Function at 0x403546
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x344
mov eax, 0x508c38
call fcn.004f2a08
mov eax, 0x517664
mov esi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x2c0], 0x51765c
mov dword [ebp - 0x2bc], 0x517654
mov dword [ebp - 0x2b8], 0x51764c
mov dword [ebp - 0x2b4], 0x517644
mov dword [ebp - 0x2b0], 0x51763c
mov dword [ebp - 0x2ac], 0x517634
mov dword [ebp - 0x2a8], 0x51762c
mov dword [ebp - 0x2a4], 0x517624
mov dword [ebp - 0x2a0], 0x51761c
mov dword [ebp - 0x29c], 0x517614
mov dword [ebp - 0x298], 0x51760c
mov dword [ebp - 0x294], 0x517604
mov dword [ebp - 0x290], 0x5175fc
mov dword [ebp - 0x28c], 0x5175f4
mov dword [ebp - 0x288], 0x5175ec
mov dword [ebp - 0x284], 0x5175e4
mov dword [ebp - 0x280], 0x5175dc
mov dword [ebp - 0x27c], 0x5175d4
mov dword [ebp - 0x278], 0x5175cc
mov dword [ebp - 0x274], 0x5175c4
mov dword [ebp - 0x270], 0x5175bc
mov dword [ebp - 0x26c], 0x5175b4
mov dword [ebp - 0x268], 0x5175ac
mov dword [ebp - 0x264], 0x5175a4
mov dword [ebp - 0x260], 0x51759c
mov dword [ebp - 0x25c], 0x517594
mov dword [ebp - 0x258], 0x51758c
mov dword [ebp - 0x254], 0x517584
mov dword [ebp - 0x250], 0x51757c
mov dword [ebp - 0x24c], 0x517574
mov dword [ebp - 0x248], 0x51756c
mov dword [ebp - 0x244], 0x517564
mov dword [ebp - 0x240], 0x51755c
mov dword [ebp - 0x23c], 0x517554
mov dword [ebp - 0x238], 0x51754c
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x350], str.ar_AE
mov dword [ebp - 0x34c], str.bg_BG
mov dword [ebp - 0x348], str.zh_CN
mov dword [ebp - 0x344], str.zh_TW
mov dword [ebp - 0x340], str.cs_CZ
mov dword [ebp - 0x33c], str.da_DK
mov dword [ebp - 0x338], str.de_DE
mov dword [ebp - 0x334], str.en_US
mov dword [ebp - 0x330], str.es_ES
mov dword [ebp - 0x32c], str.et_EE
mov dword [ebp - 0x328], str.fr_FR
mov dword [ebp - 0x324], str.el_GR
mov dword [ebp - 0x320], str.he_IL
mov dword [ebp - 0x31c], str.hr_HR
mov dword [ebp - 0x318], str.hu_HU
mov dword [ebp - 0x314], str.it_IT
mov dword [ebp - 0x310], str.ja_JP
mov dword [ebp - 0x30c], str.ko_KR
mov dword [ebp - 0x308], str.lt_LT
mov dword [ebp - 0x304], str.lv_LV
mov dword [ebp - 0x300], str.nl_NL
mov dword [ebp - 0x2fc], str.nb_NO
mov dword [ebp - 0x2f8], str.pl_PL
mov dword [ebp - 0x2f4], str.pt_BR
mov dword [ebp - 0x2f0], str.ro_RO
mov dword [ebp - 0x2ec], str.ru_RU
mov dword [ebp - 0x2e8], str.sk_SK
mov dword [ebp - 0x2e4], str.sl_SI
mov dword [ebp - 0x2e0], str.fi_FI
mov dword [ebp - 0x2dc], str.sv_SE
mov dword [ebp - 0x2d8], str.tr_TR
mov dword [ebp - 0x2d4], str.uk_UA
mov dword [ebp - 0x2d0], str.en_AE
mov dword [ebp - 0x2cc], str.en_IL
mov dword [ebp - 0x2c8], str.fr_MA
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x224], 0x208
call fcn.00404eaa
push eax
lea ecx, [ebp - 0x22c]
call fcn.004022f1
lea eax, [ebp - 0x21c]
push eax
push dword [0x558124]
xor ebx, ebx
push SysReAllocStringLen
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403998
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40398c
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00402d50
lea eax, [ebp - 0x218]
push eax
push 0x517390
call fcn.004f3158
pop ecx
pop ecx
test eax, eax
jne 0x4038d6
push 0x51738c
jmp 0x403984
mov edi, dword [ebp - 0x22c]
cmp dword [edi - 0xc], ebx
je 0x40398c
push 0x2e
push edi
call fcn.004f31e3
pop ecx
pop ecx
cmp eax, ebx
je 0x40393c
sub eax, edi
sar eax, 1
mov ecx, eax
cmp ecx, ebx
jle 0x40393c
mov eax, dword [edi - 0xc]
sub eax, ecx
dec eax
