Function at 0x42b0f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x78
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x49503c]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea edi, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0042d960
add esp, 4
mov eax, dword [edi + 0x18]
test eax, eax
je 0x42b13f
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x1c], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004503b0
mov eax, esi
add esp, 0x78
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm0, qword [ebp - 0x1c]
movsd qword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0x44], xmm0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, 7
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], bx
lea edi, [ebp - 0x5c]
mov dword [edi + 0x14], eax
mov dword [edi + 0x10], ebx
mov word [edi], bx
sub esp, 0xc
mov al, byte [ebp - 0x74]
mov byte [esp + 4], al
mov dword [esp + 8], str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov dword [esp], 0x2e
mov ecx, edi
call fcn.00452270
cmp dword [ebp + 0xc], 0
je 0x42b24b
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
cmp ecx, eax
je 0x42b1bf
lea edx, [eax + 1]
mov dword [ebp - 0x4c], edx
cmp ecx, 7
jbe 0x42b1b0
mov edi, dword [ebp - 0x5c]
mov word [edi + eax*2], 0x5c
mov word [edi + eax*2 + 2], 0
jmp 0x42b1e3
sub esp, 0x10
mov al, byte [ebp - 0x74]
mov byte [esp + 4], al
xor eax, eax
inc eax
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], 0x490144
lea ecx, [ebp - 0x5c]
call fcn.004520d0
push dword [ebp + 0xc]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x48]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x42b22b
lea edi, [ecx + eax]
mov dword [ebp - 0x4c], edi
cmp edx, 7
jbe 0x42b20c
mov ebx, dword [ebp - 0x5c]
jmp 0x42b20f
lea ebx, [ebp - 0x5c]
lea ecx, [ebx + ecx*2]
add eax, eax
push eax
push dword [ebp + 0xc]
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [ebx + edi*2], 0
xor ebx, ebx
jmp 0x42b24b
sub esp, 0x10
mov cl, byte [ebp - 0x74]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov ecx, dword [ebp + 0xc]
mov dword [esp + 8], ecx
mov dword [esp], eax
lea ecx, [ebp - 0x5c]
call fcn.004520d0
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x30], 7
jbe 0x42b259
mov eax, dword [ebp - 0x44]
jmp 0x42b25c
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], 7
jbe 0x42b267
mov ecx, dword [ebp - 0x5c]
jmp 0x42b26a
lea ecx, [ebp - 0x5c]
lea edi, [ebp - 0x7c]
push edi
push ebx
push ebx
push 2
push eax
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x42b29e
cmp eax, 2
jne 0x42b2cf
xorps xmm0, xmm0
movups xmmword [esi + 9], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x1c], 0
jmp 0x42b4bb
mov ebx, dword [ebp - 0x7c]
shr ebx, 1
inc ebx
xor eax, eax
dec eax
add ebx, ebx
cmovb ebx, eax
push ebx
call fcn.0044fc05
add esp, 4
xor ecx, ecx
push ebx
mov ebx, eax
push ecx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp - 0x30], 7
jbe 0x42b300
mov eax, dword [ebp - 0x44]
jmp 0x42b303
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov ecx, edi
mov edx, str.RegistryGetValueString
push 0x45
call fcn.0042bc70
add esp, 4
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x1c], edi
jmp 0x42b4bb
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x48], 7
jbe 0x42b30e
mov ecx, dword [ebp - 0x5c]
jmp 0x42b311
lea ecx, [ebp - 0x5c]
push edi
push ebx
xor edx, edx
push edx
push 2
push eax
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x42b35c
mov edi, ebx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
mov edx, str.RegistryGetValueString
push 0x54
call fcn.0042bc70
add esp, 4
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x1c], ebx
jmp 0x42b4b2
sub esp, 0x20
xor eax, eax
mov dword [esp + 0x1c], eax
movaps xmm0, xmmword [0x461860]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, ebx
test eax, eax
je 0x42b409
mov ebx, eax
push eax
call fcn.0044fc05
add esp, 4
mov dword [ebp - 0x80], edi
mov edi, eax
push ebx
xor eax, eax
push eax
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
push eax
push eax
xor eax, eax
push ebx
push edi
push 0xffffffffffffffff
push dword [ebp - 0x80]
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
mov dword [ebp - 0x84], edi
je 0x42b42b
mov dword [ebp - 0x60], 0xf
mov dword [ebp - 0x64], 0
mov byte [ebp - 0x74], 0
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
cmp eax, 0xf
jbe 0x42b45f
sub esp, 0xc
mov al, byte [ebp - 0x78]
mov byte [esp + 4], al
mov dword [esp + 8], edi
mov dword [esp], ebx
lea ecx, [ebp - 0x74]
call fcn.00401080
jmp 0x42b475
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
mov edx, str.RegistryGetValueString
push 0x5d
jmp 0x42b342
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov ecx, ebx
mov edx, str.RegistryGetValueString
push 0x67
call fcn.0042bc70
add esp, 4
xorps xmm0, xmm0
movups xmmword [esi + 0xc], xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x1c], ebx
jmp 0x42b4a1
lea eax, [ebp - 0x74]
mov dword [eax + 0x10], ebx
push ebx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp + ebx - 0x74], 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x60]
mov dword [esi], eax
movsd xmm0, qword [ebp - 0x70]
movsd qword [esi + 4], xmm0
mov eax, dword [ebp - 0x68]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], edx
mov byte [esi + 0x18], 1
mov dword [esi + 0x1c], 0
mov edi, dword [ebp - 0x80]
push dword [ebp - 0x84]
call fcn.0044fc0e
add esp, 4
push edi
call fcn.0044fc0e
add esp, 4
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x42b4de
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42b50a
push edx
push eax
call fcn.0044fbc2
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x42b12b
mov eax, dword [ebp - 0x44]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x42b522
push edx
push eax
call fcn.0044fbc2
add esp, 8
jmp 0x42b12b
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42b53a
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b4d4
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x42b53a
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x42b4fb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]