Function at 0x402d70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cf11
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x850
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x85c], esi
mov dword [ebp - 0x820], esi
push ecx
lea edx, [ebx + 8]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x838]
call fcn.00402a10
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x402de0
mov eax, dword [eax]
lea ecx, [ebp - 0x854]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x824]
mov edi, eax
mov dword [ebp - 0x858], edi
cmp ecx, 8
jb 0x402e70
mov eax, dword [ebp - 0x838]
lea edx, [ecx + 1]
mov ecx, eax
cmp edx, 0x7fffffff
ja 0x403412
add edx, edx
cmp edx, 0x1000
jb 0x402e66
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403412
mov edx, edi
test cl, 0x1f
jne 0x403412
mov eax, dword [eax - 4]
cmp eax, ecx
jae 0x403412
sub ecx, eax
cmp ecx, 4
jb 0x403412
cmp ecx, 0x23
ja 0x403412
mov edi, dword [ebp - 0x858]
push edx
push eax
call fcn.0040ec96
add esp, 8
test edi, edi
je 0x402f54
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x43a37b
mov byte [esi], 0
call fcn.004011b0
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x402eeb
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402ee1
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403412
mov edx, edi
test al, 0x1f
jne 0x403412
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403412
sub eax, ecx
cmp eax, 4
jb 0x403412
cmp eax, 0x23
ja 0x403412
push edx
push ecx
call fcn.0040ec96
add esp, 8
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp edx, 0x10
jb 0x4033f2
mov ecx, dword [ebx + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4033e8
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403417
mov edx, edi
test al, 0x1f
jne 0x403417
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403417
sub eax, ecx
cmp eax, 4
jb 0x403417
cmp eax, 0x23
ja 0x403417
jmp 0x4033e8
push 0x800
lea eax, [ebp - 0x818]
push 0
push eax
call fcn.00411660
add esp, 8
mov dword [ebp - 0x820], 0x400
lea edx, [ebx + 0x20]
mov dword [ebp - 0x81c], 0
lea ecx, [ebp - 0x838]
call fcn.00402a10
add esp, 4
cmp dword [eax + 0x14], 8
jb 0x402f97
mov eax, dword [eax]
lea ecx, [ebp - 0x820]
push ecx
lea ecx, [ebp - 0x818]
push ecx
lea ecx, [ebp - 0x81c]
push ecx
push 0
push eax
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [ebp - 0x824]
mov dword [ebp - 0x858], eax
cmp edi, 8
jb 0x403030
mov edx, dword [ebp - 0x838]
inc edi
mov ecx, edx
cmp edi, 0x7fffffff
ja 0x403412
add edi, edi
cmp edi, 0x1000
jb 0x403020
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x403412
mov edi, eax
test cl, 0x1f
jne 0x403412
mov edx, dword [edx - 4]
cmp edx, ecx
jae 0x403412
sub ecx, edx
cmp ecx, 4
jb 0x403412
cmp ecx, 0x23
ja 0x403412
push edi
push edx
call fcn.0040ec96
mov eax, dword [ebp - 0x858]
add esp, 8
test eax, eax
je 0x403114
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x43a3e1
mov byte [esi], 0
call fcn.004011b0
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x4030ab
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4030a1
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x40341c
mov edx, edi
test al, 0x1f
jne 0x40341c
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x40341c
sub eax, ecx
cmp eax, 4
jb 0x40341c
cmp eax, 0x23
ja 0x40341c
push edx
push ecx
call fcn.0040ec96
add esp, 8
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp edx, 0x10
jb 0x4033f2
mov ecx, dword [ebx + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4033e8
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403421
mov edx, edi
test al, 0x1f
jne 0x403421
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403421
sub eax, ecx
cmp eax, 4
jb 0x403421
cmp eax, 0x23
ja 0x403421
jmp 0x4033e8
cmp dword [ebp - 0x81c], 1
je 0x4031fd
push 0
mov dword [esi + 0x10], 0
mov ecx, esi
mov dword [esi + 0x14], 0xf
push 0x43a3e2
mov byte [esi], 0
call fcn.004011b0
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x403194
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40318a
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403426
mov edx, edi
test al, 0x1f
jne 0x403426
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403426
sub eax, ecx
cmp eax, 4
jb 0x403426
cmp eax, 0x23
ja 0x403426
push edx
push ecx
call fcn.0040ec96
add esp, 8
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp edx, 0x10
jb 0x4033f2
mov ecx, dword [ebx + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4033e8
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x40342b
mov edx, edi
test al, 0x1f
jne 0x40342b
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x40342b
sub eax, ecx
cmp eax, 4
jb 0x40342b
cmp eax, 0x23
ja 0x40342b
jmp 0x4033e8
push dword [ebp - 0x854]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x818]
mov dword [ebp - 0x854], 0
push eax
lea ecx, [ebp - 0x850]
call fcn.00407c10
mov byte [ebp - 4], 2
lea edx, [ebp - 0x850]
cmp dword [ebp - 0x83c], 8
lea edi, [ebp - 0x850]
mov eax, dword [ebp - 0x840]
lea ecx, [ebp - 0x838]
cmovae edx, dword [ebp - 0x850]
cmovae edi, dword [ebp - 0x850]
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 0xf
lea eax, [edx + eax*2]
mov byte [ebp - 0x838], 0
mov dword [ebp - 0x858], eax
sub eax, edi
sar eax, 1
push eax
call fcn.00407da0
push dword [ebp - 0x85c]
lea ecx, [ebp - 0x838]
push dword [ebp - 0x858]
push edi
call fcn.0040e350
mov esi, dword [ebp - 0x85c]
movups xmm0, xmmword [ebp - 0x838]
mov edx, dword [ebp - 0x83c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x828]
movq qword [esi + 0x10], xmm0
cmp edx, 8
jb 0x40332f
mov ecx, dword [ebp - 0x850]
inc edx
mov eax, ecx
cmp edx, 0x7fffffff
ja 0x403412
add edx, edx
cmp edx, 0x1000
jb 0x403325
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403412
mov edx, edi
test al, 0x1f
jne 0x403412
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403412
sub eax, ecx
cmp eax, 4
jb 0x403412
cmp eax, 0x23
ja 0x403412
push edx
push ecx
call fcn.0040ec96
add esp, 8
mov edx, dword [ebx + 0x1c]
xor eax, eax
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 7
mov word [ebp - 0x850], ax
cmp edx, 0x10
jb 0x4033a0
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403396
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403430
mov edx, edi
test al, 0x1f
jne 0x403430
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403430
sub eax, ecx
cmp eax, 4
jb 0x403430
cmp eax, 0x23
ja 0x403430
push edx
push ecx
call fcn.0040ec96
add esp, 8
mov edx, dword [ebx + 0x34]
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0xf
mov byte [ebx + 8], 0
cmp edx, 0x10
jb 0x4033f2
mov ecx, dword [ebx + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4033e8
lea edi, [edx + 0x23]
cmp edi, edx
jbe 0x403435
mov edx, edi
test al, 0x1f
jne 0x403435
mov ecx, dword [ecx - 4]
cmp ecx, eax
jae 0x403435
sub eax, ecx
cmp eax, 4
jb 0x403435
cmp eax, 0x23
ja 0x403435
push edx
push ecx
call fcn.0040ec96
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040e7db
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041524e
call fcn.0041524e
call fcn.0041524e
call fcn.0041524e
call fcn.0041524e
call fcn.0041524e
call fcn.0041524e
call fcn.0041524e
int3