Function at 0x423e40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
mov eax, dword [esi + 0x20]
mov dword [ebp - 8], edi
inc eax
push eax
call fcn.00428230
add esp, 4
push eax
call fcn.00402d50
mov ecx, dword [esi + 0x1c]
add esp, 4
inc ecx
mov dword [ebp - 4], eax
push ecx
call fcn.00428230
add esp, 4
push eax
call fcn.00402d50
mov edx, dword [esi + 0x10]
add esp, 4
inc edx
mov dword [ebp + 0xc], eax
push edx
call fcn.00428230
add esp, 4
push eax
call fcn.00402d50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [0x4586cc], edi
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
inc eax
inc ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
push edx
lea ecx, [ebp - 0x14]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [esi]
lea edx, [ebp - 0x10]
push 0
push edx
push eax
push edi
push ecx
call ebx
test eax, eax
mov dword [0x4586cc], eax
jne 0x423f47
cmp dword [ebp - 0x14], 4
jne 0x423f47
mov edx, dword [ebp + 0xc]
push str.base
push edx
call fcn.00431080
add esp, 8
test eax, eax
jne 0x423f03
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov cl, byte [eax]
mov byte [edx + 0x10], cl
jmp 0x423f47
mov eax, dword [ebp + 0xc]
push str.width
push eax
call fcn.00431080
add esp, 8
test eax, eax
jne 0x423f25
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [eax + 0x11], dl
jmp 0x423f47
mov ecx, dword [ebp + 0xc]
push str.flags
push ecx
call fcn.00431080
add esp, 8
test eax, eax
jne 0x423f47
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movzx ax, byte [edx]
mov word [ecx], ax
mov eax, dword [esi + 0x18]
inc edi
cmp edi, eax
jbe 0x423ea8
mov edx, dword [ebp + 8]
mov ax, word [edx]
mov ecx, eax
and ecx, 2
mov dword [ebp - 0xc], ecx
je 0x423f6b
and eax, 0xfffd
mov word [edx], ax
xor edi, edi
mov edx, dword [esi + 0x10]
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
inc edx
push eax
push 0
push 0
lea ecx, [ebp - 0x10]
push 0
mov dword [ebp - 0x10], edx
mov edx, dword [esi]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
mov dword [0x4586cc], eax
jne 0x424009
mov ecx, dword [esi]
lea eax, [ebp - 0x48]
push eax
push 0x20019
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [0x4586cc], eax
jne 0x423ffd
push ebx
push str.value
call fcn.00431080
add esp, 8
test eax, eax
jne 0x423ff3
lea edx, [ebp - 0x48]
mov dword [ebp - 8], 1
push edx
mov dword [ebp - 0x44], eax
call fcn.00423550
add esp, 4
test eax, eax
jne 0x423ff3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.00424060
add esp, 8
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xc]
inc edi
cmp edi, eax
jbe 0x423f6d
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0xc]
or word [eax], cx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x424023
push eax
call fcn.0040ac10
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
call fcn.004283d0
add esp, 4
push ebx
call fcn.004283d0
mov eax, dword [ebp - 4]
add esp, 4
push eax
call fcn.004283d0
mov ecx, dword [0x4586cc]
add esp, 4
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret