Function at 0x42dc50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
xor esi, esi
push 0xffffffffffffffff
xor ecx, ecx
push esi
lea edx, [ebp + 0x44]
mov ebx, 7
xor eax, eax
mov word [ebp - 0x30], cx
push edx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], esi
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
call fcn.0041ed20
push esi
xor eax, eax
push 0x400
lea ecx, [ebp - 0x68]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], esi
mov word [ebp - 0x68], ax
mov dword [ebp - 0x14], 0x800
xor edi, edi
mov dword [ebp - 4], esi
call fcn.00431cb0
lea ecx, [ebp - 0x4c]
push ecx
lea edx, [ebp - 0x10]
push edx
sub esp, 0x1c
mov ecx, esp
push 0xffffffffffffffff
push esi
lea edx, [ebp + 0xc]
xor eax, eax
mov dword [ecx + 0x14], ebx
mov dword [ecx + 0x10], esi
push edx
mov word [ecx], ax
call fcn.0041ed20
call fcn.0042e010
cmp eax, esi
jne 0x42dd4d
cmp dword [ebp - 0x54], 8
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
jb 0x42dcf5
mov eax, dword [ebp - 0x68]
push eax
call edi
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x1c], 8
mov word [ebp - 0x68], cx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], ebx
jb 0x42dd10
mov edx, dword [ebp - 0x30]
push edx
call edi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x38], 8
mov word [ebp - 0x30], ax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ebx
jb 0x42dd2b
mov ecx, dword [ebp - 0x4c]
push ecx
call edi
add esp, 4
mov dword [ebp - 0x3c], esi
xor edx, edx
lea esi, [ebp + 0xc]
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x4c], dx
call fcn.0042dbd0
mov eax, 0x57
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x60
lea eax, [ebp - 0x30]
call fcn.0042df90
test eax, eax
je 0x42dce0
cmp dword [ebp - 0x38], 8
mov eax, dword [ebp - 0x4c]
jae 0x42dd65
lea eax, [ebp - 0x4c]
mov edx, dword [ebp + 0x64]
lea ecx, [ebp - 8]
push ecx
and edx, 0x100
or edx, 0x20019
push edx
push esi
mov esi, dword [ebp - 0x10]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x42de06
cmp dword [ebp - 0x54], 8
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
jb 0x42dda0
mov eax, dword [ebp - 0x68]
push eax
call edi
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x1c], 8
mov esi, 7
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], 0
mov word [ebp - 0x68], cx
jb 0x42ddc4
mov edx, dword [ebp - 0x30]
push edx
call edi
add esp, 4
xor eax, eax
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
jb 0x42dde3
mov ecx, dword [ebp - 0x4c]
push ecx
call edi
add esp, 4
mov dword [ebp - 0x38], esi
xor edx, edx
lea esi, [ebp + 0xc]
mov dword [ebp - 0x3c], 0
mov word [ebp - 0x4c], dx
call fcn.0042dbd0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x60
mov ecx, dword [ebp - 0x68]
mov ebx, 8
cmp dword [ebp - 0x54], ebx
jae 0x42de16
lea ecx, [ebp - 0x68]
mov eax, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], ebx
jae 0x42de21
lea eax, [ebp + 0x28]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x42de44
cmp eax, 2
jne 0x42de6d
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], ebx
jae 0x42de4f
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x54], ebx
jae 0x42de5a
lea eax, [ebp - 0x68]
push ecx
push eax
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
neg edi
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp edi, ebx
je 0x42df13
call fcn.00431f60
mov edx, dword [ebp - 0x30]
mov edi, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], edi
jae 0x42de99
lea edx, [ebp - 0x30]
mov ecx, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x42dea4
lea ecx, [ebp + 0x28]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], edi
jae 0x42deaf
lea eax, [ebp - 0x4c]
cmp esi, ebx
je 0x42df87
mov edi, dword [ebp + 0x64]
push edx
mov edx, dword [ebp + 0x60]
push edx
push ecx
mov ebx, esi
call fcn.0042e300
xor ebx, ebx
mov dword [ebp - 4], eax
test eax, eax
jne 0x42df13
lea edi, [eax + 8]
cmp dword [ebp - 0x10], 6
jb 0x42df18
mov edx, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], edi
jae 0x42dee4
lea edx, [ebp - 0x30]
mov ecx, dword [ebp + 0x28]
cmp dword [ebp + 0x3c], edi
jae 0x42deef
lea ecx, [ebp + 0x28]
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], edi
jae 0x42defa
lea eax, [ebp - 0x4c]
mov edi, dword [ebp + 0x64]
push edi
push edx
mov edx, dword [ebp + 0x60]
push edx
push ecx
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, esi
call fcn.0042e200
mov dword [ebp - 4], eax
mov edi, 8
cmp dword [ebp - 0x54], edi
mov edi, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
jb 0x42df2c
mov ecx, dword [ebp - 0x68]
push ecx
call edi
add esp, 4
xor edx, edx
cmp dword [ebp - 0x1c], 8
mov esi, 7
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x68], dx
jb 0x42df4c
mov eax, dword [ebp - 0x30]
push eax
call edi
add esp, 4
xor ecx, ecx
cmp dword [ebp - 0x38], 8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], cx
jb 0x42df67
mov edx, dword [ebp - 0x4c]
push edx
call edi
add esp, 4
mov dword [ebp - 0x38], esi
xor eax, eax
lea esi, [ebp + 0xc]
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], ax
call fcn.0042dbd0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x60
mov dword [ebp - 4], ebx
jmp 0x42ded3