Function at 0x42b63e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4608a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x4260
call fcn.0042dfe0
push edi
mov dword [ebp - 0x426c], ecx
mov dword [ebp - 0x4018], 0
mov byte [ebp - 0x4240], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x423f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [ebp - 0x4138], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x4137]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x4244], 0x104
mov dword [ebp - 0x4030], 0
mov dword [ebp - 0x4140], 0
xor eax, eax
mov dword [ebp - 0x413c], eax
mov dword [ebp - 0x10], 0x3fff
lea ecx, [ebp - 0x4140]
push ecx
lea edx, [ebp - 0x4028]
push edx
lea eax, [ebp - 0x4020]
push eax
lea ecx, [ebp - 0x4034]
push ecx
lea edx, [ebp - 0x402c]
push edx
lea eax, [ebp - 0x4014]
push eax
lea ecx, [ebp - 0x4024]
push ecx
lea edx, [ebp - 0x4030]
push edx
push 0
lea eax, [ebp - 0x4244]
push eax
lea ecx, [ebp - 0x4138]
push ecx
mov edx, dword [ebp - 0x426c]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x4018], eax
cmp dword [ebp - 0x4018], 0
je 0x42b73a
jmp 0x42b8da
cmp dword [ebp - 0x4030], 0
jbe 0x42b807
cmp dword [ebp + 8], 0
je 0x42b807
mov dword [ebp - 0x401c], 0
jmp 0x42b76c
mov ecx, dword [ebp - 0x401c]
add ecx, 1
mov dword [ebp - 0x401c], ecx
mov edx, dword [ebp - 0x401c]
cmp edx, dword [ebp - 0x4030]
jae 0x42b807
mov dword [ebp - 0x4248], 0xff
lea eax, [ebp - 0x4140]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x4248]
push ecx
lea edx, [ebp - 0x4240]
push edx
mov eax, dword [ebp - 0x401c]
push eax
mov ecx, dword [ebp - 0x426c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x4018], eax
cmp dword [ebp - 0x4018], 0
jne 0x42b802
lea eax, [ebp - 0x4240]
push eax
lea ecx, [ebp - 0x4258]
call fcn.00401528
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4258]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00401947
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4258]
call fcn.00401005
jmp 0x42b75d
cmp dword [ebp - 0x402c], 0
jbe 0x42b8d0
cmp dword [ebp + 0xc], 0
je 0x42b8d0
mov dword [ebp - 0x401c], 0
jmp 0x42b839
mov edx, dword [ebp - 0x401c]
add edx, 1
mov dword [ebp - 0x401c], edx
mov eax, dword [ebp - 0x401c]
cmp eax, dword [ebp - 0x402c]
jae 0x42b8d0
mov dword [ebp - 0x10], 0x3fff
mov byte [ebp - 0x4010], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x4010]
push edx
mov eax, dword [ebp - 0x401c]
push eax
mov ecx, dword [ebp - 0x426c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x4018], eax
cmp dword [ebp - 0x4018], 0
jne 0x42b8cb
lea eax, [ebp - 0x4010]
push eax
lea ecx, [ebp - 0x4268]
call fcn.00401528
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x4268]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00401947
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4268]
call fcn.00401005
jmp 0x42b82a
xor edx, edx
test edx, edx
jne 0x42b6cf
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x4018]
push ecx
call fcn.0042bb58
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 0xc