Function at 0x42113e
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push 0x55c
mov eax, 0x42b6e0
call fcn.00428a3d
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x528]
call dword [0x43629c]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x540]
call dword [0x43629c]
xor ebx, ebx
lea ecx, [ebp - 0x538]
inc ebx
mov byte [ebp - 4], bl
call dword [0x43629c]
mov ecx, edi
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::Empty]
push esi
lea ecx, [ebp - 0x538]
call dword [0x4362a4]
push 0x40363c
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MFC42u.dll_CString::CString_1]
mov esi, eax
push ebx
lea eax, [ebp - 0x530]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x538]
call dword [sym.imp.MFC42u.dll_CString::Right]
push dword [esi]
mov ecx, eax
call fcn.00413075
lea ecx, [ebp - 0x530]
mov esi, eax
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::CString]
test esi, esi
je 0x421220
push 0x40363c
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MFC42u.dll_CString::CString_1]
push eax
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 4
call dword [sym.imp.MFC42u.dll_CString::operator_2]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x66
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::LoadStringW]
push 0x408870
lea ecx, [ebp - 0x530]
call dword [sym.imp.MFC42u.dll_CString::CString_3]
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.MFC42u.dll_operator]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 6
call dword [0x4362a4]
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x4b5
lea ecx, [ebp - 0x540]
call dword [sym.imp.MFC42u.dll_CString::LoadStringW]
lea eax, [ebp - 0x54c]
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp - 0x540]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421316
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x52c], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x530]
push eax
push esi
push 0x408850
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42130a
cmp dword [ebp - 0x530], ebx
jne 0x42130a
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x528]
call dword [0x436288]
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x534]
call dword [0x43629c]
push 0xa
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 7
call dword [sym.imp.MFC42u.dll_CStringList::CStringList]
mov byte [ebp - 4], 8
jmp 0x421478
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
cmp eax, 0xffffffff
jne 0x421365
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call dword [0x4362a4]
jmp 0x4213a8
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Left]
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 9
call dword [0x4362a4]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x568]
call dword [sym.imp.MFC42u.dll_CStringList::RemoveAll]
lea eax, [ebp - 0x568]
push eax
lea edx, [ebp - 0x538]
lea ecx, [ebp - 0x534]
call fcn.004217a8
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x530], eax
test eax, eax
jne 0x42149d
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax - 8]
mov eax, dword [ebp - 0x534]
sub ecx, dword [eax - 8]
lea eax, [ebp - 0x544]
push ecx
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xa
call dword [0x4362a4]
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
test eax, eax
jne 0x421478
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xb
call dword [0x4362a4]
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
jne 0x42133d
push 0x408874
lea ecx, [ebp - 0x528]
call dword [0x4362a8]
jmp 0x421739
lea eax, [ebp - 0x530]
push eax
call fcn.004174bf
push eax
mov ecx, edi
call dword [0x4362a4]
jmp 0x42174a
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
cmp eax, 0xffffffff
jne 0x4214df
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call dword [0x4362a4]
jmp 0x421522
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
push eax
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Left]
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0xc
call dword [0x4362a4]
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x568]
call dword [sym.imp.MFC42u.dll_CStringList::RemoveAll]
lea eax, [ebp - 0x568]
push eax
lea edx, [ebp - 0x538]
lea ecx, [ebp - 0x534]
call fcn.004217a8
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x530], eax
test eax, eax
je 0x4216a1
lea eax, [ebp - 0x530]
push eax
call fcn.004174bf
push eax
mov ecx, edi
call dword [0x4362a4]
push esi
push 0x80
push 3
push esi
push ebx
push SysReAllocStringLen
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x421691
push 0
lea eax, [ebp - 0x53c]
push eax
push ebx
lea eax, [ebp - 0x31c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421797
cmp word [ebp - 0x31c], 0x3c
jne 0x42160f
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x31c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421797
lea eax, [ebp - 0x31c]
push 0x408880
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42178e
push ebx
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x4215bb
jmp 0x42168a
push 0
lea eax, [ebp - 0x53c]
push eax
push ebx
lea eax, [ebp - 0x524]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421797
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x524]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421797
xor eax, eax
mov word [ebp - 0x500], ax
lea eax, [ebp - 0x524]
push 0x408880
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42178e
push ebx
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x42162f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x530], 0
push 0
pop esi
jne 0x42155a
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax - 8]
mov eax, dword [ebp - 0x534]
sub ecx, dword [eax - 8]
lea eax, [ebp - 0x544]
push ecx
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xd
call dword [0x4362a4]
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
test eax, eax
jne 0x421739
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xe
call dword [0x4362a4]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
jne 0x4214b7
mov ebx, esi
lea ecx, [ebp - 0x568]
call dword [0x436234]
lea ecx, [ebp - 0x534]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x538]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x540]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, ebx
call fcn.004289da
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x42174a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x42174a