Function at 0x425c4a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
xor ebx, ebx
push dword [ebp + 8]
mov esi, 0x104
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], esi
call fcn.00429500
push dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
call fcn.00429500
push 0x40
mov dword [ebp - 0x24], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x127]
mov byte [ebp - 0x128], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x7f5500]
push 0x32
push eax
push 0x7fdfd4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], esi
call fcn.00412ef3
add esp, 0x14
mov dword [0x7fe008], eax
lea eax, [ebp - 0x18]
push eax
push ebx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x425e8c
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push dword [0x7fe008]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x425e8c
mov edi, 0x800710
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push ebx
push eax
push edi
mov dword [ebp - 0x10], esi
push dword [ebp - 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x425d14
inc dword [ebp - 0x1c]
jmp 0x425cf0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov al, byte [0x7f5500]
push 0xc
push eax
push 0x7fe038
call fcn.00412ef3
add esp, 0xc
lea ecx, [ebp - 0xc]
mov dword [0x7fe048], eax
push ecx
lea ecx, [ebp - 0x128]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
call fcn.00426046
mov dword [0x802640], eax
mov eax, dword [0x802640]
shr eax, 0x10
inc eax
shl eax, 0x10
mov ebx, dword [0x802640]
and ebx, 0xffff
or eax, ebx
mov dword [0x802640], eax
mov al, byte [0x7f5500]
push 5
push eax
push 0x7fe060
call fcn.00412ef3
push dword [0x802640]
mov dword [0x7fe068], eax
push eax
push edi
call fcn.0042957b
push dword [0x7fe068]
call fcn.00428816
mov al, byte [0x7f5500]
push 9
xor ebx, ebx
push eax
push 0x7fe028
mov dword [0x7fe068], ebx
call fcn.00412ef3
mov dword [0x7fe034], eax
mov al, byte [0x7f5500]
push 0xc
push eax
push 0x7fe04c
call fcn.00412ef3
add esp, 0x38
mov dword [0x7fe05c], eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x425e4f
mov eax, dword [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push dword [ebp + 8]
push 1
push ebx
push dword [0x7fe034]
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0xc]
inc eax
push eax
lea eax, [ebp - 0x128]
push eax
push 1
push ebx
push dword [0x7fe048]
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0x24]
inc eax
push eax
push dword [ebp + 0xc]
push 1
push ebx
push dword [0x7fe05c]
push dword [ebp - 4]
call edi
push dword [ebp - 4]
call esi
push dword [0x7fe034]
call fcn.00428816
push dword [0x7fe048]
mov dword [0x7fe034], ebx
call fcn.00428816
push dword [0x7fe05c]
mov dword [0x7fe048], ebx
call fcn.00428816
add esp, 0xc
mov dword [0x7fe05c], ebx
push dword [ebp - 8]
call esi
xor ebx, ebx
push dword [0x7fe008]
call fcn.00428816
pop ecx
pop edi
mov dword [0x7fe008], ebx
pop esi
pop ebx
leave
ret