Function at 0x423215
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x15c
mov eax, 0x461724
call fcn.0043c4da
mov ebx, ecx
mov edi, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xcc], eax
cmp dword [ebx], eax
push 0x278
push str.srcwindows_registry.cpp
setne cl
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xd0], edi
call fcn.00421241
xor edx, edx
cmp dword [esi + 0x14], 8
pop ecx
pop ecx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xc8], edx
jb 0x423271
mov eax, dword [esi]
jmp 0x423273
mov eax, esi
lea ecx, [ebp - 0xc8]
push ecx
push edx
lea ecx, [ebp - 0xc0]
push ecx
push edx
push eax
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x423313
lea ecx, [ebp - 0x168]
call fcn.00406224
lea ecx, [ebp - 0x28]
xor ebx, ebx
push ecx
push ecx
lea ecx, [ebp - 0xc4]
inc ebx
push ecx
push ecx
push str.RegQueryValueExW_failed_with
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.0040b27d
pop ecx
mov ecx, eax
call fcn.0040b266
pop ecx
mov ecx, eax
call fcn.0040620b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xc4]
movzx eax, cx
push ebx
or eax, 0x80070000
test ecx, ecx
push 0x28b
push str.srcwindows_registry.cpp
cmovle eax, ecx
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xa8]
call fcn.00422738
push 0x487c98
lea eax, [ebp - 0xa8]
push eax
call fcn.00440ad9
push dword [ebp - 0xc8]
lea ecx, [ebp - 0xb8]
call fcn.004111b3
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0xc8]
test eax, eax
je 0x4233cd
cmp dword [esi + 0x14], 8
jb 0x423341
mov esi, dword [esi]
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xb8]
lea eax, [ebp - 0xc0]
push eax
xor eax, eax
push eax
push esi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov dword [ebp - 0xc4], esi
test esi, esi
je 0x4233c7
lea ecx, [ebp - 0x168]
call fcn.00406224
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
push ecx
push ecx
lea ecx, [ebp - 0xc4]
push ecx
push ecx
push str.RegQueryValueExW_failed_with
mov ecx, eax
call fcn.0040b27d
pop ecx
mov ecx, eax
call fcn.0040b266
pop ecx
mov ecx, eax
call fcn.0040620b
movzx eax, si
push 1
or eax, 0x80070000
mov byte [ebp - 4], 5
test esi, esi
push 0x29f
push str.srcwindows_registry.cpp
cmovle eax, esi
jmp 0x4232f2
mov eax, dword [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xb8]
call fcn.00417d41
mov eax, dword [ebp - 0xc0]
lea ebx, [edi + 0x10]
xor edx, edx
mov dword [edi], eax
lea esi, [edi + 4]
mov dword [edi + 8], edx
mov dword [esi], edx
mov dword [edi + 0xc], edx
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edx
cmp dword [ebx + 0x14], 8
jb 0x423405
mov eax, dword [ebx]
jmp 0x423407
mov eax, ebx
xor ecx, ecx
mov word [eax], cx
lea eax, [edi + 0x28]
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
lea edx, [edi + 0x34]
mov dword [ebp - 0xc4], eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc0]
inc ecx
mov dword [ebp - 0xcc], ecx
cmp eax, 0xb
ja case.default.0x423447
movzx eax, byte [eax + 0x4237bd]
jmp dword [eax*4 + 0x4237a5]
mov esi, dword [ebp - 0xb4]
mov eax, esi
mov edi, dword [ebp - 0xb8]
sub eax, edi
and eax, ecx
je 0x42347e
sub esi, edi
lea ecx, [ebp - 0xb8]
sub esi, eax
push esi
call fcn.00417d41
mov esi, dword [ebp - 0xb4]
mov edi, dword [ebp - 0xb8]
cmp edi, esi
je 0x4234dd
mov eax, esi
sub eax, edi
lea ecx, [eax - 1]
cmp eax, ecx
ja 0x423492
call fcn.0042390e
cmp byte [edi + ecx], 0
jne 0x4234ae
lea ecx, [eax - 2]
cmp eax, ecx
jbe 0x42348d
cmp byte [edi + ecx], 0
jne 0x4234ae
sub esi, 2
mov dword [ebp - 0xb4], esi
xor eax, eax
sub esi, edi
push eax
mov eax, esi
mov ecx, ebx
shr eax, 1
push eax
call fcn.0041800b
