Function at 0x42f194
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x42f19d
mov eax, dword [ebp - 4]
add esp, 0xfffffbf0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x8414], ecx
mov dword [ebp - 0x840c], ecx
mov dword [ebp - 0x8410], ecx
mov dword [ebp - 0x8404], ecx
mov dword [ebp - 0x8408], ecx
mov dword [ebp - 0x8400], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x42f406
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004046a4
lea eax, [ebp - 0x205]
mov edx, 0x42f41c
call fcn.0040938c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x205]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
mov ebx, eax
test ebx, ebx
jne 0x42f3e8
push ebp
push 0x42f3e1
push dword fs:[0]
mov dword fs:[0], esp
xor esi, esi
lea eax, [ebp - 0x3fa]
xor ecx, ecx
mov edx, 0x1f5
call fcn.004030c4
mov dword [ebp - 0xc], 0x7fff
lea eax, [ebp - 0x83fa]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004030c4
mov dword [ebp - 8], 0x1f5
xor eax, eax
lea edx, [ebp - 0xc]
push edx
lea edx, [ebp - 0x83fa]
push edx
push edi
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x3fa]
push eax
push esi
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
inc esi
test ebx, ebx
jne 0x42f2b7
lea edx, [ebp - 0x8400]
lea eax, [ebp - 0x3fa]
call fcn.004094c8
mov eax, dword [ebp - 0x8400]
mov edx, 0x42f458
call fcn.00404ac0
jne 0x42f239
test ebx, ebx
jne 0x42f3ca
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x8408]
call fcn.004087d0
mov ecx, dword [ebp - 0x8408]
lea eax, [ebp - 0x8404]
mov edx, 0x42f47c
call fcn.004049c0
mov eax, dword [ebp - 0x8404]
call fcn.00404b74
push eax
call fcn.0041d9a4
lea eax, [ebp - 0x83fa]
push eax
call fcn.0041d9a4
mov edx, dword [ebp - 0xc]
dec edx
test edx, edx
jle 0x42f346
lea eax, [ebp - 0x83fa]
cmp byte [eax], 0
jne 0x42f326
cmp byte [eax + 1], 0
jne 0x42f326
mov byte [eax], 0x3d
mov byte [eax + 1], 9
jmp 0x42f342
mov cl, byte [eax]
test cl, cl
jne 0x42f33b
cmp byte [eax + 1], 0x21
jne 0x42f33b
mov byte [eax], 0x3d
mov byte [eax + 1], 0x21
jmp 0x42f342
test cl, cl
jne 0x42f342
mov byte [eax], 9
inc eax
dec edx
jne 0x42f312
mov eax, dword [ebp - 0xc]
mov byte [ebp + eax - 0x83fa], 0
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x83fa]
call fcn.004094c8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404974
lea edx, [ebp - 0x8410]
call fcn.004086e4
mov ecx, dword [ebp - 0x8410]
lea eax, [ebp - 0x840c]
mov edx, 0x42f494
call fcn.004049c0
mov eax, dword [ebp - 0x840c]
call fcn.00404b74
push eax
call fcn.0041d9a4
mov al, byte [0x42f4a4]
push eax
lea eax, [ebp - 0x8414]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, 0x42f4b0
mov edx, 0x42f4bc
call fcn.0040d934
mov edx, dword [ebp - 0x8414]
mov eax, dword [ebp - 4]
call fcn.004046f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f3e8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f40d
lea eax, [ebp - 0x8414]
mov edx, 6
call fcn.004046c8
ret