Function at 0x403250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], 0x400
mov dword [esp + 0xc], 0
mov esi, 0x41df70
mov eax, 0x41e6e0
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x403298
test cl, cl
je 0x403294
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x403298
add eax, 2
add esi, 2
test cl, cl
jne 0x403270
xor eax, eax
jmp 0x40329d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov al, byte [0x41df70]
mov byte [0x41eae0], al
je 0x4032d2
mov edi, 0x41e6e0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x41eae0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x40332b
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push str.SOFTWAREORACLE
push 0x80000002
call esi
test eax, eax
je 0x40330a
lea edx, [esp + 0xc]
push edx
push 1
push 0
push str.SOFTWAREWOW6432NODEORACLE
push 0x80000002
call esi
test eax, eax
jne 0x40332b
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push 0x41eae0
push ecx
push 0
push str.inst_loc
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 0x41df70
mov eax, 0x41eae0
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40335d
test cl, cl
je 0x403359
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40335d
add eax, 2
add esi, 2
test cl, cl
jne 0x403335
xor eax, eax
jmp 0x403362
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403385
mov edi, dword [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x41eae0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x4033ad
mov edi, str.logs
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41eae0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x41eae0
rep movsb byte es:[edi], byte [esi]
call fcn.00406260
add esp, 4
test eax, eax
je 0x40345f
mov edi, dword [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
push 0x41928c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x41eae0
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x41eae0
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41eae0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..log
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x41eae0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040a6cd
add esp, 8
mov dword [0x41df74], eax
mov eax, dword [0x41df74]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x403475
mov al, byte [0x41df70]
mov byte [0x41eae0], al
add esp, 0xc
ret