Function at 0x421792
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x834
mov eax, 0x4b0403
call fcn.0048f423
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x83c], eax
xor eax, eax
xor ebx, ebx
cmp byte [0x507af8], al
mov edi, SysReAllocStringLen
sete al
push 0x505ab0
lea ecx, [ebp - 0x818]
mov dword [ebp - 4], ebx
add eax, edi
mov dword [ebp - 0x814], eax
call fcn.00408fd9
mov byte [ebp - 4], 1
cmp byte [ebp + 0x10], bl
je 0x42185d
call fcn.00422da4
test al, al
jne 0x421807
push 0x38
pop eax
push 0x67
pop esi
test esi, esi
je 0x421800
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x4217ef
add eax, esi
mov dword [0x507340], eax
cmp byte [0x50124c], 0
jne 0x42185d
mov eax, dword [0x507c30]
cmp dword [eax - 0xc], 0
jne 0x42181f
mov esi, edi
jmp 0x421863
push 0x4c0b70
lea eax, [ebp - 0x814]
push 0x507c30
push eax
mov esi, VariantInit
call fcn.00409229
add esp, 0xc
push eax
lea ecx, [ebp - 0x818]
mov byte [ebp - 4], 2
call fcn.00402394
mov ecx, dword [ebp - 0x814]
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x421863
mov esi, dword [ebp - 0x814]
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ebx
push 3
pop eax
push str.Software_
lea ecx, [ebp - 0x81c]
mov dword [ebp - 0x834], eax
mov byte [ebp - 4], al
call fcn.00416f4a
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x830]
push eax
mov byte [ebp - 4], 4
call fcn.004091d4
push 0x507c34
push eax
lea eax, [ebp - 0x840]
push eax
mov byte [ebp - 4], 5
call fcn.004091d4
push 0x4c0b70
push eax
lea eax, [ebp - 0x838]
push eax
mov byte [ebp - 4], 6
call fcn.00409229
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x814]
push eax
mov byte [ebp - 4], 7
call fcn.004091d4
add esp, 0x30
lea ecx, [ebp - 0x82c]
push 1
push dword [eax]
push esi
call fcn.004097e1
mov ecx, dword [ebp - 0x814]
test eax, eax
lea ecx, [ecx - 0x10]
setne bl
call fcn.00407864
mov ecx, dword [ebp - 0x838]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x840]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x830]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x81c]
push 3
pop eax
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], al
call fcn.00407864
test bl, bl
je 0x421959
xor ebx, ebx
jmp 0x421aaa
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor ebx, ebx
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0x820], 0x400
call fcn.004913e0
add esp, 0xc
mov edi, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
inc edi
test esi, esi
je 0x4219b7
cmp esi, 0x103
jne 0x421a90
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.00401b1e
mov eax, dword [ebp - 0x814]
mov byte [ebp - 4], 8
cmp dword [eax - 0xc], 0
je 0x4219eb
mov ecx, dword [ebp - 0x83c]
lea eax, [ebp - 0x814]
push eax
call fcn.0041d980
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0x820], 0x400
call fcn.004913e0
mov ecx, dword [0x507340]
mov eax, ecx
imul eax, ecx
cdq
mov dword [ebp - 0x81c], 0x18
idiv dword [ebp - 0x81c]
add esp, 0xc
cmp edx, 6
jne 0x421a7c
jmp 0x421a78
mov eax, ecx
and eax, 0x80000001
jns 0x421a3b
dec eax
or eax, 0xfffffffe
inc eax
jne 0x421a48
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x421a4f
lea ecx, [ecx*2 + 1]
mov eax, ecx
cdq
idiv dword [ebp - 0x834]
mov dword [0x507340], ecx
sub edx, ebx
je 0x421a6b
dec edx
dec edx
je 0x421a6e
dec edx
je 0x421a6f
jmp 0x421a78
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x507340], ecx
test ecx, ecx
jne 0x421a2d
mov ecx, dword [ebp - 0x814]
push 3
pop eax
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], al
call fcn.00407864
test esi, esi
je 0x421985
lea ecx, [ebp - 0x82c]
call fcn.004093e4
call fcn.00422e34
mov bl, 1
lea ecx, [ebp - 0x82c]
call fcn.004093e4
mov ecx, dword [ebp - 0x818]
add ecx, 0xfffffff0
call fcn.00407864
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00407864
mov al, bl
call fcn.0048f3d2
ret