Function at 0x42b640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51378c
mov eax, dword fs:[0]
push eax
sub esp, 0x628
mov eax, dword [0x56e6c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test edi, edi
je 0x42b684
push edi
call fcn.0042c4e0
mov ecx, eax
call fcn.00421620
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.0049d980
add esp, 0xc
mov dword [ebp - 0x634], 1
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x104
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x634]
push eax
push 0x526fd4
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshalowp.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x42b7a7
call fcn.0042c4e0
mov ecx, eax
call fcn.00420ec0
push eax
call fcn.0041c480
mov ecx, eax
call fcn.00417e00
push str.bizhi
call fcn.0041c480
mov ecx, eax
call fcn.00417ec0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x571d58]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0041c480
mov ecx, eax
call fcn.00417d70
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x62c], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.exist_wp
mov dword [ebp - 4], 0
call fcn.0041c480
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004179b0
test esi, esi
je 0x42b9b3
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x42b9b3
push str.exist
push eax
push esi
call fcn.004b9384
add esp, 0xc
jmp 0x42b9b3
call fcn.0042c4e0
mov ecx, eax
call fcn.00422830
test eax, eax
jne 0x42b894
push 1
call fcn.0041dab0
add esp, 4
test eax, eax
jne 0x42b894
call fcn.0042c4e0
mov ecx, eax
call fcn.00420ec0
push eax
call fcn.0041c480
mov ecx, eax
call fcn.00417e00
push str.bizhi
call fcn.0041c480
mov ecx, eax
call fcn.00417ec0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x571d58]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call fcn.0041c480
mov ecx, eax
call fcn.00417d70
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x62c], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.giveup
mov dword [ebp - 4], 1
call fcn.0041c480
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004179b0
test esi, esi
je 0x42b9b3
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x42b9b3
push str.giveup
push eax
push esi
call fcn.004b9384
add esp, 0xc
jmp 0x42b9b3
cmp dword [0x571e20], 0
jne 0x42b9b3
push 0xa
push edi
push 0
push dword [0x571d58]
mov dword [0x571e20], 1
call fcn.0042d9c0
test esi, esi
je 0x42b9b3
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x42b9b3
call fcn.0042c4e0
mov ecx, eax
call fcn.00420ec0
push eax
call fcn.0041c480
mov ecx, eax
call fcn.00417e00
push str.bizhi
call fcn.0041c480
mov ecx, eax
call fcn.00417ec0
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0049d980
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x571d58]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call fcn.0041c480
mov ecx, eax
call fcn.00417d70
cmp dword [0x56d2f4], 0
jne 0x42b972
push 0x52b5ec
push edi
push esi
call fcn.004b9384
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x62c], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 2
push 0x52b5ec
jmp 0x42b9a0
push str.fail
push edi
push esi
call fcn.004b9384
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x62c], esp
mov dword [eax + 0x24], 0
push 0
push 0
mov dword [ebp - 4], 3
push str.fail
call fcn.0041c480
mov ecx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004179b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00483518
mov esp, ebp
pop ebp
ret 0xc