Function at 0x42cc50
Capabilities:
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24c
mov eax, dword [0x43500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push str.detoured.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42cd8a
push str._etoured.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42cd8a
push str.nvd3d9wrap.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42cd8a
push str.nvdxgiwrap.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x42cd8a
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov bl, 1
test eax, eax
je 0x42ccda
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042da80
mov eax, ebx
add esp, 0x24c
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42cd07
mov bl, 1
jmp 0x42ccc3
movzx eax, word [0x42ffe8]
movsd xmm0, qword [0x42ffe0]
movsd xmm2, qword [0x42ffd8]
movsd xmm1, qword [0x42ffd0]
mov ecx, dword [ebp - 0x248]
lea ebx, [ebp - 0x24c]
mov dword [ebp - 0x24c], 0
mov word [ebp - 0x14], ax
movsd qword [ebp - 0x1c], xmm0
movsd qword [ebp - 0x24], xmm2
movsd qword [ebp - 0x2c], xmm1
lea eax, [ebp - 0x2c]
push ebx
push 0
push 0
push 0
push eax
mov dword [ebp - 0x258], ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
test eax, eax
je 0x42cd91
cmp dword [ebp - 0x258], 0
je 0x42cd82
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x42cd03
xor ebx, ebx
jmp 0x42ccc3
mov esi, dword [ebp - 0x24c]
inc esi
and esi, 0xfffffffe
push esi
call dword [sym.imp.mozglue.dll_moz_xmalloc]
add esp, 4
mov edi, eax
push esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebx
mov dword [ebp - 0x254], edi
push edi
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
test eax, eax
je 0x42cdef
push dword [ebp - 0x254]
call dword [sym.imp.mozglue.dll_free]
add esp, 4
cmp dword [ebp - 0x258], 0
jne 0x42cd76
jmp 0x42cd82
movzx eax, word [0x42ffee]
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x244]
mov word [ebp - 0x240], ax
mov eax, dword [0x42ffea]
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x250]
push eax
push ecx
push dword [ebp - 0x254]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
xor esi, esi
test eax, eax
je 0x42cdd5
mov edi, eax
lea ebx, [ebp - 0x22c]
jmp 0x42ce62
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x244]
push eax
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
add esp, 0xc
mov edi, eax
test eax, eax
je 0x42cdd5
push 0x200
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0
push 0
push 0x100
push ebx
push 0
push 0
push 0
push 0
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
add esp, 0x24
test eax, eax
jne 0x42ce3f
movsd xmm0, qword [0x42fff6]
movsd xmm1, qword [0x42fff0]
movsd qword [ebp - 0x236], xmm0
movsd qword [ebp - 0x23c], xmm1
push 7
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x42ce3f
mov esi, 1
jmp 0x42cdd5