cmp dword [ebx + 0x14], 8
mov eax, dword [ebp - 0xbc]
mov edx, dword [eax + 0x20]
jb 0x4234d0
mov ebx, dword [ebx]
push esi
push edi
add edx, edx
mov ecx, ebx
call fcn.00422869
pop ecx
pop ecx
mov edi, dword [ebp - 0xbc]
lea ecx, [ebp - 0xb8]
call fcn.00408971
mov eax, edi
call fcn.0043c484
ret 8
mov eax, dword [ebp - 0xb4]
mov ecx, eax
mov edx, dword [ebp - 0xb8]
sub ecx, edx
test cl, 1
je 0x42352c
mov eax, ecx
and eax, 1
sub ecx, eax
push ecx
lea ecx, [ebp - 0xb8]
call fcn.00417d41
mov eax, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xb8]
cmp edx, eax
sete al
test al, al
jne case.0x423447.0
lea eax, [ebp - 0xa9]
xor ebx, ebx
push eax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 0xa9], bl
call fcn.004238bd
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.004238bd
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.004238bd
lea eax, [ebp - 0xa9]
mov byte [ebp - 0xa9], bl
push eax
lea ecx, [ebp - 0xb8]
call fcn.004238bd
mov esi, dword [ebp - 0xb8]
cmp word [esi], bx
je case.0x423447.0
mov ebx, dword [ebp - 0xb4]
mov edi, dword [ebp - 0xc4]
sub ebx, esi
push esi
lea ecx, [ebp - 0x28]
call fcn.004062f0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 6
push eax
mov ecx, edi
call fcn.0040f409
xor eax, eax
mov byte [ebp - 4], 3
push eax
push 1
lea ecx, [ebp - 0x28]
call fcn.00408a5c
push ebx
push esi
call fcn.00448806
pop ecx
pop ecx
lea esi, [esi + eax*2]
xor eax, eax
add esi, 2
cmp word [esi], ax
jne 0x4235b4
jmp 0x4234dd
lea eax, [ebp - 0xb8]
cmp edx, eax
je case.0x423447.0
mov ecx, dword [edx]
mov eax, dword [ebp - 0xb8]
mov dword [edx], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], ecx
mov ecx, dword [edx + 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], ecx
mov ecx, dword [edx + 8]
mov dword [edx + 8], eax
mov dword [ebp - 0xb0], ecx
jmp case.0x423447.0
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xb8]
push 4
pop edx
cmp eax, edx
je 0x4236b1
lea ecx, [ebp - 0xb8]
call fcn.00417d3b
lea ecx, [ebp - 0x168]
mov dword [ebp - 0xbc], eax
call fcn.00406224
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 7
push ecx
push ecx
lea ecx, [ebp - 0xbc]
push ecx
push ecx
push str.Invalid_DWORD_size:
mov ecx, eax
call fcn.0040b27d
pop ecx
mov ecx, eax
call fcn.0040b23a
pop ecx
mov ecx, eax
call fcn.0040620b
mov byte [ebp - 4], 8
push 0x305
mov edx, str.srcwindows_registry.cpp
lea ecx, [ebp - 0x28]
call fcn.004023ea
push edx
push dword [ebp - 0xb8]
mov ecx, esi
call fcn.00422869
cmp dword [ebp - 0xc0], 5
pop ecx
pop ecx
jne case.0x423447.0
push dword [esi]
call dword [sym.imp.WS2_32.dll_ntohl]
mov dword [esi], eax
jmp case.0x423447.0
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xb8]
cmp eax, 8
je 0x423745
lea ecx, [ebp - 0xb8]
call fcn.00417d3b
lea ecx, [ebp - 0x168]
mov dword [ebp - 0xbc], eax
call fcn.00406224
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 9
push ecx
push ecx
lea ecx, [ebp - 0xbc]
push ecx
push ecx
push str.Invalid_QWORD_size:
mov ecx, eax
call fcn.0040b27d
pop ecx
mov ecx, eax
call fcn.0040b23a
pop ecx
mov ecx, eax
call fcn.0040620b
mov byte [ebp - 4], 0xa
push 0x311
jmp 0x4236a4
push 8
push dword [ebp - 0xb8]
lea ecx, [edi + 8]
push 8
pop edx
call fcn.00422869
pop ecx
pop ecx
jmp case.0x423447.0
lea ecx, [ebp - 0x168]
call fcn.00406224
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0xb
push ecx
push ecx
lea ecx, [ebp - 0xc0]
push ecx
push ecx
push str.Invalid_registry_value_type
mov ecx, eax
call fcn.0040b27d
pop ecx
mov ecx, eax
call fcn.0040b23a
pop ecx
mov ecx, eax
call fcn.0040620b
mov byte [ebp - 4], 0xc
push 0x316
jmp 0x4236a4