Function at 0x401d20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x228
push ebp
push esi
mov esi, dword [esp + 0x238]
test esi, esi
je 0x401fce
mov ecx, dword [esp + 0x23c]
test ecx, ecx
je 0x401fce
mov eax, dword [esp + 0x240]
test eax, eax
je 0x401fce
mov ebp, dword [esp + 0x244]
test ebp, ebp
je 0x401fce
mov dword [ecx], 0
mov ecx, dword [esp + 0x234]
mov dword [eax], 0
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push esi
push ecx
mov dword [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401fc0
lea edx, [esp + 0x24]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x401de9
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 0xfffffffc
pop ebp
add esp, 0x228
ret
mov ecx, dword [esp + 0x10]
mov eax, 0x200
cmp ecx, eax
jb 0x401e39
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
push esi
push edx
lea eax, [esp + 0x38]
push str.ERROR:_enumerateRegValues___found_name_length__d_that_is_greater_than_MAX_REG_NAME_LEN_in_regkey__s._n
push eax
call fcn.00458ee7
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x40], 1
call fcn.0043e010
add esp, 0x14
pop esi
mov eax, 0xfffffffb
pop ebp
add esp, 0x228
ret
cmp dword [esp + 0x14], eax
jbe 0x401e82
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x38]
push str.ERROR:_enumerateRegValues___found_data_length__d_that_is_greater_than_MAX_SUPPORTED_REG_DATA_LEN_in_regkey__s._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 1
call fcn.0043e010
add esp, 0x14
pop esi
mov eax, 0xfffffffa
pop ebp
add esp, 0x228
ret
mov eax, dword [esp + 0xc]
test eax, eax
push ebx
push edi
jbe 0x401f87
imul eax, eax, 0x408
mov esi, eax
push esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x401ec2
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 0x228
ret
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
xor edi, edi
test eax, eax
jle 0x401f8f
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea esi, [ebx + 4]
lea ecx, [ecx]
push esi
lea eax, [esi + 0x204]
push eax
lea ecx, [esi - 4]
push ecx
push 0
lea edx, [esp + 0x30]
push edx
lea eax, [esi + 4]
push eax
mov dword [esp + 0x38], 0x200
mov dword [esi], 0x200
mov ecx, dword [esp + 0x28]
push edi
push ecx
call ebp
test eax, eax
jne 0x401f39
mov eax, dword [esp + 0x14]
inc edi
add esi, 0x408
cmp edi, eax
jl 0x401ef0
mov ebp, dword [esp + 0x24c]
jmp 0x401f8f
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0045932f
mov eax, dword [esp + 0x244]
push edi
push eax
lea ecx, [esp + 0x44]
push str.ERROR:_enumerateRegValues___RegEnumValue_call_failed_for__s____d._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x4c], 1
call fcn.0043e010
add esp, 0x18
pop edi
pop ebx
pop esi
mov eax, 0xfffffff9
pop ebp
add esp, 0x228
ret
xor eax, eax
mov dword [esp + 0x14], eax
xor ebx, ebx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x244]
mov dword [edx], ecx
mov ecx, dword [esp + 0x248]
mov edx, dword [esp + 0x10]
mov dword [ecx], eax
push edx
mov dword [ebp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x228
ret
pop esi
mov eax, 0xfffffffd
pop ebp
add esp, 0x228
ret
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x228
ret