Function at 0x4244ee
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa48
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [0x42cc34], edx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x9dc], ebx
mov dword [ebp - 0xa08], ebx
mov dword [ebp - 0xa04], ebx
mov dword [ebp - 0xa00], ebx
mov dword [ebp - 0x9fc], ebx
mov dword [ebp - 0x9f8], ebx
mov dword [ebp - 0x9f4], ebx
mov dword [ebp - 0x9f0], ebx
mov dword [ebp - 0x9ec], ebx
mov dword [0x42cc38], eax
test edi, edi
jne 0x424557
call fcn.00422032
lea ecx, [ebp - 0xa08]
call fcn.004232ca
test eax, eax
je 0x424962
lea eax, [ebp - 0x9e0]
mov dword [ebp - 0x9d8], ebx
push eax
push 0x20019
push ebx
push 0x403130
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ebx
mov dword [ebp - 0x9e0], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424962
test edi, edi
jne 0x424666
lea eax, [ebp - 0x9dc]
push eax
push 0x20019
push ebx
push 0x403074
push dword [ebp - 0x9e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424666
lea ecx, [ebp - 0xa44]
call fcn.00424b39
call fcn.00424b6f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
jmp 0x424635
lea edx, [ebp - 0x28]
inc esi
lea ecx, [ebp - 0xa44]
call fcn.00424d6e
test eax, eax
jne 0x42464f
lea ecx, [ebp - 0xa44]
call fcn.0042365d
test eax, eax
je 0x42461a
lea edx, [ebp - 0xa44]
call fcn.00420a5c
lea ecx, [ebp - 0xa44]
call fcn.00424b6f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0x9dc]
mov dword [ebp - 0x9d8], 0x10
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4245ed
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa44]
call fcn.00424b6f
lea eax, [ebp - 0x9dc]
push eax
push 0x20019
push ebx
push 0x406438
push dword [ebp - 0x9e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424700
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
mov esi, ebx
push eax
lea eax, [ebp - 0x9d4]
push eax
push ebx
jmp 0x4246da
lea ecx, [ebp - 0x9d4]
inc esi
call fcn.00423d75
test eax, eax
je 0x4246c7
lea eax, [ebp - 0x5ec]
push eax
lea edx, [ebp - 0x6b4]
lea ecx, [ebp - 0x9d4]
call fcn.00428adb
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x9d4]
push eax
push esi
push dword [ebp - 0x9dc]
mov dword [ebp - 0x9d8], 0x64
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42469f
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x424956
lea eax, [ebp - 0x9dc]
push eax
push 0x20019
push ebx
push 0x406450
push dword [ebp - 0x9e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x64
pop edi
test eax, eax
jne 0x4247ca
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
mov esi, ebx
push eax
lea eax, [ebp - 0x1bc]
push eax
push ebx
jmp 0x4247a8
push ecx
lea eax, [ebp - 0x7dc]
inc esi
push eax
push ecx
lea eax, [ebp - 0x2ec]
push eax
push ecx
lea edx, [ebp - 0x4fc]
lea ecx, [ebp - 0x1bc]
call fcn.00424064
test eax, eax
je 0x424795
mov edx, dword [ebp - 0x9ec]
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.0041f476
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push esi
push dword [ebp - 0x9dc]
mov dword [ebp - 0x9d8], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x424748
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x9dc]
push eax
push 0x20019
push ebx
push 0x406464
push dword [ebp - 0x9e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424956
push 0x206
mov word [ebp - 0x3c4], ax
lea eax, [ebp - 0x3c2]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9d8]
mov esi, ebx
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0xf4]
push eax
push ebx
jmp 0x424930
push ecx
lea eax, [ebp - 0x7dc]
inc esi
push eax
push ecx
lea edx, [ebp - 0x3c4]
lea ecx, [ebp - 0xf4]
call fcn.004242b9
test eax, eax
je 0x42491d
lea eax, [ebp - 0x9e4]
mov dword [ebp - 0x9e4], ebx
push eax
push 1
push ebx
lea eax, [ebp - 0xf4]
push eax
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4248f5
lea eax, [ebp - 0x9d8]
mov dword [ebp - 0x9d8], 0x20a
push eax
lea eax, [ebp - 0x5d4]
mov dword [ebp - 0x9e8], 1
push eax
lea eax, [ebp - 0x9e8]
push eax
push ebx
push 0x403e7c
push dword [ebp - 0x9e4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4248e9
cmp dword [ebp - 0x9e8], 1
jne 0x4248e9
mov word [ebp - 0x3cc], ax
lea eax, [ebp - 0x5d4]
push 0x401b58
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x4248e9
push dword [ebp - 0x9e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42491d
push dword [ebp - 0x9e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xf4]
test eax, eax
je 0x42491d
push dword [ebp - 0xa04]
mov edx, dword [ebp - 0x9ec]
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0xf4]
call fcn.0041ffc9
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0xf4]
push eax
push esi
push dword [ebp - 0x9dc]
mov dword [ebp - 0x9d8], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x424826
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x9e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xa08]
call fcn.00424aa4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret 4