Function at 0x42fd6a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x4dd52c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push 0x17
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x270], esi
call fcn.004a5754
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x25c]
push eax
call fcn.0042fd0f
xor eax, eax
cmp dword [ebx + 0x19784], eax
je 0x4300f2
push edi
mov word [ebp - 0x20c], ax
mov dword [ebp - 0x264], eax
mov ecx, 0x81
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
movsx eax, word [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
push 0x405bf4
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
lea eax, [ebx + 0x19e44]
push eax
lea ecx, [ebx + 0x19a24]
push ecx
lea eax, [ebp - 0x260]
xor edi, edi
push eax
mov dword [ebp - 0x26c], 0x50
mov dword [ebp - 0x260], edi
call fcn.004805f0
test eax, eax
jne 0x42fe63
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42fe4b
mov dword [ebp - 0x264], 1
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x264], edi
jne 0x42ff02
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0xc]
push edi
push dword [ebx + 0x5010]
call dword [ebx + 0x19784]
test eax, eax
jne 0x42fec9
movsx eax, word [ebx + 0x56]
imul eax, eax, 0x12c
add eax, 0x7f
cdq
mov edi, 0xfe
mov ecx, edi
idiv ecx
push 0x405be0
mov word [ebp - 0x250], ax
movsx eax, word [ebx + 0x54]
imul eax, eax, 0x12c
add eax, 0x7f
cdq
idiv edi
mov word [ebp - 0x24e], ax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
xor edi, edi
lea eax, [ebx + 0x19e44]
push eax
lea eax, [ebx + 0x19a24]
push eax
lea eax, [ebp - 0x260]
push eax
mov dword [ebp - 0x260], edi
call fcn.004806cf
test eax, eax
jne 0x43003d
push 0x50
lea eax, [ebp - 0x25c]
push eax
push 3
push edi
jmp 0x43001e
mov eax, dword [ebp + 0xc]
cmp ax, 0x100
jl 0x43003d
cmp word [ebx + 0x364], di
jle 0x42ff4d
cmp ax, word [ebx + 0x366]
jne 0x42ff4d
movsx eax, word [ebx + 0xdd6]
imul eax, eax, 0x12c
add eax, 0x7f
mov edi, 0xfe
cdq
mov ecx, edi
idiv ecx
cmp ax, word [ebp - 0x250]
jne 0x42ff8c
movsx eax, word [ebx + 0xdd8]
jmp 0x42ff71
movsx eax, word [ebx + 0x56]
imul eax, eax, 0x12c
add eax, 0x7f
mov edi, 0xfe
cdq
mov ecx, edi
idiv ecx
cmp ax, word [ebp - 0x250]
jne 0x42ff8c
movsx eax, word [ebx + 0x54]
imul eax, eax, 0x12c
add eax, 0x7f
cdq
mov ecx, edi
idiv ecx
cmp ax, word [ebp - 0x24e]
je 0x43003d
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 0xc]
push 0
push dword [ebx + 0x5010]
call dword [ebx + 0x19784]
test eax, eax
jne 0x42ffec
movsx eax, word [ebx + 0x56]
imul eax, eax, 0x12c
add eax, 0x7f
cdq
mov ecx, edi
idiv ecx
push 0x405be0
mov word [ebp - 0x250], ax
movsx eax, word [ebx + 0x54]
imul eax, eax, 0x12c
add eax, 0x7f
cdq
idiv edi
mov word [ebp - 0x24e], ax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
and dword [ebp - 0x260], 0
lea eax, [ebx + 0x19e44]
push eax
lea eax, [ebx + 0x19a24]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004806cf
test eax, eax
jne 0x43003d
push 0x50
lea eax, [ebp - 0x25c]
push eax
push 3
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [ebp - 0x25c]
mov word [esi + 8], ax
mov ax, word [ebp - 0x25a]
mov word [esi + 0xa], ax
mov ax, word [ebp - 0x258]
mov word [esi + 0xc], ax
mov ax, word [ebp - 0x256]
mov word [esi + 0xe], ax
mov ax, word [ebp - 0x254]
mov word [esi + 0x10], ax
mov ax, word [ebp - 0x252]
mov word [esi + 0x12], ax
mov ax, word [ebp - 0x250]
mov word [esi], ax
mov ax, word [ebp - 0x24e]
mov word [esi + 2], ax
mov eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0x258]
push 0x10
sub eax, dword [ebp - 0x25c]
lea edi, [esi + 0x14]
mov word [esi + 4], ax
mov eax, dword [ebp - 0x24e]
sub eax, dword [ebp - 0x256]
pop ecx
sub eax, dword [ebp - 0x25a]
mov word [esi + 6], ax
lea esi, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
cmp word [ebx + 0x18934], 4
pop edi
jne 0x4300f2
cmp byte [ebx + 0xdcb], 0
jne 0x4300f2
sub eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x270]
mov word [ecx + 6], ax
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004a9585
leave
ret 0xc