Function at 0x402220
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov eax, ecx
xor edi, edi
cmp eax, edi
mov esi, edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x14], edi
je 0x402668
cmp esi, edi
je 0x402668
cmp byte [esi], 0
je 0x402668
test byte [esp + 0x4c], 1
je 0x40225b
mov dword [esp + 0x10], eax
jmp 0x40227e
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40227a
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x40227e
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x402668
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push edx
push edi
push edi
push edi
push edi
push eax
call ebx
test eax, eax
je 0x4022a0
mov dword [esp + 0x18], edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x38]
and ecx, 0xfffffffc
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x14], ebp
je 0x402655
lea edx, [ebp + 0x24]
mov dword [ebp + 8], edx
mov eax, dword [esp + 0x18]
cmp eax, 1
jbe 0x40233d
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp + 0x10]
repne scasb al, byte es:[edi]
not ecx
add ecx, 7
mov dword [ebp + 0xc], 1
and ecx, 0xfffffffc
push edx
lea eax, [ecx + ebp + 0x24]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x14], eax
mov edi, dword [esp + 0x1c]
push eax
mov dword [edx], edi
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0
push eax
call ebx
test eax, eax
je 0x40233d
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x14], 0
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x402655
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
mov dword [ebp], 1
call fcn.00401d80
cmp eax, 0xc8
mov dword [ebp + 4], eax
jb 0x40238b
cmp eax, 0x12c
jae 0x40238b
or dword [ebp], 0x10000
test ebp, ebp
je 0x402655
push 0
push 0
lea eax, [esp + 0x34]
push 0
lea ecx, [esp + 0x40]
push eax
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x38]
push 0
lea eax, [esp + 0x40]
push edx
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x4c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40263e
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
cmp eax, ecx
jle 0x4023e1
add eax, 8
jmp 0x4023e4
lea eax, [ecx + 8]
and al, 0xfc
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40263e
mov eax, dword [esp + 0x28]
xor edi, edi
test eax, eax
jle 0x4024bc
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x40]
xor esi, esi
push eax
push esi
inc edx
push esi
lea ecx, [esp + 0x2c]
push esi
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x20]
push ecx
push ebx
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40244b
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x10]
and al, 0xfe
mov edx, ebx
push eax
call fcn.00402220
mov esi, eax
test esi, esi
je 0x4024b4
mov eax, dword [esi + 4]
test eax, eax
jne 0x40246a
mov ecx, dword [esp + 0x4c]
and ecx, 2
test cl, cl
je 0x40246a
mov ecx, esi
call fcn.00402170
xor esi, esi
test esi, esi
je 0x40249c
mov edx, esi
mov ecx, ebp
call fcn.00402100
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4024ab
mov eax, dword [ebp + 4]
sub eax, 0x66
je 0x402493
dec eax
jne 0x40249c
mov eax, dword [esi]
or eax, 0x20000
jmp 0x40249a
mov eax, dword [esi]
or eax, 0x10000
mov dword [esi], eax
mov eax, dword [esp + 0x28]
inc edi
cmp edi, eax
jl 0x40240e
jmp 0x4024bc
mov ecx, esi
call fcn.00402170
jmp 0x4024bc
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x34]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x30], eax
jle 0x40262e
mov edx, dword [esp + 0x2c]
xor ebp, ebp
inc edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x3c]
push ebp
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
push ebp
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x4025ae
cmp byte [ebx], 0
je 0x4025fd
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4025fd
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x18]
not ecx
dec ecx
lea ecx, [ecx + eax + 0x38]
and ecx, 0xfffffffc
push ecx
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x402622
lea edx, [ebp + 0x24]
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], edx
repne scasb al, byte es:[edi]
not ecx
add ecx, 7
and ecx, 0xfffffffc
lea eax, [ecx + ebp + 0x24]
lea ecx, [ebp + 0xc]
mov dword [ebp + 0x14], eax
mov edx, dword [esp + 0x38]
mov dword [ecx], edx
mov edi, dword [esp + 0x18]
lea edx, [ebp + 0x10]
push edx
push eax
mov dword [edx], edi
mov eax, dword [esp + 0x18]
push ecx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402676
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test ebp, ebp
je 0x402622
mov ecx, ebp
mov dword [ebp], 2
call fcn.00401d80
test eax, eax
mov dword [ebp + 4], eax
jne 0x4025e6
mov eax, dword [esp + 0x4c]
and eax, 2
test al, al
je 0x4025e6
push ebp
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebp, ebp
test ebp, ebp
je 0x4025fd
mov ecx, dword [esp + 0x14]
mov edx, ebp
call fcn.00402100
test eax, eax
mov dword [esp + 0x1c], eax
je 0x402614
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
inc eax
cmp eax, ecx
mov dword [esp + 0x30], eax
jl 0x4024ce
jmp 0x40262a
push ebp
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40262a
mov dword [esp + 0x1c], 0
mov ebp, dword [esp + 0x14]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x402655
mov ecx, ebp
call fcn.00402170
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
cmp eax, ecx
je 0x402668
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret 4
push ebp
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebp, ebp
jmp 0x4025b4