Function at 0x42aa07
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, ecx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2b4], eax
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x2a4], edi
mov dword [ebp - 0x2a8], ecx
test ecx, ecx
jne 0x42aa46
mov eax, 0x80004005
jmp 0x42add6
xor esi, esi
inc esi
cmp dword [eax + 0x1c], edi
je 0x42aa5a
cmp dword [eax + 0x1c], esi
je 0x42aa5a
mov edi, esi
jmp 0x42add4
call fcn.0041fb3c
mov ecx, eax
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x407308
lea eax, [ebp - 0x290]
push 0x208
push eax
call fcn.0040c0f9
add esp, 0x14
test eax, eax
js 0x42adcf
push edi
lea eax, [ebp - 0x2a4]
push eax
push edi
push 3
push edi
push edi
push edi
lea eax, [ebp - 0x290]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42adcf
lea eax, [ebp - 0x2b0]
mov dword [ebp - 0x2b0], 0x80
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x2a0], edi
push eax
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x298], edi
push eax
push edi
push 0x406b88
push dword [ebp - 0x2a4]
mov ebx, edi
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x2ac], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ad30
cmp dword [ebp - 0x2ac], esi
jne 0x42ad30
mov dword [ebp - 0x29c], edi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x298], edi
mov esi, edi
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x2a0], edi
jmp 0x42ab38
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42ab34
mov eax, esi
sub eax, 1
je 0x42ac6f
sub eax, 1
je 0x42ac43
sub eax, 1
je 0x42ac10
lea eax, [ebp - 0x88]
test esi, esi
je 0x42ab85
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x294], eax
jmp 0x42ac92
inc esi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x42ab81
sub esi, 1
je 0x42abfb
sub esi, 1
je 0x42abdf
sub esi, 1
je 0x42abbc
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x29c], eax
jmp 0x42ac92
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404340
jmp 0x42ac31
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404360
jmp 0x42ac5d
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404378
jmp 0x42ac82
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x4042f8
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x42ac92
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404318
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x42ac92
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0x404330
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x298]
mov esi, dword [ebp - 0x2a0]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x294]
shl eax, 0x10
add esi, eax
mov eax, ecx
shr eax, 0x10
cdq
mov ebx, eax
mov eax, edx
shld eax, ebx, 0x10
mov dword [ebp - 0x294], eax
movzx eax, cx
mov ecx, dword [ebp - 0x294]
cdq
shl ebx, 0x10
or ecx, edx
or ebx, eax
mov eax, esi
shld ecx, ebx, 0x10
shr eax, 0x10
cdq
shl ebx, 0x10
or ecx, edx
or ebx, eax
movzx eax, si
mov esi, dword [ebp - 0x2a8]
shld ecx, ebx, 0x10
cdq
or ecx, edx
shl ebx, 0x10
mov dword [ebp - 0x294], ecx
or ebx, eax
mov ecx, esi
call fcn.0041ee6a
mov ecx, eax
mov dword [ebp - 0x298], edx
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2a0], ecx
cmp edx, eax
jb 0x42adc1
ja 0x42ad36
cmp ecx, ebx
jbe 0x42ad79
jmp 0x42ad36
mov esi, dword [ebp - 0x2a8]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42ad3b
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push edi
push 0x406b88
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x294]
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ebp - 0x298]
cmp edx, eax
jb 0x42adc1
ja 0x42ad83
cmp ecx, ebx
jb 0x42adc1
mov edx, dword [ebp - 0x2b4]
mov edx, dword [edx + 0x28]
test edx, edx
je 0x42adc1
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42ad95
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push edi
push 0x406ba0
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42add4
mov edi, 0x80004005
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret