Function at 0x4034e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 6
push 0
mov ebx, edx
mov dword [ebp - 4], 0
push str.InstallPath
mov esi, ecx
push ebx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40355d
push dword [ebp - 4]
call fcn.0040f52e
mov esi, eax
add esp, 4
test esi, esi
jne 0x403531
pop edi
lea eax, [esi + 0x68]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push esi
push 0
push 6
push 0
push str.InstallPath
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x403551
mov dword [edi + 0x18], esi
jmp 0x40355a
push esi
call fcn.0040f452
add esp, 4
mov esi, dword [ebp - 8]
xor eax, eax
cmp dword [edi + 0x18], eax
je 0x40370f
cmp byte [esi + 0x39], al
lea esi, [edi + 0x1c]
je 0x4035a9
push str.WindowedExecutablePath
push str.InstallPath
mov edx, ebx
mov ecx, esi
call fcn.00403380
add esp, 8
test eax, eax
jne 0x40371d
cmp dword [esi], eax
je 0x4035b5
push str.WindowedExecutableArguments
push str.InstallPath
lea ecx, [edi + 0x20]
mov edx, ebx
call fcn.00403380
add esp, 8
test eax, eax
jne 0x40371d
cmp dword [esi], eax
jne 0x4035f6
push str.ExecutablePath
push str.InstallPath
mov edx, ebx
mov ecx, esi
call fcn.00403380
add esp, 8
test eax, eax
jne 0x40371d
cmp dword [esi], eax
je 0x4035f6
push str.ExecutableArguments
push str.InstallPath
lea ecx, [edi + 0x20]
mov edx, ebx
call fcn.00403380
add esp, 8
test eax, eax
jne 0x40371d
push str.SysArchitecture
lea ecx, [edi + 0x24]
mov edx, ebx
push 0
call fcn.00403380
add esp, 8
test eax, eax
jne 0x40371d
push str.DisplayName
push eax
lea ecx, [edi + 0x28]
mov edx, ebx
call fcn.00403380
add esp, 8
test eax, eax
jne 0x40371d
mov ebx, dword [edi + 0xc]
test ebx, ebx
je 0x4036f7
push eax
push eax
push eax
push 0xffffffffffffffff
push str.PythonCore
push 0xffffffffffffffff
push ebx
push 9
push 0x421a90
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
sub eax, 1
je 0x4036f7
sub eax, 1
je 0x403684
sub eax, 1
je 0x4036f7
push str.PythonCore
push 0xffffffffffffffff
push ebx
push 0xffffffffffffffff
push str.Error_comparing__.s_and__.s__compare_
push 0
call fcn.004011c0
add esp, 0x18
jmp 0x4036f7
cmp dword [esi], 0
jne 0x4036a3
mov eax, dword [ebp - 8]
mov ecx, esi
mov edx, dword [edi + 0x18]
push dword [eax + 0x18]
push dword [eax + 0x14]
call fcn.00403400
add esp, 8
test eax, eax
jne 0x40371d
cmp dword [edi + 0x24], 0
lea eax, [edi + 0x24]
jne 0x4036f7
cmp dword [esi], 0
je 0x4036fc
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4036f7
test eax, eax
je 0x4036f7
push 0x7fff
push ebx
call fcn.004095b4
mov dword [ebp - 8], eax
inc eax
mov dword [ebp - 4], eax
lea ecx, [eax + eax]
push ecx
call fcn.0040f52e
add esp, 0xc
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4036f7
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
push eax
call fcn.0040f607
mov eax, dword [ebp - 0xc]
add esp, 0x10
mov dword [edi + 0x24], eax
cmp dword [esi], 0
jne 0x40371b
push dword [edi + 0x10]
push dword [edi + 0xc]
push str.__s__s_has_no_executable_path_n
call fcn.004010f0
add esp, 0xc
pop edi
pop esi
mov eax, 0x67
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret