Function at 0x425dea
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x465832
call fcn.0043fa79
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x47686c
mov dword [ebp - 0x18], 0x46d060
call fcn.004033a0
push 0x46b7a8
mov dword [ebp - 4], ebx
call fcn.0043f784
pop ecx
push eax
push ebx
push 0x46b7a8
lea ecx, [edi + 4]
call fcn.004051c0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.0042dd1c
call fcn.00435b4f
inc ebx
test al, al
je 0x425ea0
test byte [ebp - 0xac], bl
je 0x425e91
mov edi, 0x200
jmp 0x425ea0
test byte [ebp - 0xac], 2
mov eax, 0x100
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x426294
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004022d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401500
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x425f03
mov esi, SysReAllocStringLen
jmp 0x425f95
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x425f1b
mov esi, SysReAllocStringLen
jmp 0x425f95
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x425f33
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x425f95
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x425f4b
mov esi, SysReAllocStringLen
jmp 0x425f95
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x425f63
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x425f95
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x425f7b
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x425f95
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042b3a5
test eax, eax
jne 0x426294
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004022d0
lea ecx, [ebp - 0xa0]
call fcn.00401500
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004013d0
test eax, eax
jne 0x42626b
cmp dword [ebp + 8], ebx
jne 0x426019
cmp dword [ebp + 0xc], ebx
jmp 0x4260fa
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x426036
mov eax, dword [edi]
jmp 0x426038
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x426104
cmp dword [ebp - 0xb4], 4
jne 0x42610d
cmp dword [ebp - 0xb0], 4
jne 0x42610d
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.0042dd1c
mov eax, dword [ebp + 0xc]
dec eax
je 0x4260ee
dec eax
je 0x4260dd
dec eax
dec eax
je 0x4260cc
sub eax, 0xc
je 0x4260be
sub eax, 0x10
jne 0x426287
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x4260fd
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x4260f4
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x4260fd
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x4260fd
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x426287
cmp eax, 2
je 0x42626b
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x476700
call fcn.004067e8
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42613c
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.004067e8
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.004067e8
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.0043670b
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x4261a2
mov eax, dword [esi]
jmp 0x4261a4
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f692
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x4261fa
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402330
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.004257b5
jmp 0x42620b
cmp dword [esi + 0x14], 8
jb 0x426202
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.0041e9e0
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x426220
lea ecx, [ebp - 0xa0]
call fcn.00401500
mov eax, dword [ebp + 0xc]
dec eax
je 0x42625a
dec eax
je 0x426253
dec eax
dec eax
je 0x42624c
sub eax, 4
je 0x426248
sub eax, 8
je 0x426240
sub eax, 0x10
jne 0x426261
test esi, esi
jmp 0x426243
cmp edi, 0xffffffff
setne al
jmp 0x42625f
test edi, edi
jmp 0x42625c
test esi, esi
setg al
jmp 0x42625f
test esi, esi
sets al
jmp 0x42625f
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401500
jmp 0x426287
cmp dword [ebp + 8], ebx
jne 0x426279
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x426287
cmp dword [ebp + 0xc], 2
je 0x426287
cmp dword [ebp + 0xc], 0x20
je 0x426287
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004013a0
jmp 0x426296
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401500
mov al, bl
call fcn.0043fa28
ret 0x18