Function at 0x423fa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10118
call fcn.004294c0
push esi
push edi
mov esi, ecx
push 0x400
call fcn.00428d9a
mov dword [esi + 0x214], eax
pop ecx
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push 0x20019
push edi
push str.SoftwareAutoIt_v3AutoIt
push 0x80000002
mov dword [esi + 0x218], edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4241fe
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x114]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push edi
push edi
push str.InstallDir
mov dword [ebp - 8], 0x104
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x4240bc
lea eax, [ebp - 0x114]
push eax
call fcn.00428ea0
test eax, eax
pop ecx
je 0x424069
lea eax, [ebp - 0x114]
push eax
call fcn.00428ea0
cmp byte [ebp + eax - 0x115], 0x5c
pop ecx
je 0x424069
lea eax, [ebp - 0x114]
push 0x43539c
push eax
call fcn.00428dc0
pop ecx
pop ecx
lea eax, [ebp - 0x114]
push str.Include_
push eax
call fcn.00428dc0
mov edi, 0x105
push edi
call fcn.00428d9a
mov ecx, dword [esi + 0x218]
mov edx, dword [esi + 0x214]
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 0x218]
mov ecx, dword [esi + 0x214]
mov ecx, dword [ecx + eax*4]
inc eax
mov dword [esi + 0x218], eax
lea eax, [ebp - 0x114]
push eax
push ecx
call fcn.00428db0
add esp, 0x14
jmp 0x4240fb
mov edi, 0x105
push edi
call fcn.00428d9a
mov ecx, dword [esi + 0x218]
mov edx, dword [esi + 0x214]
mov dword [esp], str.Include_
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 0x218]
mov ecx, dword [esi + 0x214]
mov ecx, dword [ecx + eax*4]
inc eax
push ecx
mov dword [esi + 0x218], eax
call fcn.00428db0
pop ecx
pop ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xffff
push eax
lea eax, [ebp - 0x10118]
push eax
push 0
push 0
push 0x4367c0
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x4241f2
mov eax, dword [ebp - 8]
lea ebx, [ebp - 0x10118]
and byte [ebp + eax - 0x10118], 0
and byte [ebp - 0x114], 0
mov al, byte [ebx]
and byte [ebp - 1], 0
test al, al
mov byte [ebp - 2], al
je 0x424163
cmp al, 0x3b
je 0x424163
lea eax, [ebp - 2]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00428dc0
pop ecx
pop ecx
jmp 0x4241ec
lea eax, [ebp - 0x114]
push eax
call fcn.00428ea0
test eax, eax
pop ecx
je 0x42419e
lea eax, [ebp - 0x114]
push eax
call fcn.00428ea0
cmp byte [ebp + eax - 0x115], 0x5c
pop ecx
je 0x42419e
lea eax, [ebp - 0x114]
push 0x43539c
push eax
call fcn.00428dc0
pop ecx
pop ecx
push edi
call fcn.00428d9a
mov ecx, dword [esi + 0x218]
mov edx, dword [esi + 0x214]
mov dword [esp], 0x104
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 0x218]
mov ecx, dword [esi + 0x214]
mov ecx, dword [ecx + eax*4]
inc eax
mov dword [esi + 0x218], eax
lea eax, [ebp - 0x114]
push eax
push ecx
call fcn.00429960
and byte [ebp - 0x114], 0
add esp, 0xc
cmp byte [ebx], 0
je 0x4241f2
inc ebx
jmp 0x42413b
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
jmp 0x42423c
push 0x105
call fcn.00428d9a
mov ecx, dword [esi + 0x218]
mov edx, dword [esi + 0x214]
mov dword [esp], str.Include_
mov dword [edx + ecx*4], eax
mov eax, dword [esi + 0x218]
mov ecx, dword [esi + 0x214]
mov ecx, dword [ecx + eax*4]
inc eax
push ecx
mov dword [esi + 0x218], eax
call fcn.00428db0
pop ecx
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret