Function at 0x420f30
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
push ebx
sub esp, 0x64
mov eax, dword [0x450484]
lea ebx, [esp + 0x30]
mov dword [esp + 4], 0x30
lea edx, [eax + 0x14c6]
add eax, 0x1268
mov dword [esp], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call fcn.00429550
movzx eax, word [0x4505e0]
mov word [esp + 0x42], ax
cmp ax, 0x49
movzx eax, word [0x4505e2]
mov word [esp + 0x44], ax
je 0x421378
cmp ax, 0x49
je 0x421130
movzx eax, word [0x4505e4]
mov word [esp + 0x46], ax
cmp ax, 0x49
je 0x421108
movzx eax, word [0x4505e6]
mov word [esp + 0x48], ax
cmp ax, 0x49
je 0x421158
movzx eax, word [0x4505e8]
mov word [esp + 0x4a], ax
cmp ax, 0x49
je 0x421180
movzx eax, word [0x4505ea]
mov word [esp + 0x4c], ax
cmp ax, 0x49
je 0x4211a8
movzx eax, word [0x4505ec]
mov word [esp + 0x4e], ax
cmp ax, 0x49
je 0x4211d0
movzx eax, word [0x4505ee]
mov word [esp + 0x50], ax
cmp ax, 0x49
je 0x4211f8
movzx eax, word [0x4505f0]
mov word [esp + 0x52], ax
cmp ax, 0x49
je 0x421220
movzx eax, word [0x4505f2]
mov word [esp + 0x54], ax
cmp ax, 0x49
je 0x421248
movzx eax, word [0x4505f4]
mov word [esp + 0x56], ax
cmp ax, 0x49
je 0x421270
movzx eax, word [0x4505f6]
mov word [esp + 0x58], ax
cmp ax, 0x49
je 0x421298
movzx eax, word [0x4505f8]
mov word [esp + 0x5a], ax
cmp ax, 0x49
je 0x4212c0
movzx eax, word [0x4505fa]
mov word [esp + 0x5c], ax
cmp ax, 0x49
je 0x4212e8
movzx eax, word [0x4505fc]
mov word [esp + 0x5e], ax
mov edx, 0xf
mov eax, 0xf
mov dword [esp + 0x2c], edx
mov edx, 0xd
cmp eax, edx
cmova eax, edx
xor edx, edx
mov word [esp + eax*2 + 0x44], dx
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x421310
mov dword [0x459080], 0x2e
add esp, 0x64
pop ebx
pop esi
ret
movzx eax, word [0x4505e6]
mov word [esp + 0x48], ax
cmp ax, 0x49
jne 0x420fb9
mov eax, 3
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505e4]
mov word [esp + 0x46], ax
cmp ax, 0x49
jne 0x420fa3
mov eax, 2
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505e8]
mov word [esp + 0x4a], ax
cmp ax, 0x49
jne 0x420fcf
mov eax, 4
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505ea]
mov word [esp + 0x4c], ax
cmp ax, 0x49
jne 0x420fe5
mov eax, 5
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505ec]
mov word [esp + 0x4e], ax
cmp ax, 0x49
jne 0x420ffb
mov eax, 6
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505ee]
mov word [esp + 0x50], ax
cmp ax, 0x49
jne 0x421011
mov eax, 7
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505f0]
mov word [esp + 0x52], ax
cmp ax, 0x49
jne 0x421027
mov eax, 8
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505f2]
mov word [esp + 0x54], ax
cmp ax, 0x49
jne 0x42103d
mov eax, 9
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505f4]
mov word [esp + 0x56], ax
cmp ax, 0x49
jne 0x421053
mov eax, 0xa
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505f6]
mov word [esp + 0x58], ax
cmp ax, 0x49
jne 0x421069
mov eax, 0xb
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505f8]
mov word [esp + 0x5a], ax
cmp ax, 0x49
jne 0x42107f
mov eax, 0xc
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505fa]
mov word [esp + 0x5c], ax
cmp ax, 0x49
jne 0x421095
mov eax, 0xd
mov edx, eax
jmp 0x4210ab
movzx eax, word [0x4505fc]
mov word [esp + 0x5e], ax
cmp ax, 0x49
jne 0x4210a1
mov eax, 0xe
mov edx, eax
jmp 0x4210ab
mov eax, dword [0x450484]
lea esi, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add eax, 0x14da
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 0
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x28]
je 0x421390
mov dword [0x459080], 0x2e
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x64
pop ebx
pop esi
ret
cmp ax, 0x49
jne 0x420f8d
mov eax, 1
mov edx, eax
jmp 0x4210ab
cmp dword [esp + 0x2c], 0x103
ja 0x421358
mov ecx, dword [0x450484]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0x459080
lea edx, [ecx + 0x14da]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call ebx
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x28]
jne 0x421358
jmp 0x421362