Function at 0x42de90
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x34]
push edi
mov dword [esp + 0x3c], eax
push ecx
mov eax, esp
add esi, 0x38
mov edi, ecx
mov ebx, edx
mov dword [eax], 0
call fcn.0040ce30
xor ecx, ecx
cmp eax, ecx
jne 0x42dee2
push 0x433664
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [0x43e0dc]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
cmp ebp, ecx
je 0x42df13
push 0x433674
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x38]
push ebp
push 1
push ebx
add eax, 0x38
call fcn.00406920
mov edx, dword [0x43e0dc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x42dff6
cmp edi, ecx
je 0x42df36
mov eax, dword [esp + 0x38]
push edi
push ebx
add eax, 0x38
call fcn.004066e0
mov eax, dword [0x43e0dc]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x42dff6
cmp ebx, ecx
je 0x42df8a
movzx eax, word [ebx]
cmp ax, cx
je 0x42df8a
mov esi, ebx
cmp ax, 0x22
jne 0x42df77
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebx + 2]
push esi
xor ebx, ebx
call ebp
test eax, eax
jle 0x42df77
lea esp, [esp]
cmp word [esi + ebx*2], 0x22
je 0x42df71
push esi
inc ebx
call ebp
cmp ebx, eax
jl 0x42df60
jmp 0x42df77
xor ecx, ecx
mov word [esi + ebx*2], cx
mov eax, dword [esp + 0x38]
push 0
push 1
push esi
add eax, 0x38
call fcn.00406920
jmp 0x42dff6
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
push SysReAllocStringLen
mov ecx, 0x2001f
mov edx, 0x433694
lea esi, [esp + 0x1c]
call fcn.0041c010
test eax, eax
je 0x42e018
push SysReAllocStringLen
mov edx, 0x4336b8
call fcn.0041bfb0
mov dword [esp + 0x3c], 3
mov esi, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42dfd8
push esi
call edi
xor esi, esi
mov ecx, dword [0x43e808]
mov eax, dword [esp + 0x38]
push 0
push 1
push ecx
add eax, 0x38
call fcn.00406920
test esi, esi
je 0x42dff6
push esi
call edi
mov edx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov eax, dword [edi + 0x3c]
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004144e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x40]
call fcn.00414580
test eax, eax
jne 0x42dfbd
mov ebp, 3
cmp dword [esp + 0x3c], ebp
je 0x42dfc5
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0x4336f0
push esi
mov dword [esp + 0x2c], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov edx, eax
sub edx, ecx
cmp edx, 0x1f4
jg 0x42e07c
lea eax, [ecx + 0x1f4]
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov ebx, edx
sub ebx, edi
cmp ebx, 0x1f4
jg 0x42e09a
lea edx, [edi + 0x1f4]
mov dword [esp + 0x28], edx
mov ebx, 0x64
test eax, eax
jl 0x42e0a7
test ecx, ecx
jge 0x42e0b4
mov eax, 0x2bc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], eax
test edi, edi
jl 0x42e0bc
test edx, edx
jge 0x42e0ca
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0x320
jmp 0x42e0d2
cmp edx, 0x1f4
jl 0x42e0f7
cmp eax, 0x1f4
jle 0x42e0f7
mov eax, dword [esp + 0x38]
add eax, 0x3c
push eax
lea eax, [esp + 0x24]
call fcn.0041c080
mov dword [esp + 0x3c], 1
jmp 0x42dfc9
mov dword [esp + 0x3c], ebp
jmp 0x42dfc9