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00402e02
push eax
lea ecx, [esi + 8]
mov byte [ebp - 4], 1
call fcn.0040323e
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401ff3
lea ecx, [esi + 8]
call fcn.00402dda
mov dword [ebp - 0x220], ebx
mov eax, 0x51765c
push dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40396d
inc dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp + eax*4 - 0x2c0]
cmp word [eax], bx
jne 0x403947
mov eax, dword [ebp - 0x220]
mov eax, dword [ebp + eax*4 - 0x2c0]
cmp word [eax], bx
jne 0x40398c
push 0x51738a
lea ecx, [esi + 8]
call fcn.00402cb6
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
mov edi, 0x517384
cmp dword [eax - 0xc], ebx
je 0x4039b0
mov eax, dword [esi + 8]
cmp dword [eax - 0xc], ebx
jne 0x403a18
lea eax, [ebp - 0x21c]
push eax
push dword [0x558128]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403a18
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 8]
call fcn.00402d50
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 8
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x403a89
lea eax, [ebp - 0x21c]
push eax
push dword [0x558128]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403a89
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00402d50
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x403b1e
lea eax, [ebp - 0x21c]
push eax
push dword [0x55812c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403b1e
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00402d50
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
je 0x403b12
push 0x517368
mov ecx, esi
call fcn.004021cf
test eax, eax
jne 0x403b12
push 0x51738c
mov ecx, esi
call fcn.00402cb6
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x403b8c
lea eax, [ebp - 0x21c]
push eax
push dword [0x558130]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403b8c
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00402d50
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x403bfa
lea eax, [ebp - 0x21c]
push eax
push dword [0x558130]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x403bfa
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push edi
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00402d50
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
jne 0x403c0d
push 0x51738c
mov ecx, esi
call fcn.00402cb6
xor edi, edi
mov eax, 0x51765c
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x403c2e
mov eax, dword [ebp + edi*4 - 0x2bc]
inc edi
cmp word [eax], bx
jne 0x403c14
mov eax, edi
shl eax, 2
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + eax - 0x2c0]
mov edi, 0x517624
cmp word [eax], bx
jne 0x403c5a
push edi
call fcn.00402114
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00402d50
mov esi, dword [esi]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x403c8c
mov eax, dword [ebp - 0x220]
mov esi, dword [ebp + eax - 0x350]
push esi
call fcn.00402114
pop ecx
mov ecx, dword [ebp - 0x230]
push eax
push esi
add ecx, 0xc
call fcn.00402d50
lea eax, [ebp - 0x21c]
push eax
push 1
push ebx
push dword [0x558134]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403d0b
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push ebx
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403cff
lea eax, [ebp - 0x218]
push eax
call fcn.00402114
pop ecx
mov ecx, dword [ebp - 0x230]
push eax
lea eax, [ebp - 0x218]
push eax
add ecx, 0x10
call fcn.00402d50
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.00401ff3
call fcn.004f2a8b
ret