Function at 0x42b350
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x45a1d1
push eax
mov eax, 0x3020
mov dword fs:[0], esp
call fcn.00457870
mov eax, dword [0x4631a0]
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x3044]
mov dword [esp + 0x3038], ebp
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
add esp, 4
cmp edi, ebp
je 0x42b5ec
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_wcschr]
add esp, 8
test eax, eax
jne 0x42b5ec
lea ecx, [esp + 0x1030]
push ebp
push ecx
push 0x1000
push str..exe
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x42b44c
lea edx, [esp + 0x1030]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x42b44c
lea eax, [esp + 0x1030]
test eax, eax
jne 0x42b3f8
xor esi, esi
jmp 0x42b408
lea ecx, [esp + 0x1030]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push esi
lea ecx, [esp + 0x14]
call fcn.00401cb0
test eax, eax
je 0x42b5b3
mov ecx, dword [esp + 0x10]
lea edi, [esi + esi]
lea edx, [esp + 0x1030]
push edi
lea eax, [esi + esi + 2]
push edx
push eax
push ecx
call fcn.00401bc0
mov edx, dword [esp + 0x20]
add esp, 0x10
mov dword [edx - 8], esi
mov eax, dword [esp + 0x10]
mov word [edi + eax], bp
jmp 0x42b5b3
lea ecx, [esi + edi*2 - 8]
push str..exe
push ecx
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
lea edx, [esp + 0x1030]
neg eax
sbb eax, eax
and eax, str..exe
push eax
push esi
push 0x46707c
push 0x2000
push edx
call fcn.00429450
add esp, 0x14
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x468dac
call fcn.0042a190
push ecx
lea eax, [esp + 0x103c]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
mov byte [esp + 0x3048], 1
call fcn.004171e0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x30]
mov byte [esp + 0x3048], 0
call fcn.00421240
mov esi, eax
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
lea ecx, [esp + 0x18]
or edx, 1
push ecx
push edx
push ebp
push eax
mov eax, dword [esi]
mov byte [esp + 0x3048], 2
push eax
mov dword [esp + 0x30], 0x1000
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42b568
mov esi, dword [esi + 8]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push ebp
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x18]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x42b568
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x42b53f
cmp eax, 1
jne 0x42b568
lea eax, [esp + 0x30]
test eax, eax
je 0x42b552
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [esp + 0x30]
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.00408770
mov eax, 1
jmp 0x42b56a
xor eax, eax
mov edx, dword [0x4631a4]
cmp eax, ebp
mov eax, dword [esp + 0x28]
mov byte [esp + 0x3038], 0
sete bl
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42b5a6
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42b5a6
mov edx, dword [esp + 0x28]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00401c80
test bl, bl
jne 0x42b5ec
lea eax, [esp + 0x10]
push eax
call fcn.00420cb0
mov ecx, dword [0x4631a0]
mov esi, esp
mov dword [esp + 0x18], esp
push 1
mov dword [esi], ecx
mov ecx, esi
call fcn.00404720
test eax, eax
je 0x42b5df
mov edx, dword [esi]
mov word [edx], 0x22
lea eax, [esp + 0x14]
push eax
call fcn.00420aa0
add esp, 8
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x3040]
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
cmp edx, ebp
jl 0x42b60c
push ecx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x42b655
mov ecx, dword [0x4631a0]
cmp eax, ebp
mov dword [esi], ecx
mov ebx, eax
jne 0x42b61e
xor edi, edi
jmp 0x42b627
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
mov ecx, esi
call fcn.00401cb0
test eax, eax
je 0x42b655
mov eax, dword [esi]
lea ebp, [edi + edi]
push ebp
lea edx, [edi + edi + 2]
push ebx
push edx
push eax
call fcn.00401bc0
mov ecx, dword [esi]
add esp, 0x10
mov dword [ecx - 8], edi
mov edx, dword [esi]
mov word [edx + ebp], 0
mov eax, dword [esp + 0x10]
mov edx, dword [0x4631a4]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x42b684
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x42b684
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.0044bf22
add esp, 4
mov ecx, dword [esp + 0x3030]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x302c
ret