Function at 0x426788
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba0
xor ecx, ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x426aea
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
jne 0x42690c
xor eax, eax
mov dword [ebp - 0x10], eax
push 0x20a
lea eax, [ebp - 0x232]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x426806
cmp dword [ebp - 0x14], 0x103
jne 0x426abb
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x426abb
cmp word [ebp - 0x232], 0x2e
je 0x4268ee
lea eax, [ebp - 0x232]
call fcn.00419fec
mov dword [ebp - 0x24], eax
mov edx, 0x426af8
lea eax, [ebp - 0x232]
call fcn.0041a048
mov edx, 0x426b20
lea eax, [ebp - 0x43c]
call fcn.0041a014
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x232]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42689e
mov eax, dword [ebp - 0x24]
mov word [ebp + eax*2 - 0x232], 0
mov dword [ebp - 0x20], 0x20a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x426b60
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 0x14], 0
jne 0x4268ee
mov eax, dword [ebp - 0x20]
shr eax, 1
mov word [ebp + eax*2 - 0x43e], 0
lea eax, [ebp - 0x232]
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0x448], 0xa
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x444], eax
mov byte [ebp - 0x440], 0xa
lea edx, [ebp - 0x44c]
mov eax, 0x426b64
mov ecx, 1
call fcn.00423c4c
mov eax, dword [0x436ba8]
cmp dword [eax], 0
je 0x426904
mov dword [ebp - 0xc], 1
jmp 0x426ac1
inc dword [ebp - 0x10]
jmp 0x4267cd
mov eax, dword [ebp - 8]
cmp word [eax], 0x2e
jne 0x426959
push 0
lea edx, [ebp - 0x450]
mov eax, dword [0x436cec]
call fcn.00409578
mov eax, dword [ebp - 0x450]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x458], edx
mov byte [ebp - 0x454], 0xa
lea ecx, [ebp - 0x458]
mov edx, 1
call fcn.0042a3c8
mov dword [ebp - 0xc], 0x7b
jmp 0x426ac1
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.0042ad74
mov dword [ebp - 8], eax
mov dx, 0x20
mov eax, dword [ebp - 8]
call fcn.00419f78
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x426983
mov eax, dword [ebp - 0x1c]
mov word [eax], 0
push 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x458], eax
mov byte [ebp - 0x454], 0xa
lea ecx, [ebp - 0x458]
mov edx, 0x426b74
lea eax, [ebp - 0x232]
call fcn.0041a148
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x232]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x426a0b
push 0
lea edx, [ebp - 0x45c]
mov eax, dword [0x436cec]
call fcn.00409578
mov eax, dword [ebp - 0x45c]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x458], edx
mov byte [ebp - 0x454], 0xa
lea ecx, [ebp - 0x458]
mov edx, 1
call fcn.0042a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x426ac1
mov dword [ebp - 0x20], 0x20a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x426b60
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x426a83
mov eax, dword [ebp - 0x20]
shr eax, 1
mov word [ebp + eax*2 - 0x43e], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0x448], 0xa
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x444], eax
mov byte [ebp - 0x440], 0xa
lea edx, [ebp - 0x44c]
mov eax, 0x426b64
mov ecx, 1
call fcn.00423c4c
jmp 0x426abb
push 0
lea edx, [ebp - 0x460]
mov eax, dword [0x436cec]
call fcn.00409578
mov eax, dword [ebp - 0x460]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x458], edx
mov byte [ebp - 0x454], 0xa
lea ecx, [ebp - 0x458]
mov edx, 1
call fcn.0042a3c8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x426af1
lea eax, [ebp - 0x460]
mov edx, 2
call fcn.00406a7c
lea eax, [ebp - 0x450]
call fcn.00406a1c
ret