Function at 0x42246a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
mov eax, ecx
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4224ef
cmp dword [ebp + 8], ebx
je 0x4224ef
mov esi, ebx
mov edi, ebx
push 2
pop ebx
cmp dword [ebp - 4], esi
jbe 0x422624
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x4224ef
mov eax, dword [ebp - 0x10]
add eax, ebx
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4224fa
push esi
call fcn.00441807
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [eax*4 + 4]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
jne 0x422529
push esi
call fcn.00441807
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x4224ee
push dword [ebp - 0x18]
push 0xff
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 8]
add esp, 0xc
test ecx, ecx
je 0x4225ce
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ecx - 1]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4225ce
push 4
push 0x405000
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4225bf
cmp dword [ebp - 0x18], 1
je 0x422597
cmp dword [ebp - 0x18], 2
jne 0x4225a7
push dword [ebp + 8]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4225f4
lea eax, [esi + 8]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov ecx, dword [ebp - 8]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + ecx*4], edi
jmp 0x4225c2
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jne 0x422545
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jb 0x42260d
cmp dword [ecx + eax*4], edi
je 0x4225ec
inc eax
cmp eax, dword [ebp - 4]
jbe 0x4225e1
cmp eax, dword [ebp - 4]
ja 0x42260d
inc edi
jmp 0x4225d9
push ebx
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov eax, esi
jmp 0x4224f1
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp edi, 0x1869f
jg 0x4224e8
push 2
pop ebx
cmp dword [ebp - 0xc], 0xe
push 8
pop eax
mov dword [ebp - 4], eax
jae 0x422662
test esi, esi
je 0x42263e
push esi
call fcn.00441807
mov eax, dword [ebp - 4]
pop ecx
xor ecx, ecx
add eax, 6
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041fb3c
mov esi, eax
pop ecx
test esi, esi
je 0x4224ef
mov eax, dword [ebp - 4]
jmp 0x422666
test esi, esi
je 0x422606
push eax
push 0x405000
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
shr eax, 1
push 0xa
lea eax, [esi + eax*2]
push eax
push edi
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0x18
jmp 0x422606