Function at 0x420a29
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x6e0
push 0x440c38
call fcn.00425230
mov eax, dword [0x44de90]
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6c8], ebx
mov byte [ebp - 0x6b9], bl
mov dword [ebp - 0xb0], ebx
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
mov dword [0x45de78], ebx
mov dword [ebp - 0xb0], 0x94
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xa0]
mov dword [0x459e70], eax
cmp eax, 2
jne 0x420ed7
mov dword [ebp - 0x6d4], ebx
mov dword [ebp - 0x6c4], ebx
mov dword [ebp - 0x6e0], 0x100
mov dword [0x45de80], ebx
call fcn.0042024f
test eax, eax
jne 0x420adf
push str._nTo_stop_processes_program_must_be_started_with_Administrator_privileges__nYou_may_scan_local_drives_starting_tool_with__s_key_n
call fcn.00419ab0
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.004253ca
add esp, 0xc
xor al, al
jmp 0x4210bf
push 9
pop eax
mov dword [ebp - 0x6f0], eax
push eax
push str.softwaremicrosoftwindows_ntcurrentversionperflib
push str._s_03x
lea eax, [ebp - 0x6b8]
push eax
call fcn.00424fde
add esp, 0x10
lea eax, [ebp - 0x6d0]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x6b8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420b63
lea eax, [ebp - 0x6c0]
push eax
push ebx
lea eax, [ebp - 0x6e4]
push eax
push ebx
mov esi, str.Counters
push esi
push dword [ebp - 0x6d0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x420b63
push dword [ebp - 0x6c0]
call fcn.00425520
pop ecx
mov edi, eax
mov dword [ebp - 0x6c8], edi
cmp edi, ebx
jne 0x420b75
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.004253ca
pop ecx
pop ecx
jmp 0x420ad8
push dword [ebp - 0x6c0]
push ebx
push edi
call fcn.00425190
add esp, 0xc
lea eax, [ebp - 0x6c0]
push eax
push edi
lea eax, [ebp - 0x6e4]
push eax
push ebx
push esi
push dword [ebp - 0x6d0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x420bba
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
call fcn.004253ca
pop ecx
pop ecx
mov al, bl
jmp 0x4210bf
mov esi, edi
mov dword [ebp - 0x6ec], esi
cmp byte [esi], bl
je 0x420cbb
add edi, 2
cmp esi, edi
jbe 0x420beb
lea edi, [esi - 2]
mov dword [ebp - 0x6cc], edi
movsx eax, byte [edi]
push eax
call fcn.0042812a
pop ecx
test eax, eax
je 0x420beb
dec edi
jmp 0x420bd4
push str.process
push esi
call fcn.00427cf5
pop ecx
pop ecx
test eax, eax
jne 0x420c28
lea edi, [esi - 2]
mov dword [ebp - 0x6cc], edi
movsx eax, byte [edi]
push eax
call fcn.0042812a
pop ecx
test eax, eax
je 0x420c16
dec edi
jmp 0x420bff
inc edi
push edi
lea eax, [ebp - 0x6b8]
push eax
call fcn.00425600
pop ecx
pop ecx
jmp 0x420c9f
push str.id_process
push esi
call fcn.0042766e
pop ecx
pop ecx
test eax, eax
jne 0x420c9f
lea edi, [esi - 2]
mov dword [ebp - 0x6cc], edi
movsx eax, byte [edi]
push eax
call fcn.00425eb3
pop ecx
test eax, eax
je 0x420c53
dec edi
jmp 0x420c3c
inc dword [ebp - 0x6d4]
cmp dword [ebp - 0x6c4], ebx
jne 0x420c6a
push 4
call fcn.00425520
jmp 0x420c80
mov eax, dword [ebp - 0x6d4]
shl eax, 2
push eax
push dword [ebp - 0x6c4]
call fcn.0042788e
pop ecx
pop ecx
mov dword [ebp - 0x6c4], eax
inc edi
push edi
call fcn.004275c4
pop ecx
mov ecx, dword [ebp - 0x6c4]
mov edx, dword [ebp - 0x6d4]
mov dword [ecx + edx*4 - 4], eax
push esi
call fcn.00425700
pop ecx
lea esi, [esi + eax + 1]
mov dword [ebp - 0x6ec], esi
mov edi, dword [ebp - 0x6c8]
jmp 0x420bc2
push edi
call fcn.00425476
mov dword [ebp - 0x6c8], ebx
mov eax, 0xc800
mov dword [ebp - 0x6c0], eax
push eax
call fcn.00425520
pop ecx
pop ecx
mov dword [0x45de80], eax
cmp eax, ebx
je 0x420e5d
push dword [ebp - 0x6c0]
push ebx
push eax
call fcn.00425190
mov esi, 0x80000004
add esp, 0xc
lea eax, [ebp - 0x6c0]
push eax
push dword [0x45de80]
lea eax, [ebp - 0x6e4]
push eax
push ebx
lea eax, [ebp - 0x6b8]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x6e8], eax
cmp eax, ebx
mov eax, dword [0x45de80]
jne 0x420e7c
cmp dword [ebp - 0x6c0], ebx
jbe 0x420e7c
cmp word [eax], 0x50
jne 0x420e7c
