Function at 0x420604
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x47803f
call fcn.00450508
mov ebx, ecx
mov dword [ebp - 0x34], ebx
test ebx, ebx
jne 0x420621
push 0x57
pop eax
jmp 0x42082d
call fcn.00409480
push eax
lea ecx, [ebp - 0x10]
call fcn.00408c39
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov edi, eax
mov dword [ebp - 0x30], eax
xor esi, esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], esi
push eax
push esi
lea eax, [ebp - 0x28]
mov ecx, 0x100
push eax
push esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
push ecx
jmp 0x4207ef
cmp dword [ebp - 0x28], 7
je 0x420670
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
jmp 0x4207b3
mov esi, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x20], eax
mov edx, esi
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0042030c
add esp, 0xc
test eax, eax
jne 0x42079e
mov dword [ebp - 0x1c], eax
call fcn.00409480
push eax
lea ecx, [ebp - 0x18]
call fcn.00408c39
mov byte [ebp - 4], 5
call fcn.00409480
push eax
lea ecx, [ebp - 0x14]
call fcn.00408c39
mov byte [ebp - 4], 7
xor edx, edx
mov ebx, dword [ebp - 0x20]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x4206c7
sub ebx, ecx
sar ebx, 1
je 0x42077d
mov esi, dword [ebp - 0x20]
mov ecx, ebx
call fcn.00422961
push eax
lea ecx, [ebp - 0x14]
call fcn.00409176
mov ecx, ebx
mov edi, eax
call fcn.00422961
push eax
lea ecx, [ebp - 0x18]
call fcn.00409176
mov ecx, dword [ebp - 0x1c]
push edi
push eax
add ecx, esi
push str._MoveFile__________
push ecx
call fcn.0041b661
add esp, 0xc
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.004089f1
push ecx
lea ecx, [ebp - 0x14]
call fcn.004089f1
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx + ebx*2]
add ecx, 2
mov dword [ebp - 0x1c], ecx
cmp edi, 2
jne 0x42075a
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x42075a
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x42075a
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00420384
mov ecx, dword [ebp - 0x1c]
lea ebx, [ecx + esi]
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x420762
sub ebx, ecx
sar ebx, 1
jne 0x4206df
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x30]
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00409575
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4207ac
push eax
call fcn.00454c63
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.00409575
call fcn.00409480
push eax
lea ecx, [ebp - 0x10]
call fcn.00408c39
mov dword [ebp - 4], 1
xor ecx, ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ecx
push eax
push ecx
lea eax, [ebp - 0x28]
mov edx, 0x100
push eax
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edx
mov esi, edi
inc edi
push eax
mov dword [ebp - 0x30], edi
push edx
lea ecx, [ebp - 0x10]
call fcn.00409176
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push ecx
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.004089f1
test esi, esi
je 0x42065b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00409575
xor eax, eax
cmp esi, 0x103
cmovne eax, esi
call fcn.004504d1
ret