Function at 0x424803
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
push esi
push edi
mov edi, edx
cmp ebx, 1
je 0x424838
cmp ebx, 8
je 0x424838
mov esi, 0x80070057
push esi
jmp 0x424b23
mov eax, dword [0x48ecb8]
test eax, eax
je 0x424846
cmp eax, 0xffffffff
jne 0x424848
mov eax, ecx
push 0x407838
push dword [0x491330]
push eax
call fcn.0041aecf
pop ecx
pop ecx
lea eax, [ebp - 4]
mov edx, 0x406234
push eax
push 0x4078c4
call fcn.00434623
mov esi, eax
test esi, esi
js 0x424832
mov eax, dword [0x48ecb8]
test eax, eax
je 0x424882
cmp eax, 0xffffffff
jne 0x424884
xor eax, eax
push dword [ebp - 4]
push 0x4078e8
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
cmp dword [ebp - 4], ebx
jne 0x424b1b
dec edi
sub edi, 1
je 0x424a05
sub edi, 1
je 0x4248bd
mov esi, 0x80070078
jmp 0x424832
mov eax, dword [0x48ecb8]
test eax, eax
je 0x4248cb
cmp eax, 0xffffffff
jne 0x4248cd
xor eax, eax
push 0x407940
push dword [0x491330]
push eax
call fcn.0041aecf
mov eax, dword [0x48ecb8]
add esp, 0xc
test eax, eax
je 0x4248ef
cmp eax, 0xffffffff
jne 0x4248f1
xor eax, eax
push 0x4079c0
push dword [0x491330]
push eax
call fcn.0041aecf
pop ecx
pop ecx
lea eax, [ebp - 8]
mov ebx, 0x406234
push eax
push 0x407a38
mov edx, ebx
call fcn.00434623
mov esi, eax
test esi, esi
js 0x424832
mov esi, dword [ebp - 8]
mov edi, 0x407800
mov ecx, edi
test esi, esi
jne 0x424936
mov ecx, 0x407808
mov eax, dword [0x48ecb8]
test eax, eax
je 0x424944
cmp eax, 0xffffffff
jne 0x424946
xor eax, eax
push ecx
push 0x407a50
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
test esi, esi
je 0x424b1b
mov eax, dword [0x48ecb8]
test eax, eax
je 0x424971
cmp eax, 0xffffffff
jne 0x424973
xor eax, eax
push 0x407a98
push dword [0x491330]
push eax
call fcn.0041aecf
pop ecx
pop ecx
lea eax, [ebp - 0xc]
mov edx, ebx
push eax
push 0x407b18
call fcn.00434623
mov esi, eax
test esi, esi
js 0x424832
mov eax, dword [0x48ecb8]
test eax, eax
je 0x4249ae
cmp eax, 0xffffffff
jne 0x4249b0
xor eax, eax
mov ebx, dword [ebp - 0xc]
push ebx
push 0x407b38
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
mov ecx, edi
test ebx, ebx
jns 0x4249d3
mov ecx, 0x407808
mov eax, dword [0x48ecb8]
test eax, eax
je 0x4249e1
cmp eax, 0xffffffff
jne 0x4249e3
xor eax, eax
push ecx
push 0x407b8c
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
test ebx, ebx
jns 0x424af7
jmp 0x424b1b
mov eax, dword [0x48ecb8]
cmp ebx, 1
jne 0x424afc
test eax, eax
je 0x424a1c
cmp eax, 0xffffffff
jne 0x424a1e
xor eax, eax
push 0x407bc8
push dword [0x491330]
push eax
call fcn.0041aecf
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
add esp, 0xc
mov edx, 0x406234
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push eax
push 1
call fcn.004364d8
mov ebx, dword [ebp - 0xc]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
jns 0x424a5f
push esi
call fcn.004321e3
jmp 0x424aa2
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0x407c44
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
mov ecx, eax
sub ecx, edi
je 0x424a9c
dec ecx
sub ecx, 1
je 0x424a98
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004324b0
mov esi, dword [ebp - 4]
test eax, eax
jne 0x424a9f
jmp 0x424a57
xor edi, edi
jmp 0x424a9f
xor edi, edi
inc edi
mov dword [ebp - 0x10], edi
push esi
call fcn.00432150
test ebx, ebx
je 0x424ab3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x424832
mov ebx, dword [ebp - 0x10]
mov edi, 0x407800
mov ecx, edi
test ebx, ebx
jne 0x424ace
mov ecx, 0x407808
mov eax, dword [0x48ecb8]
test eax, eax
je 0x424adc
cmp eax, 0xffffffff
jne 0x424ade
xor eax, eax
push ecx
push 0x407c68
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
test ebx, ebx
je 0x424b1b
xor ebx, ebx
inc ebx
jmp 0x424b30
test eax, eax
je 0x424b05
cmp eax, 0xffffffff
jne 0x424b07
xor eax, eax
push 0x407ca0
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0xc
mov eax, 0x80070032
mov esi, eax
push eax
call fcn.004321e3
mov ebx, dword [ebp - 0x14]
mov edi, 0x407808
mov eax, dword [0x48ecb8]
test eax, eax
je 0x424b3e
cmp eax, 0xffffffff
jne 0x424b40
xor eax, eax
push edi
push 0x407d2c
push dword [0x491330]
push eax
call fcn.0041aecf
add esp, 0x10
push esi
call fcn.00432150
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret