Function at 0x42c575
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x110
mov eax, 0x47a202
call fcn.00450508
mov dword [ebp - 0x60], edx
mov edi, ecx
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push str.ApplyXmlRegistryUpdate
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x14], ebx
call fcn.0041dfa0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x28]
call fcn.0044a4d0
call fcn.00409480
push eax
lea ecx, [ebp - 0x50]
call fcn.00408c39
mov byte [ebp - 4], 2
call fcn.00409480
push eax
lea ecx, [ebp - 0x4c]
call fcn.00408c39
mov byte [ebp - 4], 4
call fcn.00409480
push eax
lea ecx, [ebp - 0x70]
call fcn.00408c39
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
call fcn.00431fd0
mov byte [ebp - 4], 7
xor eax, eax
mov bh, bl
mov dword [ebp - 0x74], eax
mov ecx, edi
mov bl, al
call fcn.0042f56b
mov ecx, edi
call fcn.0044a600
test al, al
jne 0x42d434
mov ecx, edi
call fcn.0044e390
cmp eax, 2
jne 0x42d434
mov ecx, edi
call fcn.0044b5e0
mov esi, eax
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x70]
call fcn.0040afd8
lea ecx, [ebp - 0x70]
call fcn.0041ab4d
mov ecx, eax
call fcn.0040a092
push str.regkey
push dword [ebp - 0x70]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
je 0x42c672
mov dword [ebp - 0x14], 0x57
jmp 0x42d452
mov esi, str.path
lea eax, [ebp - 0x7c]
push esi
push eax
mov ecx, edi
call fcn.0044aa60
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.0044a600
test al, al
je 0x42c6ad
push esi
push str._s_attribute_is_mandatory_for_regkey_node
call fcn.0041dafb
pop ecx
pop ecx
mov dword [ebp - 0x14], 0xd
jmp 0x42d452
lea ecx, [ebp - 0x28]
call fcn.0044e3b0
mov esi, eax
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x50]
call fcn.0040afd8
lea ecx, [ebp - 0x50]
call fcn.0041ab4d
mov ecx, eax
call fcn.0040a092
mov eax, dword [ebp - 0x50]
cmp dword [eax - 0xc], 0
jne 0x42c6f6
push str.path
push str._s_attribute_is_empty
call fcn.0041dafb
pop ecx
pop ecx
jmp 0x42c666
push eax
push str.Processing_regkey_node:__s
call fcn.0041dafb
pop ecx
pop ecx
push str.flags
lea eax, [ebp - 0x7c]
mov ecx, edi
push eax
call fcn.0044aa60
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.0044a630
test eax, eax
je 0x42c826
lea ecx, [ebp - 0x28]
call fcn.0044e3b0
mov edi, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x2c]
call fcn.0041e8af
mov esi, dword [ebp - 0x2c]
push 9
push str.mustexist
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42c75f
mov bh, 1
add esi, 0x12
jmp 0x42c7e5
push 2
push 0x48b774
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42c77b
or edi, 0x200
jmp 0x42c795
push 2
push 0x48b77c
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42c79a
or edi, 0x100
add esi, 4
jmp 0x42c7e5
push 3
push 0x48e16c
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42c7b3
add esi, 6
jmp 0x42c7e5
push 4
push str.aimm
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42c7cc
add esi, 8
jmp 0x42c7e5
push 6
push str.delete
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42c7ed
mov bl, 1
add esi, 0xc
mov dword [ebp - 0x2c], esi
jmp 0x42c736
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], edi
call fcn.0041e8af
mov esi, edi
mov ecx, 0x300
mov edi, dword [ebp - 0x34]
mov eax, esi
and eax, ecx
cmp eax, ecx
je 0x42c6a1
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x3c], esi
cmp word [eax], cx
je 0x42c829
push eax
push str.Invalid_flag__s
jmp 0x42c69a
mov esi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
push eax
lea edx, [ebp - 0x40]
call fcn.0041f3b5
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
jne 0x42d43b
test bh, bh
je 0x42c87e
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x4c]
push esi
call fcn.0041f486
mov dword [ebp - 0x14], eax
pop ecx
cmp eax, 0x490
jne 0x42c874
push str.Attribure_mustexist_is_specified__but_the_destination_registry_key_is_missing__skipping
call fcn.0041dafb
pop ecx
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x42d43b
cmp dword [ebp - 0x14], 0
jne 0x42d43b
mov eax, dword [ebp - 0x40]
mov ecx, eax
shr ecx, 0x1f
mov byte [ebp - 0x110], 1
mov dword [ebp - 0x84], ecx
test cl, cl
jne 0x42c8c9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor ecx, ecx
push ecx
push ecx
lea ecx, [ebp - 0x108]
push ecx
push esi
push dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x42c8cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x42c86c
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x100]
call fcn.0040a1c3
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x104]
call fcn.0040a1c3
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x110]
push eax
mov byte [ebp - 0xfc], bl
push dword [ecx + 0x28]
lea ecx, [ecx + 0x28]
mov byte [ebp - 0xfb], 1
call fcn.00431646
xor eax, eax
mov dword [ebp - 0x108], eax
test bl, bl
jne 0x42d43b
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.0044aff0
jmp 0x42d2e1
xor eax, eax
lea ecx, [ebp - 0xc0]
mov bl, al
mov byte [ebp - 0xd], al
mov bh, al
call fcn.00431fd0
mov byte [ebp - 4], 8
xor edi, edi
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x6c], edi
call fcn.0044a4d0
call fcn.00409480
push eax
lea ecx, [ebp - 0x1c]
call fcn.00408c39
mov byte [ebp - 4], 0xa
call fcn.00409480
push eax
lea ecx, [ebp - 0x18]
call fcn.00408c39
mov byte [ebp - 4], 0xc
call fcn.00409480
push eax
lea ecx, [ebp - 0x20]
call fcn.00408c39
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x68], edi
call fcn.0044e390
cmp eax, 2
je 0x42c9c6
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
push dword [ebp - 0x60]
lea edx, [ebp - 0x45]
lea ecx, [ebp - 0x38]
call fcn.0041a573
pop ecx
test eax, eax
je 0x42c9fc
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
cmp byte [ebp - 0x45], 0
jne 0x42ca25
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
push str.flags
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044aa60
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.0044a630
test eax, eax
je 0x42cad1
lea ecx, [ebp - 0x28]
call fcn.0044e3b0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x24]
call fcn.0041e8af
mov esi, dword [ebp - 0x24]
push 9
push str.mustexist
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42ca7f
mov bl, 1
add esi, 0x12
jmp 0x42cab2
push 6
push str.delete
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42ca97
mov bh, 1
jmp 0x42caaf
push 6
push str.expand
push esi
call fcn.00464e21
add esp, 0xc
test eax, eax
jne 0x42cab7
mov byte [ebp - 0xd], 1
add esi, 0xc
mov dword [ebp - 0x24], esi
jmp 0x42ca59
lea ecx, [ebp - 0x24]
call fcn.0041e8af
mov esi, dword [ebp - 0x24]
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xd], al
cmp word [esi], di
jne 0x42d2f6
push str.name
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044aa60
lea ecx, [ebp - 0x28]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.0044a600
test al, al
jne 0x42d40a
lea ecx, [ebp - 0x28]
call fcn.0044e3b0
mov esi, eax
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040afd8
lea ecx, [ebp - 0x1c]
call fcn.0041ab4d
mov ecx, eax
call fcn.0040a092
test bl, bl
je 0x42cbdd
xor ecx, ecx
mov edx, 0x20019
mov dword [ebp - 0x24], ecx
mov eax, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x42d334
cmp dword [0x4a0604], 0
je 0x42cb54
mov eax, dword [ebp - 0x3c]
or eax, edx
lea edx, [ebp - 0x24]
xor edi, edi
push edx
push eax
push edi
push dword [ebp - 0x4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42cb71
mov esi, 0x490
jmp 0x42cb94
lea eax, [ebp - 0x34]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edi, edi
test eax, eax
mov esi, edi
mov eax, 0x490
cmovne esi, eax
cmp dword [ebp - 0x24], 0
je 0x42cba3
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x490
mov dword [ebp - 0x14], esi
cmp esi, eax
jne 0x42cbd5
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
test esi, esi
jne 0x42d33b
lea ecx, [ebp - 0x38]
call fcn.0044b5e0
mov esi, eax
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.0040afd8
lea ecx, [ebp - 0x18]
call fcn.0041ab4d
mov ecx, eax
call fcn.0040a092
push str.reg_sz
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42cc22
xor edi, edi
inc edi
jmp 0x42ccb9
push str.reg_expand_sz
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42cc39
push 2
jmp 0x42ccb8
push str.reg_dword
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42cc50
push 4
jmp 0x42ccb8
push str.reg_multi_sz
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42cc67
push 7
jmp 0x42ccb8
push str.reg_multi_sz_add
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42cc83
mov dword [ebp - 0x74], 1
jmp 0x42cc63
push str.reg_multi_sz_rem
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42cc9f
mov dword [ebp - 0x74], 2
jmp 0x42cc63
push str.reg_binary
push dword [ebp - 0x18]
call fcn.00458623
pop ecx
pop ecx
test eax, eax
jne 0x42d3d4
push 3
pop edi
cmp byte [ebp - 0x84], 0
mov dword [ebp - 0x24], edi
jne 0x42cd1b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
