Function at 0x42a5a2
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2b4], eax
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a8], ecx
test ecx, ecx
jne 0x42a5e1
mov eax, 0x80004005
jmp 0x42a96b
cmp dword [eax + 0x1c], edi
je 0x42a5f4
cmp dword [eax + 0x1c], 1
je 0x42a5f4
xor edi, edi
inc edi
jmp 0x42a969
call fcn.0043fffc
mov ecx, eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x407318
lea eax, [ebp - 0x290]
push 0x208
push eax
call fcn.0040c125
add esp, 0x14
test eax, eax
js 0x42a964
push edi
lea eax, [ebp - 0x2a4]
push eax
push edi
push 3
push edi
push edi
push edi
lea eax, [ebp - 0x290]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42a964
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x2b0], 0x80
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x298], edi
push eax
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x294], edi
push eax
push edi
push 0x406b98
push dword [ebp - 0x2a4]
mov ebx, edi
mov dword [ebp - 0x2ac], 1
mov esi, edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a8c1
cmp dword [ebp - 0x2ac], 1
jne 0x42a8c1
mov dword [ebp - 0x29c], edi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x2a0], edi
jmp 0x42a6d1
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42a6cd
mov eax, esi
sub eax, 1
je 0x42a808
sub eax, 1
je 0x42a7dc
sub eax, 1
je 0x42a7a9
lea eax, [ebp - 0x88]
test esi, esi
je 0x42a71e
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x298], eax
jmp 0x42a82b
inc esi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42a71a
sub esi, 1
je 0x42a794
sub esi, 1
je 0x42a778
sub esi, 1
je 0x42a755
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x29c], eax
jmp 0x42a82b
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404350
jmp 0x42a7ca
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404370
jmp 0x42a7f6
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404388
jmp 0x42a81b
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404308
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x42a82b
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404328
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x42a82b
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404340
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x294]
mov esi, dword [ebp - 0x2a0]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x298]
shl eax, 0x10
mov ebx, ecx
add esi, eax
shr ebx, 0x10
xor eax, eax
shld eax, ebx, 0x10
mov dword [ebp - 0x2a0], eax
movzx eax, cx
mov ecx, dword [ebp - 0x2a0]
shl ebx, 0x10
cdq
or ebx, eax
or ecx, edx
shld ecx, ebx, 0x10
mov eax, esi
shl ebx, 0x10
or ecx, edi
shr eax, 0x10
or ebx, eax
movzx eax, si
shld ecx, ebx, 0x10
cdq
or ecx, edx
shl ebx, 0x10
mov dword [ebp - 0x2a0], ecx
or ebx, eax
mov ecx, dword [ebp - 0x2a8]
call fcn.0041ec22
mov esi, dword [ebp - 0x2a0]
mov ecx, edx
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], ecx
cmp ecx, esi
jb 0x42a956
ja 0x42a8c1
cmp eax, ebx
jbe 0x42a90e
mov edx, dword [ebp - 0x2a8]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x2a8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42a8d2
sub ecx, dword [ebp - 0x2a8]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push edi
push 0x406b98
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x294]
cmp ecx, esi
jb 0x42a956
ja 0x42a918
cmp eax, ebx
jb 0x42a956
mov edx, dword [ebp - 0x2b4]
mov edx, dword [edx + 0x28]
test edx, edx
je 0x42a956
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42a92a
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push edi
push 0x406bb0
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42a969
mov edi, 0x80004005
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret