Function at 0x42f350
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x466a28
mov eax, dword fs:[0]
push eax
sub esp, 0xab8
mov eax, dword [0x48602c]
xor eax, esp
mov dword [esp + 0xab0], eax
push ebx
push esi
push edi
mov eax, dword [0x48602c]
xor eax, esp
push eax
lea eax, [esp + 0xac8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
xor edi, edi
push reloc.WS2_32.dll_bind
mov dword [esp + 0x38], eax
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x42f3bd
xor al, al
jmp 0x42f6cc
mov eax, dword [esp + 0x14]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea edx, [esp + 0x38]
push edx
push edi
push edi
push edi
push eax
mov dword [esp + 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x42f3b6
xor esi, esi
cmp dword [esp + 0x1c], edi
mov dword [esp + 0x20], esi
jbe 0x42f6bf
push 0x3fe
lea ecx, [esp + 0x2c2]
push edi
push ecx
mov word [esp + 0x2c8], di
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x20]
add esp, 0xc
push 0x400
lea edx, [esp + 0x2c0]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x42f6ae
push 0x3fe
lea ecx, [esp + 0x6c2]
push edi
push ecx
mov word [esp + 0x6c8], di
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0x400
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
lea ecx, [esp + 0x38]
mov dword [esp + 0xad4], edi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push 0x47bbdc
lea ecx, [esp + 0x38]
call dword [0x46831c]
lea edx, [esp + 0x2bc]
push edx
lea ecx, [esp + 0x38]
call dword [0x46831c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42f699
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x6c0]
push edx
push edi
push edi
push str.ServiceName
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42f4ef
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42f699
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x50]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
push str.._
lea ecx, [esp + 0x54]
mov byte [esp + 0xad4], 1
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [esp + 0x6bc]
push eax
lea ecx, [esp + 0x54]
call dword [0x46831c]
push edi
push 0x80
push 3
push edi
push 1
push bind
lea ecx, [esp + 0x68]
call dword [sym.imp.MSVCP80.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x42f687
push 0x1ff
lea ecx, [esp + 0xc1]
push edi
push ecx
mov byte [esp + 0xc8], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea edx, [esp + 0x34]
push edx
push 0x200
lea eax, [esp + 0xc8]
push eax
push 4
lea ecx, [esp + 0x38]
push ecx
push 0x170002
push ebx
mov dword [esp + 0x44], 0x1010101
mov dword [esp + 0x50], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, edi
je 0x42f680
push 0x48
xor eax, eax
lea edx, [esp + 0x76]
push edi
push edx
mov dword [esp + 0x79], eax
mov byte [esp + 0x7d], al
call sub.MSVCR80.dll_memset
mov cx, word [esp + 0xcc]
movzx edx, byte [esp + 0xcd]
mov eax, dword [esp + 0xc8]
add esp, 0xc
push edx
mov word [esp + 0x74], cx
movzx ecx, cl
push ecx
mov edx, eax
mov ecx, eax
shr edx, 0x18
push edx
shr ecx, 0x10
mov dword [esp + 0x78], eax
movzx edx, cl
movzx ecx, byte [esp + 0xc8]
shr eax, 8
push edx
movzx eax, al
push eax
push ecx
push 0x47d6f0
mov ecx, 0x18
lea edi, [esp + 0x8e]
call fcn.004124c0
movzx edx, byte [esp + 0x8d]
movzx eax, byte [esp + 0x8c]
movzx ecx, byte [esp + 0x8b]
add esp, 0x1c
push edx
movzx edx, byte [esp + 0x72]
push eax
movzx eax, byte [esp + 0x75]
push ecx
movzx ecx, byte [esp + 0x78]
push edx
push eax
push ecx
push str._0.2X__0.2X__0.2X__0.2X__0.2X__0.2X
lea edx, [esp + 0xa6]
push 0x30
push edx
call fcn.00410bf0
mov esi, dword [esp + 0x50]
add esp, 0x24
lea eax, [esp + 0x6c]
push eax
call fcn.004305f0
mov esi, dword [esp + 0x20]
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x50]
mov byte [esp + 0xad0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x34]
mov dword [esp + 0xad0], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 1
cmp esi, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
jb 0x42f3ef
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0xac8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xab0]
xor ecx, esp
call fcn.0043ad38
mov esp, ebp
pop ebp
ret