Function at 0x402760
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x36c
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x28], 0x103
lea edi, [esp + 0x54]
mov dword [esp + 0x38], 0
lea ebx, [esp + 0x158]
mov dword [esp + 0x24], 0x103
mov dword [esp + 0x2c], 0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x380]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
mov ebp, eax
test eax, eax
je 0x4028e8
cmp eax, 0xea
je 0x4029f8
cmp eax, 0x103
je 0x40282c
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebp
mov dword [esp + 4], str.errno__li_n
mov dword [esp], eax
call fcn.00401000
mov ebp, dword [sym.imp.advapi32.dll_RegEnumKeyExW]
xor esi, esi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x380]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x20
mov edi, eax
test eax, eax
je 0x402990
cmp eax, 0xea
je 0x402ac0
cmp eax, 0x103
je 0x4028b8
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], edi
mov dword [esp + 4], str.errno__li_n
mov dword [esp], eax
call fcn.00401000
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ecx
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
add esp, 0x36c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x50]
mov dword [esp + 4], 0xffffffff
add esi, 1
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00401980
mov ecx, dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], 1
mov ebp, eax
mov dword [esp + 0x34], ecx
call ecx
mov edx, dword [sym.imp.ucrtbase.dll_fputs]
mov dword [esp], str.value
mov dword [esp + 4], eax
mov dword [esp + 0x30], edx
call edx
mov dword [esp], ebp
call fcn.004024e0
mov ecx, dword [esp + 0x34]
mov dword [esp], 1
call ecx
mov edx, dword [esp + 0x30]
mov dword [esp], 0x4041ca
mov dword [esp + 4], eax
call edx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [esp + 0x48]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.00402650
jmp 0x4027a0
lea eax, [esp + 0x50]
mov dword [esp + 4], 0xffffffff
add esi, 1
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.00401980
mov dword [esp], 1
mov edi, eax
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], edi
mov dword [esp + 4], str.subkey__s_n
mov dword [esp], eax
call fcn.00401000
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x402834
mov ebp, dword [esp + 0x44]
cmp ebp, dword [esp + 0x24]
ja 0x402a68
mov ebp, dword [esp + 0x48]
cmp ebp, dword [esp + 0x28]
jbe 0x4027a0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov edx, dword [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov edi, dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edi
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
mov dword [esp + 0x28], ebp
mov dword [esp + 0x38], eax
jmp 0x4027a0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call dword [sym.imp.kernel32.dll_GetProcessHeap]
lea edx, [ebp + ebp + 2]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], edx
call eax
sub esp, 0xc
mov ebx, eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], eax
jmp 0x402a02
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x24], ebx
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov edx, dword [esp + 0x2c]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], edx
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
call dword [sym.imp.kernel32.dll_GetProcessHeap]
lea edx, [ebx + ebx + 2]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
mov dword [esp + 0x2c], eax
jmp 0x402834