Function at 0x426d4d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x467486
call fcn.004414e8
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x4745e4
mov dword [ebp - 0x18], 0x46ef78
call fcn.004033a0
push 0x46d690
mov dword [ebp - 4], ebx
call fcn.0042db31
pop ecx
push eax
push ebx
push 0x46d690
lea ecx, [edi + 4]
call fcn.004051c0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.0042f976
call fcn.00437610
inc ebx
test al, al
je 0x426e03
test byte [ebp - 0xac], bl
je 0x426df4
mov edi, 0x200
jmp 0x426e03
test byte [ebp - 0xac], 2
mov eax, 0x100
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x4271f7
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004022d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401500
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x426e66
mov esi, SysReAllocStringLen
jmp 0x426ef8
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x426e7e
mov esi, SysReAllocStringLen
jmp 0x426ef8
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x426e96
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x426ef8
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x426eae
mov esi, SysReAllocStringLen
jmp 0x426ef8
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x426ec6
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x426ef8
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x426ede
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x426ef8
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.00423876
test eax, eax
jne 0x4271f7
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004022d0
lea ecx, [ebp - 0xa0]
call fcn.00401500
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004013d0
test eax, eax
jne 0x4271ce
cmp dword [ebp + 8], ebx
jne 0x426f7c
cmp dword [ebp + 0xc], ebx
jmp 0x42705d
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x426f99
mov eax, dword [edi]
jmp 0x426f9b
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x427067
cmp dword [ebp - 0xb4], 4
jne 0x427070
cmp dword [ebp - 0xb0], 4
jne 0x427070
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.0042f976
mov eax, dword [ebp + 0xc]
dec eax
je 0x427051
dec eax
je 0x427040
dec eax
dec eax
je 0x42702f
sub eax, 0xc
je 0x427021
sub eax, 0x10
jne 0x4271ea
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x427060
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x427057
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x427060
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x427060
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x4271ea
cmp eax, 2
je 0x4271ce
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x478ed0
call fcn.00406979
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42709f
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.00406979
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.00406979
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.004381cd
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x427105
mov eax, dword [esi]
jmp 0x427107
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f9d8
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x42715d
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402330
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.0042622f
jmp 0x42716e
cmp dword [esi + 0x14], 8
jb 0x427165
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.0041ef84
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x427183
lea ecx, [ebp - 0xa0]
call fcn.00401500
mov eax, dword [ebp + 0xc]
dec eax
je 0x4271bd
dec eax
je 0x4271b6
dec eax
dec eax
je 0x4271af
sub eax, 4
je 0x4271ab
sub eax, 8
je 0x4271a3
sub eax, 0x10
jne 0x4271c4
test esi, esi
jmp 0x4271a6
cmp edi, 0xffffffff
setne al
jmp 0x4271c2
test edi, edi
jmp 0x4271bf
test esi, esi
setg al
jmp 0x4271c2
test esi, esi
sets al
jmp 0x4271c2
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401500
jmp 0x4271ea
cmp dword [ebp + 8], ebx
jne 0x4271dc
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x4271ea
cmp dword [ebp + 0xc], 2
je 0x4271ea
cmp dword [ebp + 0xc], 0x20
je 0x4271ea
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004013a0
jmp 0x4271f9
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401500
mov al, bl
call fcn.00441497
ret 0x18