Function at 0x424a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59cb99
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x5ec374]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd8], ecx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xd4], eax
xor eax, eax
mov dword [ebp - 0x80], eax
push str.DisplayName
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x84]
push edi
push eax
mov dword [ebp - 0xdc], ebx
call fcn.00428d90
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x78], 4
push eax
push 0
push str.SystemComponent
push dword [edi]
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x84]
or ecx, 0xffffffff
cmp dword [ebp - 0x7c], 1
je 0x425065
cmp dword [eax - 0xc], 0
je 0x425065
test ebx, ebx
je 0x425065
push 0xfde9
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.0047d3c0
add esp, 0xc
lea ecx, [ebx + 0x18]
push eax
call fcn.0041dff0
lea ecx, [ebp - 0xb4]
call fcn.004064a0
lea eax, [ebp - 0xb4]
push edi
push eax
call fcn.00408960
add esp, 8
lea esi, [ebx + 0x48]
mov ecx, esi
push eax
call fcn.0041e030
lea ecx, [ebp - 0xb4]
call fcn.004064f0
cmp dword [ebx + 0x58], 0
je 0x425058
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.005663c0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x424ba9
mov esi, dword [esi]
push 0xfde9
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.0047d3c0
cmp dword [ebp - 0xa0], 0x10
lea ecx, [ebp - 0x74]
push 0x64
push ecx
push dword [ebp - 0xa4]
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 1
cmovae eax, dword [ebp - 0xb4]
push eax
call fcn.005270d0
lea ecx, [ebp - 0x74]
add esp, 0x1c
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x424bf0
sub ecx, edx
lea eax, [ebp - 0x74]
push ecx
push eax
mov ecx, ebx
call fcn.0040c820
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0x80]
push str.DisplayIcon
push edi
push eax
call fcn.00428d90
push 0xfde9
push dword [eax]
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 2
push eax
call fcn.0047d3c0
add esp, 0xc
lea edi, [ebx + 0x30]
mov ecx, edi
push eax
call fcn.0041dff0
lea ecx, [ebp - 0x9c]
call fcn.004064a0
mov edx, dword [ebp - 0x80]
or eax, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x424c69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi + 0x10]
test esi, esi
jne 0x424cc7
push dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd8]
lea eax, [ebp - 0xd4]
push eax
call fcn.00426da0
push 0xfde9
push dword [eax]
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 3
push eax
call fcn.0047d3c0
add esp, 0xc
mov ecx, edi
push eax
call fcn.0041dff0
lea ecx, [ebp - 0x9c]
call fcn.004064a0
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 1
call fcn.00406110
mov esi, dword [ebx + 0x40]
mov eax, dword [edi + 0x14]
mov ecx, edi
mov dword [ebp - 0x7c], edi
cmp eax, 0x10
jb 0x424cd9
mov ecx, dword [edi]
mov dword [ebp - 0x7c], ecx
mov edx, esi
test esi, esi
je 0x424d28
push esi
push 0x2c
push ecx
call fcn.00567890
add esp, 0xc
mov edx, esi
test eax, eax
je 0x424d25
sub eax, dword [ebp - 0x7c]
cmp eax, 0xffffffff
je 0x424d2c
push eax
push 0
lea eax, [ebp - 0x9c]
mov ecx, edi
push eax
call fcn.00448020
push eax
mov ecx, edi
call fcn.0041dff0
lea ecx, [ebp - 0x9c]
call fcn.004064a0
mov eax, dword [ebx + 0x44]
mov esi, dword [ebx + 0x40]
jmp 0x424d2f
mov eax, dword [edi + 0x14]
mov esi, edx
jmp 0x424d2f
mov eax, dword [edi + 0x14]
mov ecx, edi
mov ebx, eax
cmp eax, 0x10
jb 0x424d3a
mov ecx, dword [edi]
add ecx, esi
mov dword [ebp - 0x78], ecx
mov ecx, edi
cmp eax, 0x10
jb 0x424d48
mov ecx, dword [edi]
add esi, ecx
mov ecx, edi
cmp eax, 0x10
jb 0x424d53
mov ecx, dword [edi]
mov eax, esi
sub eax, ecx
push eax
push 0x22
push ecx
call fcn.00567890
add esp, 0xc
mov ecx, esi
test eax, eax
cmovne ecx, eax
cmp ecx, esi
je 0x424d9e
lea eax, [ecx + 1]
mov dword [ebp - 0x7c], esi
sub dword [ebp - 0x7c], eax
xor edx, edx
