Function at 0x4261ba
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x465b54
call fcn.0043fcc0
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x471efc
mov dword [ebp - 0x18], 0x46cf9c
call fcn.004033a0
push 0x46b7a8
mov dword [ebp - 4], ebx
call fcn.0042c205
pop ecx
push eax
push ebx
push 0x46b7a8
lea ecx, [edi + 4]
call fcn.004051c0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.0042dd33
call fcn.00435b59
inc ebx
test al, al
je 0x426270
test byte [ebp - 0xac], bl
je 0x426261
mov edi, 0x200
jmp 0x426270
test byte [ebp - 0xac], 2
mov eax, 0x100
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x426664
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004022d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401500
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x4262d3
mov esi, SysReAllocStringLen
jmp 0x426365
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x4262eb
mov esi, SysReAllocStringLen
jmp 0x426365
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x426303
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x426365
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x42631b
mov esi, SysReAllocStringLen
jmp 0x426365
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x426333
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x426365
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x42634b
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x426365
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042b69e
test eax, eax
jne 0x426664
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004022d0
lea ecx, [ebp - 0xa0]
call fcn.00401500
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004013d0
test eax, eax
jne 0x42663b
cmp dword [ebp + 8], ebx
jne 0x4263e9
cmp dword [ebp + 0xc], ebx
jmp 0x4264ca
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x426406
mov eax, dword [edi]
jmp 0x426408
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4264d4
cmp dword [ebp - 0xb4], 4
jne 0x4264dd
cmp dword [ebp - 0xb0], 4
jne 0x4264dd
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.0042dd33
mov eax, dword [ebp + 0xc]
dec eax
je 0x4264be
dec eax
je 0x4264ad
dec eax
dec eax
je 0x42649c
sub eax, 0xc
je 0x42648e
sub eax, 0x10
jne 0x426657
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x4264cd
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x4264c4
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x4264cd
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x4264cd
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x426657
cmp eax, 2
je 0x42663b
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x4767e0
call fcn.004067be
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42650c
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.004067be
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.004067be
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.00436715
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x426572
mov eax, dword [esi]
jmp 0x426574
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f773
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x4265ca
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402330
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.00425b85
jmp 0x4265db
cmp dword [esi + 0x14], 8
jb 0x4265d2
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.0041edfe
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x4265f0
lea ecx, [ebp - 0xa0]
call fcn.00401500
mov eax, dword [ebp + 0xc]
dec eax
je 0x42662a
dec eax
je 0x426623
dec eax
dec eax
je 0x42661c
sub eax, 4
je 0x426618
sub eax, 8
je 0x426610
sub eax, 0x10
jne 0x426631
test esi, esi
jmp 0x426613
cmp edi, 0xffffffff
setne al
jmp 0x42662f
test edi, edi
jmp 0x42662c
test esi, esi
setg al
jmp 0x42662f
test esi, esi
sets al
jmp 0x42662f
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401500
jmp 0x426657
cmp dword [ebp + 8], ebx
jne 0x426649
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x426657
cmp dword [ebp + 0xc], 2
je 0x426657
cmp dword [ebp + 0xc], 0x20
je 0x426657
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004013a0
jmp 0x426666
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401500
mov al, bl
call fcn.0043fc6f
ret 0x18