xor ecx, ecx
push ecx
push ecx
lea ecx, [ebp - 0xb8]
push ecx
push esi
push dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x42cd24
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d38a
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0xb0]
call fcn.0040a1c3
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040a1c3
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040a1c3
mov byte [ebp - 0xac], bh
mov byte [ebp - 0xab], 1
test bh, bh
je 0x42cdab
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0xc0]
push eax
push dword [ecx + 0x28]
lea ecx, [ecx + 0x28]
call fcn.00431646
xor eax, eax
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044aff0
jmp 0x42cddd
lea ecx, [ebp - 0x44]
call fcn.0044e390
cmp eax, 3
je 0x42cdee
cmp eax, 4
je 0x42cdee
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x44]
call fcn.0044b670
mov eax, dword [eax]
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], eax
call fcn.0044a630
test eax, eax
jne 0x42cdbc
lea ecx, [ebp - 0x44]
call fcn.0044a600
test al, al
jne 0x42d3ad
lea ecx, [ebp - 0x44]
call fcn.0044e3b0
mov esi, eax
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x20]
call fcn.0040afd8
xor esi, esi
cmp byte [ebp - 0xd], 0
je 0x42ce31
push dword [ebp - 0x60]
xor dl, dl
lea ecx, [ebp - 0x20]
push esi
call fcn.0041ec18
pop ecx
pop ecx
cmp edi, 2
mov edi, dword [ebp - 0x20]
jbe 0x42d20f
mov eax, dword [ebp - 0x24]
cmp eax, 3
je 0x42d1cf
cmp eax, 4
je 0x42d182
push 7
pop ecx
cmp eax, ecx
jne 0x42d24e
mov ebx, dword [ebp - 0x74]
test ebx, ebx
je 0x42d121
lea eax, [ebx - 1]
cmp eax, 1
ja 0x42d24e
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x64], esi
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x1c]
call fcn.00420199
add esp, 0x14
test eax, eax
jne 0x42d0f9
xor ebx, ebx
push 0xc
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
call fcn.0044fbac
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x54], ebx
call fcn.00409480
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408c39
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x7c]
shr eax, 1
mov byte [ebp - 0xd], bl
cmp dword [ebp - 0x64], ebx
jne 0x42ceec
mov dword [ebp - 0x14], 0x57
jmp 0x42d088
mov ebx, dword [ebp - 0x64]
lea eax, [ebx + eax*2]
mov dword [ebp - 0x34], eax
cmp ebx, eax
jae 0x42cf47
mov esi, ebx
xor edx, edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x42cf00
sub esi, ecx
sar esi, 1
je 0x42cf3c
push ebx
lea ecx, [ebp - 0x80]
call fcn.0040a211
mov byte [ebp - 4], 0x33
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x5c]
call fcn.00422998
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x80]
lea ecx, [ecx - 0x10]
call fcn.00409575
lea ebx, [ebx + esi*2]
add ebx, 2
cmp ebx, dword [ebp - 0x34]
jb 0x42cef9
xor eax, eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x54]
push eax
push 0x48edcc
lea eax, [ebp - 0x78]
push eax
call fcn.0041ac34
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x78]
lea ecx, [ecx - 0x10]
call fcn.00409575
cmp dword [ebp - 0x54], 0xffffffff
je 0x42d085
mov edi, dword [ebp - 0x74]
xor eax, eax
mov byte [ebp - 0x2d], al
mov eax, dword [ebp - 0x5c]
mov esi, dword [eax]
cmp esi, eax
je 0x42cfff
push dword [esi + 8]
lea ecx, [ebp - 0x2c]
call fcn.0041aea7
test eax, eax
jne 0x42cfe4
mov byte [ebp - 0x2d], 1
cmp edi, 2
jne 0x42cfe4
mov eax, dword [esi + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 8]
dec dword [ebp - 0x58]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 0x32
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.00409575
push 0xc
push esi
call fcn.0040b0b6
pop ecx
pop ecx
mov esi, ebx
jmp 0x42cfe6
mov esi, dword [esi]
mov eax, dword [ebp - 0x5c]
cmp esi, eax
jne 0x42cf98
cmp byte [ebp - 0x2d], 0
je 0x42cfff
cmp edi, 2
jne 0x42d013
mov bl, 1
mov byte [ebp - 0xd], bl
jmp 0x42d016
cmp edi, 1
jne 0x42d013
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x5c]
call fcn.00422998
jmp 0x42cff8
mov bl, byte [ebp - 0xd]
lea eax, [ebp - 0x54]
push eax
push 0x48edcc
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x20]
call fcn.0041ac34
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2c]
push eax
call fcn.0040a1c3
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x78]
lea ecx, [ecx - 0x10]
call fcn.00409575
cmp dword [ebp - 0x54], 0xffffffff
jne 0x42cf8a
mov edi, dword [ebp - 0x20]
test bl, bl
je 0x42d088
xor eax, eax
lea edx, [ebp - 0x54]
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
