Function at 0x42219e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
mov eax, ecx
push ebx
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 4], ebx
push ecx
lea ecx, [ebp - 4]
mov dword [ebp - 0xc], ebx
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x42224e
cmp dword [ebp + 8], ebx
je 0x42224e
mov esi, ebx
mov edi, ebx
push 2
pop ebx
cmp dword [ebp - 4], esi
jbe 0x422359
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov esi, eax
pop ecx
test esi, esi
je 0x42224e
mov ecx, dword [ebp - 0x10]
add ecx, ebx
push ecx
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
pop ecx
test ebx, ebx
je 0x42234b
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
lea eax, [eax*4 + 4]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
jne 0x422257
push esi
call fcn.00440db7
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp - 0x18]
push 0xff
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp - 8]
add esp, 0xc
test ecx, ecx
je 0x4222fc
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ecx - 1]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4222fc
push 4
push 0x405010
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4222ed
cmp dword [ebp - 0x18], 1
je 0x4222c5
cmp dword [ebp - 0x18], 2
jne 0x4222d5
push dword [ebp + 8]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x422322
lea eax, [esi + 8]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov ecx, dword [ebp - 8]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov dword [eax + ecx*4], edi
jmp 0x4222f0
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jne 0x422273
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov ecx, dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jb 0x42233b
cmp dword [ecx + eax*4], edi
je 0x42231a
inc eax
cmp eax, dword [ebp - 4]
jbe 0x42230f
cmp eax, dword [ebp - 4]
ja 0x42233b
inc edi
jmp 0x422307
push ebx
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop ecx
mov eax, esi
jmp 0x422250
push ecx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp edi, 0x1869f
jle 0x422356
push esi
call fcn.00440db7
jmp 0x42224d
push 2
pop ebx
cmp dword [ebp - 0xc], 0xe
push 8
pop eax
mov dword [ebp - 4], eax
jae 0x422397
test esi, esi
je 0x422373
push esi
call fcn.00440db7
mov eax, dword [ebp - 4]
pop ecx
xor ecx, ecx
add eax, 6
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00440dea
mov esi, eax
pop ecx
test esi, esi
je 0x42224e
mov eax, dword [ebp - 4]
jmp 0x42239b
test esi, esi
je 0x422334
push eax
push 0x405010
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
shr eax, 1
push 0xa
lea eax, [esi + eax*2]
push eax
push edi
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0x18
jmp 0x422334