_key___s___Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x426613
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x279c]
push eax
lea eax, [ebp - 0xc04]
mov dword [ebp - 0x279c], esi
push eax
lea eax, [ebp - 0x2798]
mov byte [ebp - 0xc04], 0
push eax
push 0
push str.Host
push dword [ebp - 0x2794]
call edi
push dword [ebp - 0x2794]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call ebx
test esi, esi
je 0x426484
push esi
mov esi, str.RecoverDream10PasswordFromRegKey
push esi
push str._s_:_RegQueryValueEx_failed_to_read_the_hostname__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x426612
lea eax, [ebp - 0xc04]
mov esi, str.RecoverDream10PasswordFromRegKey
push eax
push esi
push str._s_:_Found_Host__s__now_reading_username_passwords
call fcn.00449974
push dword [ebp - 0x27a0]
lea eax, [ebp - 0x278c]
push dword [ebp - 0x27a4]
push str._s_sKeychain
push 0x400
push eax
call fcn.00445d6d
lea eax, [ebp - 0x278c]
push eax
push esi
push str._s_:_Opening_host_keychain__s
call fcn.00449974
add esp, 0x2c
lea eax, [ebp - 0x2790]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x278c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x426511
push eax
lea eax, [ebp - 0x278c]
push eax
push esi
push str._s_:_Failed_to_open_the_host_key___s___Error0x_.8x
call fcn.00449974
add esp, 0x10
jmp 0x426612
lea eax, [ebp - 0x27a8]
mov dword [ebp - 0x27a8], 0x400
push eax
lea eax, [ebp - 0x404]
xor ecx, ecx
push eax
lea eax, [ebp - 0x2798]
mov byte [ebp - 0x804], cl
push eax
push ecx
push str.User
push dword [ebp - 0x2790]
mov byte [ebp - 0x404], cl
mov byte [ebp - 0x1004], cl
mov byte [ebp - 0x1404], cl
call edi
lea eax, [ebp - 0x27ac]
mov dword [ebp - 0x27ac], 0x400
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x2798]
push eax
push 0
push str.User_PW
push dword [ebp - 0x2790]
call edi
push dword [ebp - 0x2790]
call ebx
lea eax, [ebp - 0x404]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x426605
lea eax, [ebp - 0x804]
push eax
call fcn.00631510
pop ecx
test eax, eax
je 0x426605
lea eax, [ebp - 0x1404]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004096dc
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.004096dc
push 0xffffffffffffffff
mov ecx, 0x66ae5d
lea eax, [ebp - 0x1004]
push ecx
push eax
lea eax, [ebp - 0x1404]
push eax
lea eax, [ebp - 0xc04]
push eax
push ecx
push 0x131
push 4
call fcn.00412c85
add esp, 0x30
jmp 0x426612
push esi
push str._s_:_Could_not_find_both_username_password
call fcn.00449974
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret