Function at 0x423c60
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push ebx
sub esp, 0x64
mov eax, dword [0x452484]
lea ebx, [esp + 0x30]
mov dword [esp + 4], 0x30
lea edx, [eax + 0xa50]
add eax, 0xa4a
mov dword [esp], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call fcn.0042d880
movzx eax, word [0x4525e0]
mov word [esp + 0x42], ax
cmp ax, 0x49
movzx eax, word [0x4525e2]
mov word [esp + 0x44], ax
je 0x4240a8
cmp ax, 0x49
je 0x423e60
movzx eax, word [0x4525e4]
mov word [esp + 0x46], ax
cmp ax, 0x49
je 0x423e38
movzx eax, word [0x4525e6]
mov word [esp + 0x48], ax
cmp ax, 0x49
je 0x423e88
movzx eax, word [0x4525e8]
mov word [esp + 0x4a], ax
cmp ax, 0x49
je 0x423eb0
movzx eax, word [0x4525ea]
mov word [esp + 0x4c], ax
cmp ax, 0x49
je 0x423ed8
movzx eax, word [0x4525ec]
mov word [esp + 0x4e], ax
cmp ax, 0x49
je 0x423f00
movzx eax, word [0x4525ee]
mov word [esp + 0x50], ax
cmp ax, 0x49
je 0x423f28
movzx eax, word [0x4525f0]
mov word [esp + 0x52], ax
cmp ax, 0x49
je 0x423f50
movzx eax, word [0x4525f2]
mov word [esp + 0x54], ax
cmp ax, 0x49
je 0x423f78
movzx eax, word [0x4525f4]
mov word [esp + 0x56], ax
cmp ax, 0x49
je 0x423fa0
movzx eax, word [0x4525f6]
mov word [esp + 0x58], ax
cmp ax, 0x49
je 0x423fc8
movzx eax, word [0x4525f8]
mov word [esp + 0x5a], ax
cmp ax, 0x49
je 0x423ff0
movzx eax, word [0x4525fa]
mov word [esp + 0x5c], ax
cmp ax, 0x49
je 0x424018
movzx eax, word [0x4525fc]
mov word [esp + 0x5e], ax
mov edx, 0xf
mov eax, 0xf
mov dword [esp + 0x2c], edx
mov edx, 0xd
cmp eax, edx
cmova eax, edx
xor edx, edx
mov word [esp + eax*2 + 0x44], dx
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x424040
mov dword [0x45aec0], 0x2e
add esp, 0x64
pop ebx
pop esi
ret
movzx eax, word [0x4525e6]
mov word [esp + 0x48], ax
cmp ax, 0x49
jne 0x423ce9
mov eax, 3
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525e4]
mov word [esp + 0x46], ax
cmp ax, 0x49
jne 0x423cd3
mov eax, 2
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525e8]
mov word [esp + 0x4a], ax
cmp ax, 0x49
jne 0x423cff
mov eax, 4
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525ea]
mov word [esp + 0x4c], ax
cmp ax, 0x49
jne 0x423d15
mov eax, 5
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525ec]
mov word [esp + 0x4e], ax
cmp ax, 0x49
jne 0x423d2b
mov eax, 6
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525ee]
mov word [esp + 0x50], ax
cmp ax, 0x49
jne 0x423d41
mov eax, 7
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525f0]
mov word [esp + 0x52], ax
cmp ax, 0x49
jne 0x423d57
mov eax, 8
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525f2]
mov word [esp + 0x54], ax
cmp ax, 0x49
jne 0x423d6d
mov eax, 9
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525f4]
mov word [esp + 0x56], ax
cmp ax, 0x49
jne 0x423d83
mov eax, 0xa
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525f6]
mov word [esp + 0x58], ax
cmp ax, 0x49
jne 0x423d99
mov eax, 0xb
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525f8]
mov word [esp + 0x5a], ax
cmp ax, 0x49
jne 0x423daf
mov eax, 0xc
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525fa]
mov word [esp + 0x5c], ax
cmp ax, 0x49
jne 0x423dc5
mov eax, 0xd
mov edx, eax
jmp 0x423ddb
movzx eax, word [0x4525fc]
mov word [esp + 0x5e], ax
cmp ax, 0x49
jne 0x423dd1
mov eax, 0xe
mov edx, eax
jmp 0x423ddb
mov eax, dword [0x452484]
lea esi, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add eax, 0xa64
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x28]
je 0x4240c0
mov dword [0x45aec0], 0x2e
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x64
pop ebx
pop esi
ret
cmp ax, 0x49
jne 0x423cbd
mov eax, 1
mov edx, eax
jmp 0x423ddb
cmp dword [esp + 0x2c], 0x103
ja 0x424088
mov ecx, dword [0x452484]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x45aec0
lea edx, [ecx + 0xa64]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x28]
jne 0x424088
jmp 0x424092