Function at 0x422630
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491685
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4b4180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x4226a6
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004038b0
test eax, eax
je 0x42294b
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422670
mov eax, dword [ebp - 0x14]
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046bbef
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x422710
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0046bbf8
add esp, 4
jmp 0x422679
push dword [ebp - 0x14]
push ebx
call fcn.004797b1
mov ecx, dword [ebp - 0x14]
add esp, 8
mov dword [ebp - 0x24], eax
cmp eax, ecx
jne 0x42284b
test ecx, ecx
je 0x4226f9
call fcn.004038b0
mov ecx, eax
test ecx, ecx
je 0x42294b
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
test edx, edx
js 0x422941
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x42277d
push edx
lea ecx, [ebp - 0x18]
call fcn.00402cc0
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [esi - 8]
jg 0x422941
xor eax, eax
mov dword [esi - 0xc], edx
mov word [esi + edx*2], ax
cmp dword [esi - 4], 1
jle 0x4227a3
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00402e80
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, eax
je 0x4227f7
test esi, esi
jne 0x4227ec
call fcn.00470ead
mov dword [eax], 0x16
call fcn.00470daf
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0046bbf8
add esp, 4
call fcn.004038b0
mov ecx, eax
test ecx, ecx
je 0x422937
mov eax, dword [ecx]
call dword [eax + 0xc]
add esi, 0xfffffff0
jmp 0x4228fb
push eax
push ebx
push esi
call fcn.0046d6d0
add esp, 0xc
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x24], eax
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
test ecx, ecx
js 0x422941
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x42282b
push ecx
lea ecx, [ebp - 0x18]
call fcn.00402cc0
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov word [esi + eax*2], dx
cmp ecx, dword [esi - 8]
jg 0x422941
xor eax, eax
mov dword [esi - 0xc], ecx
mov word [esi + ecx*2], ax
jmp 0x4228df
test eax, eax
je 0x4226f9
call fcn.004038b0
mov ecx, eax
test ecx, ecx
je 0x42294b
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 4], 1
mov dword [ebp - 0x1c], edx
js 0x422930
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4228a3
push edx
lea ecx, [ebp - 0x18]
call fcn.00402cc0
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [esi - 8]
jg 0x422930
xor eax, eax
mov dword [esi - 0xc], edx
mov word [esi + edx*2], ax
cmp dword [esi - 4], 1
jle 0x4228cc
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00402e80
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
push ebx
push edx
push esi
call fcn.00479961
add esp, 0xc
test eax, eax
jne 0x4227be
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0046bbf8
add esi, 0xfffffff0
add esp, 4
mov ecx, esi
call fcn.00402bd0
add eax, 0x10
mov dword [edi], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x422692
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
jmp 0x42293c
push 0x80004005
call fcn.00403680
push 0x80070057
call fcn.00403680
push 0x80004005
call fcn.00403680
int3