Function at 0x426057
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
mov eax, ecx
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4260e3
cmp eax, 0x4037d4
je 0x4260e3
cmp dword [ebp + 8], eax
je 0x4260e3
mov esi, ebx
mov edi, ebx
push 2
pop ebx
cmp dword [ebp - 4], eax
jbe 0x426218
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004293af
mov esi, eax
pop ecx
test esi, esi
je 0x4260e3
mov eax, dword [ebp - 0x10]
add eax, ebx
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4260ee
push esi
call fcn.004293bf
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [eax*4 + 4]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
jne 0x42611d
push esi
call fcn.004293bf
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x4260e2
push dword [ebp - 0x18]
push 0xff
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 8]
add esp, 0xc
test ecx, ecx
je 0x4261c2
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ecx - 1]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4261c2
push 8
push 0x4037d4
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4261b3
cmp dword [ebp - 0x18], 1
je 0x42618b
cmp dword [ebp - 0x18], 2
jne 0x42619b
push dword [ebp + 8]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4261e8
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov ecx, dword [ebp - 8]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + ecx*4], edi
jmp 0x4261b6
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jne 0x426139
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jb 0x426201
cmp dword [ecx + eax*4], edi
je 0x4261e0
inc eax
cmp eax, dword [ebp - 4]
jbe 0x4261d5
cmp eax, dword [ebp - 4]
ja 0x426201
inc edi
jmp 0x4261cd
push ebx
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov eax, esi
jmp 0x4260e5
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp edi, 0x1869f
jg 0x4260dc
push 2
pop ebx
cmp dword [ebp - 0xc], 0x16
push 0x10
pop eax
mov dword [ebp - 4], eax
jae 0x426256
test esi, esi
je 0x426232
push esi
call fcn.004293bf
mov eax, dword [ebp - 4]
pop ecx
xor ecx, ecx
add eax, 6
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004293af
mov esi, eax
pop ecx
test esi, esi
je 0x4260e3
mov eax, dword [ebp - 4]
jmp 0x42625a
test esi, esi
je 0x4261fa
push eax
push 0x4037d4
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
shr eax, 1
push 0xa
lea eax, [esi + eax*2]
push eax
push edi
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0x18
jmp 0x4261fa