Function at 0x42baa8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
push eax
mov eax, 0x4288
call fcn.00421710
sub esp, eax
mov esi, ecx
mov ebx, edx
mov eax, dword [esp + eax]
mov dword [esp], 0x19000
mov dword [esp + 0x38], eax
call sym._malloc
test esi, esi
mov ebp, eax
jne 0x42baf4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.REGENTRIES__s
mov dword [esp + 4], 0x19000
mov dword [esp], eax
call sym.___mingw_snprintf
jmp 0x42bb14
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.REGENTRIES__s_s
mov dword [esp + 4], 0x19000
mov dword [esp], eax
call sym.___mingw_snprintf
lea edi, [esp + 0x181]
xor eax, eax
mov ecx, 0x40
mov dword [esp + 0x17d], 0
mov dword [esp + 0x48], 0x104
mov esi, 0x19000
rep stosd dword es:[edi], eax
lea eax, [esp + 0x74]
mov dword [esp + 0xc], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x68], 0x3fff
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x64]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x48]
mov dword [esp + 8], eax
lea eax, [esp + 0x17d]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._RegQueryInfoKeyA_48
sub esp, 0x30
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x42bc96
mov dword [esp + 4], eax
mov dword [esp], str.Number_of_subkeys:__d_r_n
xor ebx, ebx
call dbg.logEvent
cmp ebx, dword [esp + 0x4c]
jae 0x42bc96
lea eax, [esp + 0x74]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0xff
mov dword [esp + 0xc], eax
lea eax, [esp + 0x7e]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._RegEnumKeyExA_32
sub esp, 0x20
test eax, eax
jne 0x42bc90
or edx, 0xffffffff
mov edi, ebp
mov ecx, edx
repne scasb al, byte es:[edi]
lea edi, [esp + 0x7e]
mov dword [esp + 0x30], ecx
mov ecx, edx
mov edx, dword [esp + 0x30]
repne scasb al, byte es:[edi]
neg edx
sub edx, ecx
cmp edx, esi
jbe 0x42bc62
add esi, 0x19000
mov dword [esp], ebp
mov dword [esp + 4], esi
call sym._realloc
mov ebp, eax
xor eax, eax
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
lea eax, [esp + 0x7e]
mov dword [esp + 8], 0x434f1d
not ecx
dec ecx
mov dword [esp + 0xc], eax
mov eax, esi
sub eax, ecx
add ecx, ebp
mov dword [esp + 4], eax
mov dword [esp], ecx
call sym.___mingw_snprintf
inc ebx
jmp 0x42bbd4
mov eax, dword [esp + 0x58]
test eax, eax
je 0x42be0c
mov dword [esp + 4], eax
mov dword [esp], str.Number_of_values:__d_r_n
call dbg.logEvent
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x58]
jae 0x42be0c
mov eax, dword [esp + 0x60]
mov dword [esp + 0x68], 0x3fff
lea ebx, [esp + 0x281]
mov byte [esp + 0x281], 0
add eax, 2
mov dword [esp], eax
mov dword [esp + 0x70], eax
call sym._malloc
mov dword [esp + 0x34], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x68]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call sym._RegEnumValueA_32
sub esp, 0x20
test eax, eax
jne 0x42bdf7
or edx, 0xffffffff
mov edi, ebp
mov ecx, edx
repne scasb al, byte es:[edi]
mov edi, ebx
mov dword [esp + 0x3c], ecx
mov ecx, edx
repne scasb al, byte es:[edi]
mov eax, ecx
mov ecx, dword [esp + 0x70]
not eax
lea edi, [ecx + ecx]
add edi, 0x100
mov edx, edi
sub edx, dword [esp + 0x3c]
lea eax, [edx + eax - 3]
cmp eax, esi
jbe 0x42bd8c
lea esi, [esi + ecx*4]
mov dword [esp], ebp
mov dword [esp + 0x3c], ecx
mov dword [esp + 4], esi
call sym._realloc
mov ecx, dword [esp + 0x3c]
mov ebp, eax
mov dword [esp], edi
mov dword [esp + 0x3c], ecx
call sym._malloc
mov ecx, dword [esp + 0x3c]
mov ebx, eax
mov dword [esp], eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x6c]
mov dword [esp + 4], edi
mov edi, ebp
call dbg.stringRepresentationOfRegistryData
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
lea eax, [esp + 0x281]
mov dword [esp + 0x14], ebx
mov dword [esp + 8], str._t_d_f_s_f_s
not ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x6c]
dec ecx
mov dword [esp + 0xc], eax
mov eax, esi
sub eax, ecx
add ecx, ebp
mov dword [esp + 4], eax
mov dword [esp], ecx
call sym.___mingw_snprintf
mov dword [esp], ebx
call sym._free
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sym._free
inc dword [esp + 0x30]
jmp 0x42bcba
mov dword [esp + 4], ebp
mov dword [esp], str.Registry_enumerated:__s_r_n
call dbg.logEvent
mov eax, ebp
call dbg.sendCompressedMessage
mov dword [esp], ebp
call sym._free
add esp, 0x428c
pop ebx
pop esi
pop edi
pop ebp
ret