Function at 0x403320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45f810
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x4785c0]
xor eax, ebp
mov dword [ebp - 0x38], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x164], ecx
push 0x46780e
lea ecx, [ebp - 0x20]
call fcn.00402250
mov dword [ebp - 4], 0
push 0x46780f
lea ecx, [ebp - 0x14]
call fcn.00402250
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4033ae
mov dword [ebp - 0x148], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004022d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004022d0
mov eax, dword [ebp - 0x148]
jmp 0x4039cc
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x24], 0
jmp 0x4033ce
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0xc]
jge 0x4039a2
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x41c
mov ecx, dword [ebp + 8]
cmp dword [ecx + eax], reloc.OLEAUT32.dll_SysReAllocString
jne 0x4033fe
push 0x46a308
lea ecx, [ebp - 0x14]
call fcn.00402310
jmp 0x403444
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
cmp dword [eax + edx], 0x80000000
jne 0x403422
push 0x46a31c
lea ecx, [ebp - 0x14]
call fcn.00402310
jmp 0x403444
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
cmp dword [edx + ecx], 0x80000001
jne 0x403444
push 0x46a330
lea ecx, [ebp - 0x14]
call fcn.00402310
mov dword [ebp - 0x10], 0x104
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x18]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 4]
push eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4034f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x46a344
lea edx, [ebp - 0x20]
push edx
call fcn.00403100
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x14c], esp
lea eax, [ebp - 0x20]
push eax
call fcn.00402230
mov dword [ebp - 0x168], eax
mov ecx, 0x485028
call fcn.0041bfb0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4039a2
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + edx + 0x10c]
test ecx, ecx
je 0x403970
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx + 0x108]
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], 4
jne 0x403530
mov dword [ebp - 0x10], 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x41c
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x210]
push edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x41c
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x108]
push edx
push 0
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x41c
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x10c]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4035f7
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x10c]
push eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x46a358
lea edx, [ebp - 0x20]
push edx
call fcn.00403100
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x150], esp
lea eax, [ebp - 0x20]
push eax
call fcn.00402230
mov dword [ebp - 0x16c], eax
mov ecx, 0x485028
call fcn.0041bfb0
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4039a2
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x210]
mov dword [ebp - 0x170], ecx
mov edx, dword [ebp - 0x170]
add edx, 1
mov dword [ebp - 0x174], edx
mov eax, dword [ebp - 0x170]
mov cl, byte [eax]
mov byte [ebp - 0x175], cl
add dword [ebp - 0x170], 1
cmp byte [ebp - 0x175], 0
jne 0x40361f
mov edx, dword [ebp - 0x170]
sub edx, dword [ebp - 0x174]
mov dword [ebp - 0x17c], edx
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
movsx eax, byte [ecx + edx + 0x20f]
cmp eax, 0x22
jne 0x403694
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
add ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x30]
mov byte [ecx + edx + 0x20f], 0
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx + 0x210]
cmp eax, 0x22
jne 0x403704
mov ecx, dword [ebp - 0x30]
sub ecx, 1
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x211]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x210]
push ecx
call fcn.0044e400
add esp, 0xc
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x24]
imul eax, eax, 0x41c
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x30]
mov byte [eax + ecx + 0x210], 0
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx + 0x418]
cmp ecx, 1
jne 0x403970
cmp dword [ebp - 0x34], 4
jne 0x4037d8
push 4
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x314]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x210]
push ecx
call fcn.0044274e
add esp, 0xc
test eax, eax
je 0x4037d3
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x10c]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x46a374
lea eax, [ebp - 0x20]
push eax
call fcn.00403100
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x154], esp
lea edx, [ebp - 0x20]
push edx
call fcn.00402230
mov dword [ebp - 0x180], eax
mov ecx, 0x485028
call fcn.0041bfb0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], 0
jmp 0x4039a2
jmp 0x403970
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx + 0x419]
cmp eax, 1
jne 0x4038cf
mov byte [ebp - 0x144], 0
push 0x103
push 0
lea ecx, [ebp - 0x143]
push ecx
call fcn.00446170
add esp, 0xc
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x314]
push ecx
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4038ca
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x10c]
push eax
mov ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x41c
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0x46a390
lea edx, [ebp - 0x20]
push edx
call fcn.00403100
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x158], esp
lea eax, [ebp - 0x20]
push eax
call fcn.00402230
mov dword [ebp - 0x184], eax
mov ecx, 0x485028
call fcn.0041bfb0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], 0
jmp 0x4039a2
jmp 0x403970
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x314]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x403970
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x10c]
push ecx
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 4]
push ecx
mov edx, dword [ebp - 0x14]
push edx
push 0x46a3ac
lea eax, [ebp - 0x20]
push eax
call fcn.00403100
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x15c], esp
lea edx, [ebp - 0x20]
push edx
call fcn.00402230
mov dword [ebp - 0x188], eax
mov ecx, 0x485028
call fcn.0041bfb0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], 0
jmp 0x4039a2
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
push 0
mov edx, dword [ebp - 0x24]
imul edx, edx, 0x41c
mov eax, dword [ebp + 8]
lea ecx, [eax + edx + 0x210]
push ecx
call fcn.00446170
add esp, 0xc
jmp 0x4033c5
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x160], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.004022d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004022d0
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x38]
xor ecx, ebp
call fcn.00441de6
mov esp, ebp
pop ebp
ret 8