Function at 0x423d00
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x281c
call fcn.0051f3e0
mov ecx, dword [esp + 0x2824]
mov edx, dword [esp + 0x2820]
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x423d38
xor eax, eax
add esp, 0x281c
ret
mov edx, dword [esp + 0x2828]
push ebx
mov ebx, dword [esp + 0x2830]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x423d74
xor eax, eax
pop ebx
add esp, 0x281c
ret
mov ecx, dword [esp + 4]
push ebp
push esi
push edi
push 0x401
lea eax, [esp + 0x2c]
push eax
xor ebp, ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x423eac
jmp 0x423da0
mov eax, dword [esp + 0x2834]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423db0
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x28]
lea esi, [eax + 2]
jmp 0x423dd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423dd0
sub eax, esi
sar eax, 1
add eax, edx
lea edx, [eax + eax + 4]
push edx
call fcn.0051f5e5
mov ecx, dword [esp + 0x2838]
mov edi, eax
lea eax, [esp + 0x2c]
push eax
push ecx
push 0x5dfa78
push edi
call fcn.00520350
mov eax, ebx
add esp, 0x14
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423e10
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [esp + 0x28]
lea esi, [eax + 2]
jmp 0x423e30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x423e30
sub eax, esi
sar eax, 1
add eax, edx
lea edx, [eax + eax + 4]
push edx
call fcn.0051f5e5
mov esi, eax
lea eax, [esp + 0x2c]
push eax
push ebx
push 0x5dfa78
push esi
call fcn.00520350
mov ecx, dword [esp + 0x284c]
mov edx, dword [esp + 0x2844]
push esi
push ecx
push edi
push edx
call fcn.00423d00
push edi
call fcn.0051d4db
push esi
call fcn.0051d4db
inc ebp
add esp, 0x2c
cmp ebp, 0x186a0
jg 0x423eac
mov ecx, dword [esp + 0x10]
push 0x401
lea eax, [esp + 0x2c]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x423da0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor edi, edi
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x24]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x840]
push ecx
push eax
push edx
mov dword [esp + 0x34], 0x1000
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call ebp
test eax, eax
jne 0x423f74
mov eax, dword [esp + 0x18]
push eax
call fcn.0051f5e5
inc dword [esp + 0x18]
add esp, 4
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
push esi
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x840]
push ecx
push 0
push edx
call ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push esi
push ecx
push 0
lea edx, [esp + 0x83c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x82c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
call fcn.0051d4db
inc edi
add esp, 4
cmp edi, 0x186a0
jg 0x423f74
test ebx, ebx
je 0x423eb4
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov ecx, dword [esp + 0x20]
push ecx
call esi
mov edx, dword [esp + 0x2834]
mov eax, dword [esp + 0x2830]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x281c
ret