Function at 0x425618
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x46479e
call fcn.0043f4b0
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x46be90
mov dword [ebp - 0x18], 0x46c540
call fcn.004033a0
push 0x46a790
mov dword [ebp - 4], ebx
call fcn.0042b990
pop ecx
push eax
push ebx
push 0x46a790
lea ecx, [edi + 4]
call fcn.004051b0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.0042d590
call fcn.00434b67
inc ebx
test al, al
je 0x4256ce
test byte [ebp - 0xac], bl
je 0x4256bf
mov edi, 0x200
jmp 0x4256ce
test byte [ebp - 0xac], 2
mov eax, pe_nt_image_headers32
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x425ac2
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004022d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401500
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x425731
mov esi, SysReAllocStringLen
jmp 0x4257c3
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x425749
mov esi, SysFreeString
jmp 0x4257c3
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x425761
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x4257c3
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x425779
mov esi, SysFreeString
jmp 0x4257c3
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x425791
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x4257c3
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x4257a9
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x4257c3
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042ab6d
test eax, eax
jne 0x425ac2
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004022d0
lea ecx, [ebp - 0xa0]
call fcn.00401500
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004013d0
test eax, eax
jne 0x425a99
cmp dword [ebp + 8], ebx
jne 0x425847
cmp dword [ebp + 0xc], ebx
jmp 0x425928
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x425864
mov eax, dword [edi]
jmp 0x425866
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x425932
cmp dword [ebp - 0xb4], 4
jne 0x42593b
cmp dword [ebp - 0xb0], 4
jne 0x42593b
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.0042d590
mov eax, dword [ebp + 0xc]
dec eax
je 0x42591c
dec eax
je 0x42590b
dec eax
dec eax
je 0x4258fa
sub eax, 0xc
je 0x4258ec
sub eax, 0x10
jne 0x425ab5
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x42592b
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x425922
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x42592b
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x42592b
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x425ab5
cmp eax, 2
je 0x425a99
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x476040
call fcn.004067ae
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42596a
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.004067ae
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.004067ae
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.00435793
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x4259d0
mov eax, dword [esi]
jmp 0x4259d2
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f542
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x425a28
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402330
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.00424fe3
jmp 0x425a39
cmp dword [esi + 0x14], 8
jb 0x425a30
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.0041e608
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x425a4e
lea ecx, [ebp - 0xa0]
call fcn.00401500
mov eax, dword [ebp + 0xc]
dec eax
je 0x425a88
dec eax
je 0x425a81
dec eax
dec eax
je 0x425a7a
sub eax, 4
je 0x425a76
sub eax, 8
je 0x425a6e
sub eax, 0x10
jne 0x425a8f
test esi, esi
jmp 0x425a71
cmp edi, 0xffffffff
setne al
jmp 0x425a8d
test edi, edi
jmp 0x425a8a
test esi, esi
setg al
jmp 0x425a8d
test esi, esi
sets al
jmp 0x425a8d
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401500
jmp 0x425ab5
cmp dword [ebp + 8], ebx
jne 0x425aa7
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x425ab5
cmp dword [ebp + 0xc], 2
je 0x425ab5
cmp dword [ebp + 0xc], 0x20
je 0x425ab5
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004013a0
jmp 0x425ac4
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401500
mov al, bl
call fcn.0043f45f
ret 0x18