Function at 0x42e360
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x9c4
push ebx
push edi
xor ebx, ebx
mov ecx, 0x84
xor eax, eax
lea edi, [esp + 0xa5]
mov byte [esp + 0xa4], bl
mov byte [esp + 0x3b8], bl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x84
xor eax, eax
lea edi, [esp + 0x3b9]
mov byte [esp + 0x2b8], bl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x2b9]
mov dl, byte [0x438762]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x43875c]
mov ecx, 7
mov dword [esp + 0x44], eax
xor eax, eax
lea edi, [esp + 0x48]
mov dword [esp + 8], 0x211
rep stosd dword es:[edi], eax
mov cx, word [0x438760]
lea edi, [esp + 0x67]
mov word [esp + 0x64], cx
mov ecx, 7
mov byte [esp + 0x66], dl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [0x438758]
mov ecx, 7
mov dword [esp + 0x84], eax
xor eax, eax
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push 0x20119
push ebx
push str.SoftwarekingsoftOffice
push SysReAllocString
call dword [0x43bbf8]
test eax, eax
jne 0x42e6c9
push ebx
push ebx
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x30]
push ebx
push edx
push ebx
push ebx
push ebx
push eax
mov dword [esp + 0x48], ebx
call dword [0x43bc24]
test eax, eax
je 0x42e469
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x43bc00]
pop edi
pop ebx
add esp, 0x9c4
ret
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x5ce]
mov word [esp + 0x5cc], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x18]
push esi
xor esi, esi
cmp eax, ebx
mov dword [esp + 0x24], esi
jbe 0x42e6bd
push ebp
mov ecx, 0x84
xor eax, eax
lea edi, [esp + 0x3c0]
push ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
push ebx
stosw word es:[edi], ax
push ebx
lea edx, [esp + 0x1c]
push ebx
lea eax, [esp + 0x3d0]
push edx
push eax
push esi
push ecx
mov dword [esp + 0x30], 0x211
call dword [0x43bc18]
test eax, eax
jne 0x42e6ab
lea edx, [esp + 0x3c0]
push 0x2e
push edx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
test eax, eax
je 0x42e6ab
lea ebp, [esp + 0x4c]
mov dword [esp + 0x24], 3
lea eax, [esp + 0x3c0]
push ebp
push eax
lea ecx, [esp + 0x2c8]
push str.SoftwarekingsoftOffice_s_sRecentFilesSequence
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c0]
push edx
push 1
push ebx
push eax
push SysReAllocString
call dword [0x43bbf8]
test eax, eax
jne 0x42e695
push ebx
push ebx
mov edx, dword [esp + 0x1c]
push ebx
lea ecx, [esp + 0x28]
push ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x4c], ebx
call dword [0x43bc24]
test eax, eax
jne 0x42e68a
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, ebx
jbe 0x42e68a
mov ecx, 0x84
xor eax, eax
lea edi, [esp + 0xac]
push ebx
rep stosd dword es:[edi], eax
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ebx
lea edx, [esp + 0xbc]
push ecx
stosw word es:[edi], ax
mov eax, dword [esp + 0x28]
push edx
push esi
push eax
mov dword [esp + 0x30], 0x211
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x42e68a
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
mov byte [esp + ecx + 0xac], bl
jbe 0x42e5d8
cmp byte [esp + eax + 0xac], 0x2f
jne 0x42e5d3
mov byte [esp + eax + 0xac], 0x5c
inc eax
cmp eax, ecx
jb 0x42e5c1
lea ecx, [esp + 0x5d4]
push 0x200
lea edx, [esp + 0xb0]
push ecx
push edx
call fcn.004109b0
add esp, 0xc
cmp eax, ebx
jle 0x42e67d
cmp eax, 0x200
jge 0x42e67d
mov word [esp + eax*2 + 0x5d4], bx
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x38]
push ecx
lea eax, [esp + 0x4c]
push edx
lea ecx, [esp + 0x5e0]
push eax
push ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.00423d70
add esp, 0x14
test eax, eax
je 0x42e67d
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
push ebx
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
push edx
mov edx, dword [esp + 0x9f8]
lea ecx, [esp + 0x5f4]
push eax
push ecx
push edx
call fcn.0042d9b0
add esp, 0x2c
mov eax, dword [esp + 0x1c]
inc esi
cmp esi, eax
jb 0x42e573
mov eax, dword [esp + 0x14]
push eax
call dword [0x43bc00]
mov eax, dword [esp + 0x24]
add ebp, 0x20
dec eax
mov dword [esp + 0x24], eax
jne 0x42e4fd
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
inc esi
cmp esi, eax
mov dword [esp + 0x28], esi
jb 0x42e497
pop ebp
mov ecx, dword [esp + 0x14]
push ecx
call dword [0x43bc00]
pop esi
pop edi
pop ebx
add esp, 0x9c4
ret