Function at 0x42b511
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xac
mov eax, 0x470efb
call fcn.00455d7d
xor ebx, ebx
push 7
mov dword [ebp - 4], ebx
pop eax
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], cx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0042a80d
pop ecx
pop ecx
call fcn.0042b7bd
push eax
lea ecx, [ebp - 0x30]
call fcn.0041a58a
pop ecx
test al, al
jne 0x42b57f
call fcn.0042b84b
push eax
lea ecx, [ebp - 0x30]
call fcn.0041a58a
pop ecx
test al, al
je 0x42b58e
xor eax, eax
mov ecx, 0x481c08
lea esi, [ebp - 0x30]
call fcn.0040a200
push dword [ebp + 8]
call fcn.0042a324
cmp dword [ebp - 0x38], 8
pop ecx
mov ecx, dword [ebp - 0x4c]
jae 0x42b5a3
lea ecx, [ebp - 0x4c]
lea edx, [ebp - 0x88]
push edx
or eax, 0x20019
push eax
push ebx
push ecx
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x42b602
push eax
lea ecx, [ebp - 0x68]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 3
call fcn.0042b8d9
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040c222
add esp, 0xc
lea esi, [ebp - 0xac]
mov byte [ebp - 4], 4
call fcn.00404e30
push 0x4915dc
mov eax, esi
push eax
call fcn.004554bb
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8c], ebx
jae 0x42b614
lea eax, [ebp - 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x8c]
push ecx
push ebx
lea ecx, [ebp - 0x94]
push ecx
push ebx
push eax
push dword [ebp - 0x88]
call esi
cmp eax, ebx
je 0x42b69a
cmp eax, 0xea
je 0x42b69a
push eax
lea ecx, [ebp - 0x84]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0042b942
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040c222
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 7
call fcn.00403b18
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x68]
lea esi, [ebp - 0xa0]
call fcn.00404e30
push 0x4915dc
mov eax, esi
jmp 0x42b5fc
push dword [ebp - 0x8c]
call fcn.0044c10b
cmp dword [ebp - 0x1c], 8
mov edi, eax
mov eax, dword [ebp - 0x30]
pop ecx
mov dword [ebp - 0x90], edi
jae 0x42b6ba
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x8c]
push ecx
push edi
push ebx
push ebx
push eax
push dword [ebp - 0x88]
call esi
cmp eax, ebx
je 0x42b734
push eax
lea ecx, [ebp - 0x68]
call fcn.0042783a
pop ecx
push eax
mov byte [ebp - 4], 8
call fcn.0042b9bb
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040c222
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xa
call fcn.00403b18
push edi
call fcn.0044e277
pop ecx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x84]
lea esi, [ebp - 0xb8]
call fcn.00404e30
push 0x4915dc
mov eax, esi
jmp 0x42b5fc
mov ecx, dword [ebp + 0x1c]
cmp ecx, ebx
je 0x42b751
mov byte [ebp - 4], 0xb
push dword [ebp - 0x94]
mov eax, dword [ecx]
push dword [ebp - 0x8c]
push edi
call dword [eax + 4]
push edi
call fcn.0044e277
pop ecx
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x30]
call fcn.00403c49
push 1
lea esi, [ebp - 0x4c]
call fcn.00403c49
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x1c]
cmp ecx, ebx
je 0x42b796
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
cmp ecx, edx
setne dl
movzx edx, dl
push edx
call dword [eax + 0xc]
call fcn.00455dd9
ret