Function at 0x42cf55
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x4a3773
call fcn.0045a4e9
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x4c0ee0
mov dword [ebp - 0x18], 0x4c13e4
call fcn.00403f50
push 0x4ac8e8
mov dword [ebp - 4], ebx
call fcn.0045a1f4
pop ecx
push eax
push ebx
push 0x4ac8e8
lea ecx, [edi + 4]
call fcn.004068b0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.00436645
call fcn.00445e72
inc ebx
test al, al
je 0x42d00b
test byte [ebp - 0xac], bl
je 0x42cffc
mov edi, 0x200
jmp 0x42d00b
test byte [ebp - 0xac], 2
mov eax, 0x100
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x42d3ff
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00404580
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.00402b90
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401ac0
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d06e
mov esi, SysReAllocStringLen
jmp 0x42d100
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d086
mov esi, SysReAllocStringLen
jmp 0x42d100
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d09e
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x42d100
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d0b6
mov esi, SysReAllocStringLen
jmp 0x42d100
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d0ce
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x42d100
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d0e6
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x42d100
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.00433152
test eax, eax
jne 0x42d3ff
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404580
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00402b90
lea ecx, [ebp - 0xa0]
call fcn.00401ac0
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004018f0
test eax, eax
jne 0x42d3d6
cmp dword [ebp + 8], ebx
jne 0x42d184
cmp dword [ebp + 0xc], ebx
jmp 0x42d265
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x42d1a1
mov eax, dword [edi]
jmp 0x42d1a3
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42d26f
cmp dword [ebp - 0xb4], 4
jne 0x42d278
cmp dword [ebp - 0xb0], 4
jne 0x42d278
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.00436645
mov eax, dword [ebp + 0xc]
dec eax
je 0x42d259
dec eax
je 0x42d248
dec eax
dec eax
je 0x42d237
sub eax, 0xc
je 0x42d229
sub eax, 0x10
jne 0x42d3f2
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x42d268
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x42d25f
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x42d268
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x42d268
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x42d3f2
cmp eax, 2
je 0x42d3d6
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x4c0d0c
call fcn.004091b8
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42d2a7
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.004091b8
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.004091b8
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.00448c83
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x42d30d
mov eax, dword [esi]
jmp 0x42d30f
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00412c99
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x42d365
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402ce0
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.0042c920
jmp 0x42d376
cmp dword [esi + 0x14], 8
jb 0x42d36d
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.00423b88
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x42d38b
lea ecx, [ebp - 0xa0]
call fcn.00401ac0
mov eax, dword [ebp + 0xc]
dec eax
je 0x42d3c5
dec eax
je 0x42d3be
dec eax
dec eax
je 0x42d3b7
sub eax, 4
je 0x42d3b3
sub eax, 8
je 0x42d3ab
sub eax, 0x10
jne 0x42d3cc
test esi, esi
jmp 0x42d3ae
cmp edi, 0xffffffff
setne al
jmp 0x42d3ca
test edi, edi
jmp 0x42d3c7
test esi, esi
setg al
jmp 0x42d3ca
test esi, esi
sets al
jmp 0x42d3ca
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401b80
jmp 0x42d3f2
cmp dword [ebp + 8], ebx
jne 0x42d3e4
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x42d3f2
cmp dword [ebp + 0xc], 2
je 0x42d3f2
cmp dword [ebp + 0xc], 0x20
je 0x42d3f2
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004018c0
jmp 0x42d401
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401ac0
mov al, bl
call fcn.0045a498
ret 0x18