call fcn.00422332
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
jne 0x42d088
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x6c], eax
jmp 0x42d088
mov bl, byte [ebp - 0xd]
push dword [ebp - 0x64]
call fcn.00454c63
pop ecx
test bl, bl
jne 0x42d0d3
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x5c]
call fcn.00431112
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x5c]
call fcn.00431112
mov ebx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
jmp 0x42d253
cmp ebx, 2
jne 0x42d121
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d2af
mov eax, dword [edi - 0xc]
lea esi, [eax*2 + 4]
push esi
call fcn.00454c58
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42d368
push esi
xor eax, eax
push eax
push ebx
call fcn.00451b90
mov edx, ebx
add esp, 0xc
mov ecx, edi
sub edx, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d14f
mov ecx, esi
shr ecx, 1
push 0
pop eax
je 0x42d253
cmp word [ebx + eax*2], 0x23
jne 0x42d178
xor edx, edx
mov word [ebx + eax*2], dx
inc eax
cmp eax, ecx
jb 0x42d16b
jmp 0x42d253
push 4
pop esi
push esi
call fcn.00454c58
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42d368
push ebx
xor eax, eax
push 0x48edd0
push edi
mov dword [ebx], eax
call fcn.0041b661
add esp, 0xc
cmp eax, 1
je 0x42d253
push dword [ebp - 0x1c]
push edi
push str.REG_DWORD_number__s_of_value__s_is_invalid
call fcn.0041dafb
add esp, 0xc
mov dword [ebp - 0x14], 0xd
jmp 0x42d35f
mov eax, dword [edi - 0xc]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
push esi
call fcn.00454c58
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42d368
push esi
mov edx, ebx
mov ecx, edi
call fcn.0041fe3e
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x42d25f
push dword [ebp - 0x1c]
push edi
push str.REG_BINARY_hex_string__s_of_value__s_is_invalid
call fcn.0041dafb
add esp, 0xc
jmp 0x42d253
mov eax, dword [edi - 0xc]
lea esi, [eax*2 + 2]
push esi
call fcn.00454c58
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42d368
push esi
xor eax, eax
push eax
push ebx
call fcn.00451b90
mov edx, ebx
add esp, 0xc
mov ecx, edi
sub edx, edi
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x42d23d
jmp 0x42d253
mov ebx, dword [ebp - 0x68]
mov esi, ebx
cmp dword [ebp - 0x14], 0
mov eax, ebx
jne 0x42d35b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x90], esi
mov esi, dword [ebp - 0x60]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xc0]
push eax
push dword [esi + 0x28]
lea ecx, [esi + 0x28]
call fcn.00431646
xor eax, eax
mov dword [ebp - 0xb8], eax
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 4]
mov dword [eax + 0x2c], ebx
mov byte [ebp - 4], 0xc
lea ecx, [edi - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.0043216a
lea eax, [ebp - 0xd4]
push eax
lea ecx, [ebp - 0x38]
call fcn.0044b670
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x38]
call fcn.0044a630
test eax, eax
jne 0x42c938
jmp 0x42d43b
lea ecx, [ebp - 0x38]
call fcn.0044b5e0
push eax
push esi
push str.Invalid_flag__s_in_node__s
call fcn.0041dafb
add esp, 0xc
mov dword [ebp - 0x14], 0xd
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d38a
mov dword [ebp - 0x14], 0x57
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d38a
test eax, eax
je 0x42d36f
push ebx
call fcn.00454c63
pop ecx
jmp 0x42d36f
mov dword [ebp - 0x14], 8
mov byte [ebp - 4], 0xc
lea ecx, [edi - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc0]
call fcn.0043216a
jmp 0x42d43b
mov dword [ebp - 0x14], 0xd
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d38a
push dword [ebp - 0x18]
push str.Unknown_registry_value_type_specified___s
call fcn.0041dafb
pop ecx
pop ecx
mov dword [ebp - 0x14], 0x32
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d38a
mov dword [ebp - 0x14], 0xd
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
jmp 0x42d38a
mov dword [ebp - 0x14], 0x57
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x42d452
mov eax, ecx
shr eax, 0x1f
test al, al
jne 0x42d452
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x110]
call fcn.0043216a
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x70]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x4c]
lea ecx, [ecx - 0x10]
call fcn.00409575
xor eax, eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x50]
add ecx, 0xfffffff0
call fcn.00409575
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11c]
call fcn.0041e015
mov eax, esi
call fcn.004504d1
ret