Function at 0x424690
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e12e6
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x513200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x26c]
mov esi, dword [ebp + 8]
push eax
push 0x20019
push 0
push edi
push dword [ebx + 4]
mov dword [ebp - 0x270], esi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x26c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42474a
cmp eax, 2
jne 0x424706
mov byte [ebp - 0x265], 0
jmp 0x424751
cmp byte [ebx + 0x128], 0
je 0x424714
add ebx, 0x18
jmp 0x424717
mov ebx, dword [ebx + 0x14]
push eax
mov ecx, esi
call fcn.004272c0
push 0x4ff5b4
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
lea ecx, [ebx + 4]
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x18
xor al, al
jmp 0x424afc
mov byte [ebp - 0x265], 1
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x265], 0
jne 0x4247c4
cmp byte [ebp + 0xc], 0
je 0x424afa
cmp byte [ebx + 0x128], 0
je 0x42477e
add ebx, 0x18
jmp 0x424781
mov ebx, dword [ebx + 0x14]
push 0x4ff62c
mov ecx, esi
call fcn.004058b0
lea ecx, [ebx + 4]
mov esi, eax
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
push 0x4f5628
push 0x4fc47c
push esi
call fcn.004048f0
push edi
push 0x4fc47c
push esi
call fcn.004048f0
add esp, 0x24
xor al, al
jmp 0x424afc
push edi
push dword [ebp + 0xc]
mov ecx, ebx
push esi
call fcn.004244f0
test al, al
jne 0x424afa
lea ecx, [ebp - 0x258]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
call fcn.00403480
cmp byte [ebx + 0x128], 0
lea eax, [ebx + 0x18]
jne 0x4247fc
mov eax, dword [ebx + 0x14]
add eax, 4
lea ecx, [ebp - 0x264]
push eax
push dword [ebx + 4]
call fcn.00423d10
push 1
push 0
push 1
push edi
push esi
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], 0
call fcn.00423fd0
test al, al
jne 0x424839
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x424a73
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0
push eax
push 0
push 0
push 0
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4248bd
cmp byte [ebp - 0x13c], 0
lea edi, [ebp - 0x24c]
push eax
cmove edi, dword [ebp - 0x250]
mov ecx, esi
call fcn.004272c0
push 0x4ff668
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
mov edi, dword [ebp - 0x270]
add esp, 0x18
mov ecx, edi
call fcn.00426320
jmp 0x4248c3
mov edi, dword [ebp - 0x270]
xor esi, esi
mov dword [ebp - 0x26c], esi
cmp dword [ebp - 0x274], esi
jbe 0x424a43
nop word [eax + eax]
lea ecx, [ebp - 0x134]
call fcn.00403480
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
push 0x401
mov dword [ebp - 0x14], 0x401
call fcn.004056f0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
push 0x3ff
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push 0
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x134]
test eax, eax
je 0x4249d2
call fcn.00403f40
push 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x130], 0
call fcn.004056f0
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
push dword [ebp - 0x278]
cmove eax, dword [ebp - 0x12c]
lea edi, [ebp - 0x24c]
xor ecx, ecx
mov word [eax + 4], cx
cmp byte [ebp - 0x13c], cl
mov ecx, dword [ebp - 0x270]
cmove edi, dword [ebp - 0x250]
call fcn.004272c0
push 0x4ff698
mov esi, eax
push 0x4fc47c
push esi
call fcn.004048f0
lea ecx, [edi + 4]
push ecx
push 0x4fc47c
push esi
call fcn.004048f0
mov esi, dword [ebp - 0x26c]
add esp, 0x18
mov edi, dword [ebp - 0x270]
jmp 0x4249d7
call fcn.00403f40
cmp byte [ebp - 0x18], 0
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x264]
cmove eax, dword [ebp - 0x12c]
add eax, 4
push eax
push dword [ebp + 0xc]
push edi
call fcn.00424690
test al, al
je 0x424ac4
mov byte [ebp - 4], 0
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x424a30
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x424a30
push eax
call fcn.00496f41
add esp, 4
inc esi
mov dword [ebp - 0x26c], esi
cmp esi, dword [ebp - 0x274]
jb 0x4248e0
mov eax, dword [ebp - 0x260]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x424a56
push eax
call esi
push dword [ebp - 0x27c]
mov ecx, ebx
mov dword [ebp - 0x260], 0
push dword [ebp + 0xc]
push edi
call fcn.004244f0
mov bl, al
mov eax, dword [ebp - 0x260]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
test eax, eax
je 0x424a8a
push eax
call esi
cmp byte [ebp - 0x13c], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x424ac0
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x24c]
cmp eax, ecx
je 0x424ac0
push eax
call fcn.00496f41
add esp, 4
mov al, bl
jmp 0x424afc
cmp byte [ebp - 0x18], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x424aed
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 0x128]
cmp eax, ecx
je 0x424aed
push eax
call fcn.00496f41
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x424a73
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489940
mov esp, ebp
pop ebp
ret 0xc