Function at 0x422dda
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63aa2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1174
call fcn.004ad4d0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x115c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x115c]
add ecx, 0x10
call fcn.00613196
push 0xa000
call fcn.004ac6dd
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xa000
push 0x1fe
push 0x73ae6c
lea eax, [ebp - 0x1020]
push eax
call fcn.004ad479
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
lea eax, [ebp - 0x1024]
push eax
push 0
lea ecx, [ebp - 0x1020]
push ecx
push reloc.OLEAUT32.dll_SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1028], eax
cmp dword [ebp - 0x1028], 0
je 0x422ebf
cmp dword [ebp - 0x1028], 0xea
jne 0x422ead
mov edx, dword [ebp - 0x18]
add edx, 0xa000
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004ae4fe
add esp, 8
mov dword [ebp - 0x1c], eax
jmp 0x422e80
cmp dword [ebp - 0x1028], 0
je 0x422ebd
xor eax, eax
jmp 0x42317c
jmp 0x422e4e
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x102c], edx
mov eax, dword [ebp - 0x102c]
push eax
call fcn.00422733
add esp, 4
mov dword [ebp - 0x1160], eax
mov ecx, dword [ebp - 0x1160]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
jmp 0x422ef8
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x102c]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 0x1c]
jge 0x423153
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0xc], 0x1fe
jne 0x423133
mov dword [ebp - 0x1138], 0xffffffff
mov eax, dword [ebp - 0x20]
push eax
call fcn.00422752
add esp, 4
mov dword [ebp - 0x1164], eax
mov ecx, dword [ebp - 0x1164]
mov dword [ebp - 0x1130], ecx
mov dword [ebp - 0x1134], 0
jmp 0x422f5d
mov edx, dword [ebp - 0x1134]
add edx, 1
mov dword [ebp - 0x1134], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1134]
cmp ecx, dword [eax + 0x20]
jge 0x422fac
mov edx, dword [ebp - 0x1130]
cmp dword [edx + 4], 0x208
jne 0x422f89
mov eax, dword [ebp - 0x1130]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x1138], ecx
mov edx, dword [ebp - 0x1130]
push edx
call fcn.00422762
add esp, 4
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0x1168]
mov dword [ebp - 0x1130], eax
jmp 0x422f4e
cmp dword [ebp - 0x1138], 0xffffffff
jne 0x422fcb
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004ac5f4
add esp, 4
mov eax, 1
jmp 0x42317c
mov edx, dword [ebp - 0x20]
push edx
call fcn.00422780
add esp, 4
mov dword [ebp - 0x116c], eax
mov eax, dword [ebp - 0x116c]
mov dword [ebp - 0x113c], eax
mov dword [ebp - 0x1134], 0
jmp 0x423004
mov ecx, dword [ebp - 0x1134]
add ecx, 1
mov dword [ebp - 0x1134], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1134]
cmp eax, dword [edx + 0x28]
jge 0x423133
mov ecx, dword [ebp - 0x113c]
mov edx, dword [ebp - 0x113c]
add edx, dword [ecx + 0x10]
mov dword [ebp - 0x1144], edx
mov eax, dword [ebp - 0x113c]
push eax
call fcn.00422771
add esp, 4
mov dword [ebp - 0x1170], eax
mov ecx, dword [ebp - 0x1170]
mov dword [ebp - 0x114c], ecx
push 0xff
lea edx, [ebp - 0x112c]
push edx
mov eax, dword [ebp - 0x1144]
push eax
call fcn.004227b4
add esp, 0xc
mov dword [ebp - 0x1174], eax
mov ecx, dword [ebp - 0x1174]
mov dword [ebp - 0x1148], ecx
mov edx, dword [ebp - 0x114c]
add edx, dword [ebp - 0x1138]
mov eax, dword [edx]
mov dword [ebp - 0x1150], eax
mov dword [ebp - 0x1140], 0
mov ecx, dword [ebp - 0x1148]
push ecx
lea ecx, [ebp - 0x1154]
call fcn.00618dec
mov dword [ebp - 0x1178], eax
mov edx, dword [ebp - 0x1178]
mov dword [ebp - 0x117c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x117c]
push eax
mov ecx, dword [ebp - 0x115c]
add ecx, 0x10
call fcn.0061325f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1154]
call fcn.00618d7e
lea ecx, [ebp - 0x1150]
push ecx
mov ecx, dword [ebp - 0x115c]
add ecx, 0x2c
call fcn.00423380
lea edx, [ebp - 0x1140]
push edx
mov ecx, dword [ebp - 0x115c]
add ecx, 0x48
call fcn.00423380
mov eax, dword [ebp - 0x113c]
push eax
call fcn.00422790
add esp, 4
mov dword [ebp - 0x1180], eax
mov ecx, dword [ebp - 0x1180]
mov dword [ebp - 0x113c], ecx
jmp 0x422ff5
mov edx, dword [ebp - 0x20]
push edx
call fcn.00422743
add esp, 4
mov dword [ebp - 0x1184], eax
mov eax, dword [ebp - 0x1184]
mov dword [ebp - 0x20], eax
jmp 0x422eef
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004ac5f4
add esp, 4
mov eax, 1
jmp 0x42317c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret