Function at 0x42c722
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x4a3279
call fcn.0045a829
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x4c13a0
mov dword [ebp - 0x18], 0x4c18a4
call fcn.00403f50
push 0x4ac888
mov dword [ebp - 4], ebx
call fcn.0045a534
pop ecx
push eax
push ebx
push 0x4ac888
lea ecx, [edi + 4]
call fcn.004068b0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.00435e62
call fcn.00444d04
inc ebx
test al, al
je 0x42c7d8
test byte [ebp - 0xac], bl
je 0x42c7c9
mov edi, 0x200
jmp 0x42c7d8
test byte [ebp - 0xac], 2
mov eax, pe_nt_image_headers32
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x42cbcc
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00404580
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00402b90
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401ac0
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42c83b
mov esi, SysReAllocStringLen
jmp 0x42c8cd
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42c853
mov esi, SysFreeString
jmp 0x42c8cd
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42c86b
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x42c8cd
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42c883
mov esi, SysFreeString
jmp 0x42c8cd
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42c89b
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x42c8cd
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42c8b3
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x42c8cd
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.0043291f
test eax, eax
jne 0x42cbcc
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404580
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402b90
lea ecx, [ebp - 0xa0]
call fcn.00401ac0
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004018f0
test eax, eax
jne 0x42cba3
cmp dword [ebp + 8], ebx
jne 0x42c951
cmp dword [ebp + 0xc], ebx
jmp 0x42ca32
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x42c96e
mov eax, dword [edi]
jmp 0x42c970
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ca3c
cmp dword [ebp - 0xb4], 4
jne 0x42ca45
cmp dword [ebp - 0xb0], 4
jne 0x42ca45
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.00435e62
mov eax, dword [ebp + 0xc]
dec eax
je 0x42ca26
dec eax
je 0x42ca15
dec eax
dec eax
je 0x42ca04
sub eax, 0xc
je 0x42c9f6
sub eax, 0x10
jne 0x42cbbf
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x42ca35
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x42ca2c
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x42ca35
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x42ca35
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x42cbbf
cmp eax, 2
je 0x42cba3
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x4c11c8
call fcn.004091b8
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42ca74
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.004091b8
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.004091b8
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.00447c72
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x42cada
mov eax, dword [esi]
jmp 0x42cadc
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00412a67
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x42cb32
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402ce0
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.0042c0ed
jmp 0x42cb43
cmp dword [esi + 0x14], 8
jb 0x42cb3a
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.00423430
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x42cb58
lea ecx, [ebp - 0xa0]
call fcn.00401ac0
mov eax, dword [ebp + 0xc]
dec eax
je 0x42cb92
dec eax
je 0x42cb8b
dec eax
dec eax
je 0x42cb84
sub eax, 4
je 0x42cb80
sub eax, 8
je 0x42cb78
sub eax, 0x10
jne 0x42cb99
test esi, esi
jmp 0x42cb7b
cmp edi, 0xffffffff
setne al
jmp 0x42cb97
test edi, edi
jmp 0x42cb94
test esi, esi
setg al
jmp 0x42cb97
test esi, esi
sets al
jmp 0x42cb97
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401b80
jmp 0x42cbbf
cmp dword [ebp + 8], ebx
jne 0x42cbb1
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x42cbbf
cmp dword [ebp + 0xc], 2
je 0x42cbbf
cmp dword [ebp + 0xc], 0x20
je 0x42cbbf
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004018c0
jmp 0x42cbce
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401ac0
mov al, bl
call fcn.0045a7d8
ret 0x18