Function at 0x421da0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x428fc7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
xor ebp, ebp
push edi
mov edi, ecx
mov dword [esp + 0x14], ebp
push 0x440958
lea ecx, [esp + 0x1c]
mov dword [esp + 0x54], 1
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], 0x200
call sub.MFC42u.DLL_CString::CString_1
mov edx, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ebp
push ecx
push ebp
push edx
push esi
mov byte [esp + 0x68], 2
call ebx
cmp eax, ebp
jne case.default.0x421e1e
mov eax, dword [esp + 0x64]
cmp eax, 7
ja case.default.0x421e1e
jmp dword [eax*4 + 0x422480]
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x421e37
cmp eax, 2
jne case.default.0x421e1e
mov eax, dword [esp + 0x10]
cmp eax, ebp
jbe case.default.0x421e1e
shr eax, 1
lea eax, [eax + eax + 2]
push eax
call sub.MFC42u.DLL_operatornew
mov edx, dword [esp + 0x64]
add esp, 4
lea ecx, [esp + 0x10]
mov edi, eax
push ecx
push edi
push ebp
push ebp
push edx
push esi
call ebx
push 0x440958
lea ecx, [esp + 0x60]
mov esi, eax
call sub.MFC42u.DLL_CString::CString_1
push edi
lea ecx, [esp + 0x60]
mov byte [esp + 0x54], 3
call fcn.00423f2c
cmp esi, ebp
jne 0x421eb2
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x5c]
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x5c]
jmp 0x42242f
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push edx
push ebp
push ebp
push eax
push esi
call ebx
test eax, eax
jne case.default.0x421e1e
lea ecx, [esp + 0x20]
lea edx, [esp + 0x5c]
push ecx
push edx
mov ecx, edi
call fcn.004232c0
mov eax, dword [esp + 0x5c]
push 0x440958
push eax
mov byte [esp + 0x58], 4
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
jne 0x421f3d
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
lea ecx, [esp + 0x5c]
call sub.MFC42u.DLL_CString::CString_3
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x10]
lea eax, [esp + 0x64]
push edx
push eax
push ebp
push ebp
push ecx
push esi
mov byte [esp + 0x68], 5
call ebx
test eax, eax
jne 0x42203a
mov ecx, dword [esp + 0x64]
mov eax, 0x88888889
imul ecx
add edx, ecx
mov esi, 0x3c
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
mov eax, ecx
cdq
idiv esi
mov eax, edx
cdq
xor eax, edx
sub eax, edx
push eax
push ecx
lea ecx, [esp + 0x64]
push str._d._d
push ecx
call sub.MFC42u.DLL_CString::Format
mov edx, dword [esp + 0x6c]
push 0x440958
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x18
cmp eax, ebp
jne 0x42200f
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x5c]
jmp 0x42242f
lea ecx, [esp + 0x5c]
call sub.MFC42u.DLL_CString::CString_3
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x64]
push ecx
push edx
push ebp
push ebp
push eax
push esi
mov byte [esp + 0x68], 6
call ebx
test eax, eax
jne 0x42211f
lea ecx, [esp + 0x64]
push ecx
call dword [sym.imp.MSVCRT.dll_localtime]
mov edx, eax
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
push edx
push str._a___d__b__Y__H:_M:_S
lea edx, [esp + 0x34]
push 0x1e
push edx
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_strftime]
add esp, 0x14
lea eax, [esp + 0x28]
lea ecx, [esp + 0x5c]
push eax
call fcn.00424244
mov ecx, dword [esp + 0x5c]
push 0x440958
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
jne 0x4220f4
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov esi, dword [esp + 0x58]
lea edx, [esp + 0x5c]
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x5c]
jmp 0x42242f
mov edx, dword [esp + 0x60]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x64]
push eax
push ecx
push ebp
push ebp
push edx
push esi
call ebx
test eax, eax
jne case.0x421e1e.5
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x5c]
push eax
push ecx
mov ecx, 0x4482f8
call fcn.00410cc0
mov edx, dword [esp + 0x5c]
push 0x440958
push edx
mov byte [esp + 0x58], 7
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
jne 0x4221a4
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
lea ecx, [esp + 0x5c]
call sub.MFC42u.DLL_CString::CString_3
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x64]
push ecx
push edx
push ebp
push ebp
push eax
push esi
mov byte [esp + 0x68], 8
call ebx
test eax, eax
jne 0x42227a
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x5c]
push ecx
push 0x43334c
push edx
call sub.MFC42u.DLL_CString::Format
mov eax, dword [esp + 0x68]
push 0x440958
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x14
cmp eax, ebp
jne 0x42224f
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x5c]
jmp 0x42242f
mov edx, dword [esp + 0x10]
shr edx, 1
lea eax, [edx + edx + 2]
push eax
call sub.MFC42u.DLL_operatornew
mov edx, dword [esp + 0x64]
add esp, 4
lea ecx, [esp + 0x10]
mov edi, eax
push ecx
push edi
push ebp
push ebp
push edx
push esi
call ebx
push 0x440958
lea ecx, [esp + 0x60]
mov esi, eax
call sub.MFC42u.DLL_CString::CString_1
push edi
lea ecx, [esp + 0x60]
mov byte [esp + 0x54], 9
call fcn.00423f2c
cmp esi, ebp
jne 0x42233d
mov eax, dword [esp + 0x5c]
push 0x440958
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
jne 0x422312
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
mov esi, dword [esp + 0x58]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
push edi
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x5c]
jmp 0x42242f
mov edx, dword [esp + 0x10]
inc edx
push edx
call sub.MFC42u.DLL_operatornew
mov ebp, eax
mov eax, dword [esp + 0x14]
mov edi, ebp
add esp, 4
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x10]
push eax
push ebp
push 0
push 0
push ecx
push esi
call ebx
push 0x440958
lea ecx, [esp + 0x60]
mov esi, eax
call sub.MFC42u.DLL_CString::CString_1
test esi, esi
mov byte [esp + 0x50], 0xa
jne 0x42241d
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x4223f5
cmp byte [esi + ebp], 0
jne 0x4223d7
mov al, byte [esi + ebp + 1]
test al, al
jne 0x4223d7
mov al, byte [esi + ebp + 2]
test al, al
jne 0x4223d7
push str.EXEPATH:
lea ecx, [esp + 0x60]
call sub.MFC42u.DLL_CString::operator_1
add esi, 2
mov al, byte [esi + ebp]
test al, al
je 0x4223ec
movsx dx, al
push edx
lea ecx, [esp + 0x60]
call sub.MFC42u.DLL_CString::operator_2
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x4223b0
mov esi, dword [esp + 0x58]
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_4
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], 1
mov byte [esp + 0x50], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x42244c
push ebp
call sub.MFC42u.DLL_operatordelete
add esp, 4
mov byte [esp + 0x50], 2
lea ecx, [esp + 0x5c]
call sub.MFC42u.DLL_CString::CString
mov esi, dword [esp + 0x58]
push 0x433a84
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_1
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], 1
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x60]
mov byte [esp + 0x50], 0
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0x10