Function at 0x425e0b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x46524a
call fcn.0043f429
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0xb8], eax
push ebx
lea eax, [ebp - 0xa1]
mov dword [ebp - 0xbc], ebx
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x40], 0x47602c
mov dword [ebp - 0x18], 0x46c7e0
call fcn.004033a0
push 0x46a798
mov dword [ebp - 4], ebx
call fcn.0043f134
pop ecx
push eax
push ebx
push 0x46a798
lea ecx, [edi + 4]
call fcn.004051c0
mov dword [ebp - 0xb0], eax
push 0xa
lea eax, [ebp - 0xac]
push eax
mov ecx, esi
mov edi, ebx
call fcn.0042d908
call fcn.004354ca
inc ebx
test al, al
je 0x425ec1
test byte [ebp - 0xac], bl
je 0x425eb2
mov edi, 0x200
jmp 0x425ec1
test byte [ebp - 0xac], 2
mov eax, 0x100
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + 1]
mov dword [ebp - 0xb0], edx
cmp edx, dword [ecx + 0x14]
jae 0x4262b5
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], bl
call fcn.004022d0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0
call fcn.00401500
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x425f24
mov esi, SysReAllocStringLen
jmp 0x425fb6
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x425f3c
mov esi, SysReAllocStringLen
jmp 0x425fb6
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x425f54
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x425fb6
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x425f6c
mov esi, SysReAllocStringLen
jmp 0x425fb6
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x425f84
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x425fb6
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x425f9c
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x425fb6
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.0042b345
test eax, eax
jne 0x4262b5
mov esi, reloc.OLEAUT32.dll_SysStringLen
mov ecx, dword [ebp - 0xa8]
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403750
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004022d0
lea ecx, [ebp - 0xa0]
call fcn.00401500
xor eax, eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 3
mov dword [ebp - 0xa8], edi
call fcn.004013d0
test eax, eax
jne 0x42628c
cmp dword [ebp + 8], ebx
jne 0x42603a
cmp dword [ebp + 0xc], ebx
jmp 0x42611b
mov edi, dword [ebp - 0xb4]
add edi, 4
mov dword [ebp - 0xb0], 4
cmp dword [edi + 0x14], 8
jb 0x426057
mov eax, dword [edi]
jmp 0x426059
mov eax, edi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push 0
push eax
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x426125
cmp dword [ebp - 0xb4], 4
jne 0x42612e
cmp dword [ebp - 0xb0], 4
jne 0x42612e
mov ecx, dword [ebp - 0xb8]
push 0xa
lea eax, [ebp - 0xa8]
push eax
call fcn.0042d908
mov eax, dword [ebp + 0xc]
dec eax
je 0x42610f
dec eax
je 0x4260fe
dec eax
dec eax
je 0x4260ed
sub eax, 0xc
je 0x4260df
sub eax, 0x10
jne 0x4262a8
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne al
jmp 0x42611e
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x426115
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta al
jmp 0x42611e
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb al
jmp 0x42611e
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
sete al
mov bl, al
jmp 0x4262a8
cmp eax, 2
je 0x42628c
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa1]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xa8], esp
push ebx
push eax
push 0x475ec0
call fcn.004067be
cmp dword [edi + 0x14], 8
mov byte [ebp - 4], 4
jb 0x42615d
mov edi, dword [edi]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd0], esp
push ebx
lea eax, [ebp - 0xa1]
push eax
push edi
call fcn.004067be
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
push ebx
lea edx, [ebp - 0xa1]
push edx
push eax
mov byte [ebp - 4], 5
call fcn.004067be
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 3
call fcn.00436000
add esp, 0x9c
mov esi, dword [ebp - 0xb8]
add esi, 4
mov byte [ebp - 4], 6
cmp dword [esi + 0x14], 8
jb 0x4261c3
mov eax, dword [esi]
jmp 0x4261c5
mov eax, esi
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040f737
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x42621b
cmp dword [ebp - 0x58], 8
push ebx
lea eax, [ebp - 0xa1]
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00402330
push dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xcc]
lea eax, [ebp - 0xa0]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0xbc], ebx
call fcn.004257d6
jmp 0x42622c
cmp dword [esi + 0x14], 8
jb 0x426223
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.0041e9fa
mov esi, eax
test byte [ebp - 0xbc], bl
je 0x426241
lea ecx, [ebp - 0xa0]
call fcn.00401500
mov eax, dword [ebp + 0xc]
dec eax
je 0x42627b
dec eax
je 0x426274
dec eax
dec eax
je 0x42626d
sub eax, 4
je 0x426269
sub eax, 8
je 0x426261
sub eax, 0x10
jne 0x426282
test esi, esi
jmp 0x426264
cmp edi, 0xffffffff
setne al
jmp 0x426280
test edi, edi
jmp 0x42627d
test esi, esi
setg al
jmp 0x426280
test esi, esi
sets al
jmp 0x426280
test esi, esi
sete al
mov bl, al
lea ecx, [ebp - 0x70]
call fcn.00401500
jmp 0x4262a8
cmp dword [ebp + 8], ebx
jne 0x42629a
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x4262a8
cmp dword [ebp + 0xc], 2
je 0x4262a8
cmp dword [ebp + 0xc], 0x20
je 0x4262a8
xor bl, bl
lea ecx, [ebp - 0xc8]
call fcn.004013a0
jmp 0x4262b7
xor bl, bl
lea ecx, [ebp - 0x40]
call fcn.00401500
mov al, bl
call fcn.0043f3d8
ret 0x18