cmp word [eax + 2], 0x45
jne 0x420e7c
cmp word [eax + 4], 0x52
jne 0x420e7c
cmp word [eax + 6], 0x46
jne 0x420e7c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x45de80]
mov eax, dword [ecx + 0x18]
add eax, ecx
mov dword [0x459e5c], eax
mov ecx, dword [eax + 8]
add ecx, eax
mov dword [0x459e60], ecx
mov dword [ebp - 0x6d8], ebx
mov edx, dword [ebp - 0x6d4]
cmp dword [ebp - 0x6d8], edx
jae 0x420dee
mov dword [ebp - 0x6dc], ebx
mov edx, dword [ebp - 0x6dc]
cmp edx, dword [eax + 0x20]
jae 0x420dcd
mov edx, dword [ecx + 4]
mov esi, dword [ebp - 0x6d8]
mov edi, dword [ebp - 0x6c4]
cmp edx, dword [edi + esi*4]
jne 0x420ddd
mov edx, dword [ecx + 0x24]
mov dword [0x45de84], edx
cmp dword [0x45de84], ebx
jne 0x420dee
inc dword [ebp - 0x6d8]
jmp 0x420d91
add ecx, 0x28
mov dword [0x459e60], ecx
inc dword [ebp - 0x6dc]
jmp 0x420da5
push dword [ebp - 0x6c4]
call fcn.00425476
pop ecx
mov eax, dword [0x459e5c]
mov ecx, dword [eax + 0x28]
cmp dword [ebp - 0x6e0], ecx
jae 0x420e10
mov ecx, dword [ebp - 0x6e0]
mov dword [0x459e58], ecx
mov ecx, dword [eax + 4]
add ecx, eax
mov dword [0x459e64], ecx
mov esi, str.ntdll.dll
push esi
call dword [0x451e04]
mov dword [0x45de78], eax
cmp eax, ebx
je 0x420e5d
mov dword [0x45de8c], ebx
push 0x451b58
push 0x451b34
push 0x440b38
push esi
call fcn.004195d0
add esp, 0x10
mov dword [0x45de8c], eax
cmp eax, ebx
jne 0x420e68
mov bl, byte [ebp - 0x6b9]
jmp 0x420ba6
mov dword [0x45de7c], ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x421077
cmp dword [ebp - 0x6e8], 0xea
jne 0x420ec4
add dword [ebp - 0x6c0], 0x6400
push dword [ebp - 0x6c0]
push eax
call fcn.0042788e
pop ecx
pop ecx
mov dword [0x45de80], eax
cmp eax, ebx
jne 0x420eb2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420e5d
push dword [ebp - 0x6c0]
push ebx
push eax
call fcn.00425190
jmp 0x420cf9
cmp eax, ebx
je 0x420ecf
push eax
call fcn.00425476
pop ecx
mov dword [0x45de80], ebx
jmp 0x420ea9
mov esi, str.kernel32.dll
push esi
call dword [0x451e04]
mov dword [0x45de78], eax
cmp eax, ebx
je 0x420ba6
mov dword [0x45dfc8], ebx
mov dword [0x45dfcc], ebx
mov dword [0x45dfd0], ebx
mov dword [0x45dfd4], ebx
mov dword [0x45dfd8], ebx
push 0x451b60
mov edi, 0x451b34
push edi
push 0x440b1c
push esi
call fcn.004195d0
mov dword [0x45dfc8], eax
push 0x451b64
push edi
push 0x440b0c
push esi
call fcn.004195d0
mov dword [0x45dfcc], eax
push 0x451b68
push edi
push 0x440afc
push esi
call fcn.004195d0
mov dword [0x45dfd0], eax
push 0x451b6c
push edi
push 0x440aec
push esi
call fcn.004195d0
add esp, 0x40
mov dword [0x45dfd4], eax
push 0x451b70
push edi
push 0x440adc
push esi
call fcn.004195d0
add esp, 0x10
mov dword [0x45dfd8], eax
xor ecx, ecx
cmp eax, ebx
sete cl
xor eax, eax
cmp dword [0x45dfd4], ebx
sete al
or ecx, eax
xor eax, eax
cmp dword [0x45dfd0], ebx
sete al
or ecx, eax
xor eax, eax
cmp dword [0x45dfcc], ebx
sete al
or ecx, eax
xor eax, eax
mov esi, dword [0x45dfc8]
cmp esi, ebx
sete al
or ecx, eax
jne 0x420ba6
push ebx
push 2
call esi
mov dword [0x45de98], eax
cmp eax, 0xffffffff
je 0x420ba6
mov dword [0x45dea0], 0x128
push 0x45dea0
push eax
call dword [0x45dfcc]
test eax, eax
je 0x420ba6
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x1b4]
push eax
push ebx
push ebx
push 0x45dec4
call fcn.00426b7e
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x1b4]
push eax
push ebx
push ebx
mov edi, dword [ebp + 0x10]
push dword [edi]
call fcn.00426aee
add esp, 0x28
mov esi, dword [ebp + 8]
mov eax, dword [0x45dea8]
mov dword [esi], eax
cmp eax, ebx
jne 0x421050
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x42105d
push eax
push ebx
push 0x410
call dword [0x451dfc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp eax, ebx
je 0x421074
mov byte [ebp - 0x6b9], 1
mov bl, 1
jmp 0x420ba6
push edi
push ecx
push esi
call fcn.00420417
add esp, 0xc
mov bl, al
mov byte [ebp - 0x6b9], bl
jmp 0x420ba6
mov ecx, dword [ebp - 0x1c]
call fcn.00425221
call fcn.0042526b
ret