cmp eax, esi
mov esi, dword [ebp - 0x7c]
cmova esi, edx
test esi, esi
je 0x424d9e
mov bl, byte [eax]
cmp bl, 0x22
je 0x424d8f
mov byte [ecx], bl
inc ecx
inc edx
inc eax
cmp edx, esi
jne 0x424d85
mov ebx, dword [ebp - 0xdc]
mov ebx, dword [ebx + 0x44]
mov eax, edi
cmp ebx, 0x10
jb 0x424da7
mov eax, dword [edi]
mov edx, dword [edi + 0x10]
mov esi, ecx
sub esi, eax
cmp edx, esi
jb 0x4250a3
sub dword [ebp - 0x78], ecx
mov eax, edx
mov ecx, dword [ebp - 0x78]
sub eax, esi
cmp eax, ecx
cmovb ecx, eax
mov eax, edi
mov dword [ebp - 0x78], ecx
cmp ebx, 0x10
jb 0x424dd1
mov eax, dword [edi]
lea ecx, [eax + esi]
mov eax, dword [ebp - 0x78]
sub edx, eax
add eax, ecx
mov dword [edi + 0x10], edx
sub edx, esi
inc edx
push edx
push eax
push ecx
call fcn.00566dd0
lea eax, [ebp - 0xcc]
push edi
push eax
call fcn.0046acb0
add esp, 0x14
cmp dword [ebp - 0xbc], 0
mov byte [ebp - 4], 4
je 0x424e68
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0046a680
push str..ico
mov ebx, 1
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0x80], ebx
call fcn.004170e0
add esp, 8
test al, al
jne 0x424e5f
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0046a680
push str..icon
push eax
mov ebx, 3
call fcn.004170e0
add esp, 8
test al, al
je 0x424e6e
mov byte [ebp - 0xcd], 1
jmp 0x424e75
mov ebx, dword [ebp - 0xe0]
mov byte [ebp - 0xcd], 0
test bl, 2
je 0x424e88
lea ecx, [ebp - 0x9c]
and ebx, 0xfffffffd
call fcn.004064f0
mov dword [ebp - 4], 4
test bl, 1
je 0x424e9f
lea ecx, [ebp - 0xf8]
call fcn.004064f0
cmp byte [ebp - 0xcd], 0
je 0x424f1e
mov ebx, dword [ebp - 0xd8]
lea eax, [ebx + 0x230]
push eax
push 0
push 0
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00408180
add esp, 0x14
push 0
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xcc]
mov ecx, ebx
push eax
call fcn.0041f3c0
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x9c]
call fcn.00466ed0
push eax
mov ecx, edi
call fcn.0041dff0
lea ecx, [ebp - 0xf8]
call fcn.004064a0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 4
call fcn.004064f0
cmp dword [edi + 0x10], 0
je 0x425035
push edi
lea ecx, [ebp - 0x9c]
call fcn.0041b670
cmp dword [edi + 0x14], 0x10
mov ecx, edi
mov byte [ebp - 4], 7
jb 0x424f42
mov ecx, dword [edi]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x424f99
or edx, 0xffffffff
dec eax
cmp eax, edx
cmovb edx, eax
add edx, ecx
cmp byte [edx], 0x2c
je 0x424f6a
nop dword [eax]
cmp edx, ecx
je 0x424f99
dec edx
cmp byte [edx], 0x2c
jne 0x424f60
sub edx, ecx
cmp edx, 0xffffffff
je 0x424f99
push edx
push 0
lea eax, [ebp - 0xf8]
mov ecx, edi
push eax
call fcn.00448020
push eax
lea ecx, [ebp - 0x9c]
call fcn.0041dff0
lea ecx, [ebp - 0xf8]
call fcn.004064a0
cmp dword [ebp - 0x88], 0x10
lea eax, [ebp - 0x9c]
push 0xfde9
cmovae eax, dword [ebp - 0x9c]
push eax
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x78], 0
push eax
call fcn.0047d500
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 8
jb 0x424fd5
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x78]
call fcn.0041b3a0
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0xa
call fcn.004064f0
push 0x5aa9d4
push 0x5ab10c
lea ecx, [ebp - 0x78]
call fcn.00409f40
push str..exe
push dword [ebp - 0x78]
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
test eax, eax
je 0x425022
mov ecx, dword [ebp - 0xdc]
push dword [ebp - 0x78]
lea ecx, [ecx + 0x60]
call fcn.00413d30
lea ecx, [ebp - 0x78]
call fcn.00406110
lea ecx, [ebp - 0x9c]
call fcn.004064a0
lea ecx, [ebp - 0xcc]
call fcn.004064f0
lea ecx, [ebp - 0xb4]
call fcn.004064a0
mov eax, dword [ebp - 0x84]
mov bl, 1
or ecx, 0xffffffff
jmp 0x425067
mov eax, dword [ebp - 0x84]
xor bl, bl
or ecx, 0xffffffff
jmp 0x425067
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x425083
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045674d
mov esp, ebp
pop ebp
ret 0xc
call fcn.0040c0f0
int3