Function at 0x42a972
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xc08
lea ebp, [esp - 4]
mov eax, dword [0x54b3f0]
xor eax, ebp
mov dword [ebp + 0xc08], eax
push 0x28
mov eax, 0x5039e3
call fcn.004d9926
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0xc18]
add eax, 0xfffffff0
call fcn.00403e21
add eax, 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push 0x5301bc
push eax
lea edi, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0041c502
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop ecx
pop ecx
lea eax, [ebp - 0x28]
push eax
push 9
push ebx
push dword [ebp - 0x18]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call edi
test eax, eax
je 0x42a9fd
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00403e7d
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00403e7d
jmp 0x42ab60
xor eax, eax
push 0x206
mov word [ebp + 0xa00], ax
lea eax, [ebp + 0xa02]
push ebx
push eax
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x1c], ebx
call fcn.004d8c50
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0xa00]
push eax
push ebx
jmp 0x42ab20
lea eax, [ebp + 0xa00]
push eax
push dword [ebp - 0x18]
lea eax, [ebp]
push str._ls_ls
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x30]
push eax
push 9
push ebx
lea eax, [ebp]
push eax
push esi
call edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x5301e4
push dword [ebp - 0x30]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0xe], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42aaa4
cmp dword [ebp - 0x14], 4
jne 0x42aaa4
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp + 0xc14]
jne 0x42aaa4
mov byte [ebp - 0xe], 1
xor eax, eax
push 0x1fc
mov word [ebp + 0x800], ax
lea eax, [ebp + 0x802]
push ebx
push eax
call fcn.004d8c50
add esp, 0xc
mov dword [ebp - 0x2c], 0x1fe
mov dword [ebp - 0x14], ebx
cmp byte [ebp - 0xe], bl
je 0x42ab02
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0x800]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.InstallInfo
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42ab02
cmp dword [ebp - 0x14], 1
jne 0x42ab02
cmp word [ebp + 0x800], bx
jne 0x42ab3a
push ebx
push ebx
xor eax, eax
inc dword [ebp - 0x1c]
push ebx
mov word [ebp + 0xa00], ax
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0xa00]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x42aa36
jmp 0x42ab3e
mov byte [ebp - 0xd], 1
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00403e7d
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
call fcn.00403e7d
mov bl, byte [ebp - 0xd]
mov eax, dword [ebp + 0xc18]
add eax, 0xfffffff0
call fcn.00403e7d
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xc08]
xor ecx, ebp
call fcn.004d574b
add ebp, 0xc0c
leave
ret