Function at 0x402a80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a95c0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi + 0x18], edi
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
lea ebx, [eax + 0x10]
mov dword [esp + 0x1c], ebx
mov eax, 0x1000
mov dword [esp + 0x50], edi
push 0x4008
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
call fcn.0057740a
mov edi, eax
add esp, 4
mov dword [esp + 0x24], edi
test edi, edi
jne 0x402b18
push eax
call fcn.00578327
lea eax, [ebx - 0x10]
add esp, 4
mov dword [esp + 0x50], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x403144
push 0x4008
push 0
push edi
call fcn.00580260
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea ebx, [edi + ecx]
lea edx, [esp + 0x18]
push edx
push 0x2001f
push 0
push str.SOFTWARETencentQQPinyin
mov byte [esp + 0x60], 2
push closesocket
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402e39
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x3c]
push edx
push 0
push str.Acc20
push eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x2c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402b98
cmp dword [esp + 0x34], 3
je 0x402db9
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x3c]
push ecx
push 0
push str.Acc2
push edx
mov dword [esp + 0x2c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402c34
cmp dword [esp + 0x34], 3
jne 0x402c34
cmp dword [edi], 1
jne 0x402c0c
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ebx
mov eax, 0x5bcae0
mov ecx, edi
call fcn.004025a0
add esp, 8
test eax, eax
je 0x402c0c
mov dword [esp + 0x14], 0x1000
call fcn.004021f0
mov ecx, dword [esp + 0x20]
push eax
push ecx
push ebx
lea ecx, [esp + 0x20]
mov edx, edi
call fcn.00401c40
add esp, 0xc
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push edx
push edi
push 3
push 0
push str.Acc20
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x402dc8
push esi
jmp 0x402dc2
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push edi
lea ecx, [esp + 0x3c]
push ecx
push 0
push 0x5bcc18
push edx
mov dword [esp + 0x2c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402db9
cmp dword [esp + 0x34], 3
jne 0x402db9
cmp dword [edi], 1
jne 0x402db9
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push ebx
xor eax, eax
mov ecx, edi
call fcn.004025a0
add esp, 8
test eax, eax
je 0x402db9
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x50], 3
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 0x20]
movzx edx, byte [ebx + ecx + 4]
push edx
push 0x5bcb8c
lea edi, [esp + 0x30]
call fcn.00403650
mov eax, dword [esp + 0x28]
add eax, 1
add esp, 8
cmp eax, 0x10
mov dword [esp + 0x20], eax
jb 0x402cb7
mov eax, dword [esp + 0x28]
push eax
mov eax, 0x5bcb98
mov ecx, esi
call fcn.00403690
mov dword [esi + 0x18], 1
mov ecx, dword [ebx]
push ecx
mov edi, str.User
call fcn.004034d0
lea edx, [ebx + 0x14]
push edx
mov eax, str.Nick
mov ecx, esi
call fcn.00403690
push 0
mov edi, str.AutoSyncCfg
mov dword [esi + 0x18], 1
call fcn.004034d0
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x34]
push edx
push 0
push str.LastSync
mov edi, 4
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402d75
cmp dword [esp + 0x2c], edi
jne 0x402d75
mov ecx, dword [esp + 0x30]
push ecx
mov edi, str.LastSync
call fcn.004034d0
push esi
mov dword [esi + 0x18], 1
call fcn.004031a0
mov edi, esi
call fcn.00408ad0
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esi + 0x18], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402db5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x402dc8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
push ecx
push 0x20019
push 0
push str.SOFTWARETencentQQPinyin
mov byte [esp + 0x60], 4
push closesocket
mov dword [esp + 0x44], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402e63
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x3c]
push edx
push 0
mov eax, 0x1000
push str.Acc20
push esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402e2e
cmp dword [esp + 0x34], 3
je 0x402e7d
test esi, esi
je 0x402e39
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00578327
mov dword [esp + 0x54], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x403144
push edi
call fcn.00578327
mov dword [esp + 0x54], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
jmp 0x403134
call fcn.004021f0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
mov ecx, ebx
mov edx, edi
call fcn.00401f50
add esp, 0xc
test eax, eax
je 0x402e2e
mov ecx, dword [esp + 0x20]
push 0x1ffe
lea edi, [ebx + 0x1000]
push edi
push ecx
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, edi
lea edi, [esp + 0x1c]
call fcn.004040f0
mov edi, dword [esp + 0x1c]
cmp dword [edi - 0xc], 0
jne 0x402f0f
test esi, esi
je 0x402edc
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x24]
push edx
call fcn.00578327
add edi, 0xfffffff0
add esp, 4
mov dword [esp + 0x50], 0xffffffff
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403150
mov ecx, dword [edi]
push edi
jmp 0x403149
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x50], 5
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x50], 6
mov edx, dword [0x5fcd20]
mov eax, dword [edx + 0xc]
mov ecx, 0x5fcd20
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x28], ebx
mov byte [esp + 0x50], 7
mov ecx, dword [edi - 0xc]
lea esi, [edi + ecx*2]
cmp edi, esi
mov eax, edi
mov dword [esp + 0x34], esi
jae 0x4030a5
jmp 0x402f84
mov eax, dword [esp + 0x2c]
cmp eax, esi
mov ecx, eax
jae 0x402fa1
lea ebx, [ebx]
cmp word [eax], 0xa
je 0x403165
add eax, 2
cmp eax, esi
jb 0x402f90
mov dword [esp + 0x2c], esi
cmp eax, ecx
jbe 0x40309b
cmp word [eax - 2], 0xd
jne 0x402fb7
add eax, 0xfffffffe
cmp eax, ecx
jbe 0x40309b
mov ebx, eax
sub ebx, ecx
sar ebx, 1
push ecx
lea eax, [esp + 0x24]
call fcn.00404050
mov edi, dword [esp + 0x20]
cmp dword [edi - 0xc], 0
jle 0x403179
push 0x3d
push edi
call fcn.00578331
add esp, 8
test eax, eax
je 0x403179
sub eax, edi
sar eax, 1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403179
lea ecx, [esp + 0x38]
lea edx, [esp + 0x20]
call fcn.00403560
lea edi, [esp + 0x18]
mov byte [esp + 0x50], 8
call fcn.004035d0
mov byte [esp + 0x50], 7
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40303f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebx + 1]
lea esi, [esp + 0x3c]
lea edx, [esp + 0x20]
call fcn.00403540
lea edi, [esp + 0x28]
mov byte [esp + 0x50], 9
call fcn.004035d0
mov byte [esp + 0x50], 7
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403082
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
push ebx
call fcn.00403690
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x2c], esi
jb 0x402f80
lea eax, [ebx - 0x10]
mov byte [esp + 0x50], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 5
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4030eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x50], 4
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403110
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40311f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00578327
mov dword [esp + 0x54], 0xffffffff
lea eax, [edi - 0x10]
or ecx, 0xffffffff
lea edx, [eax + 0xc]
add esp, 4
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403150
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, esi
jae 0x402fa1
lea edx, [eax + 2]
mov dword [esp + 0x2c], edx
jmp 0x402fa5
lea eax, [esp + 0x20]
lea edi, [esp + 0x18]
call fcn.004035d0
push 0x5bcc3c
xor ebx, ebx
lea eax, [esp + 0x2c]
call fcn.00404050
jmp 0x403086