Function at 0x4022d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
cmp dword [ebp + 0xc], 0
je 0x4022ef
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
test ax, ax
jne 0x402327
lea eax, [ebp - 0x60]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov dword [ebp - 0x54], 0
lea eax, [ebp - 0x60]
mov dword [esp + 4], eax
lea eax, [ebp - 0x54]
mov dword [esp], eax
mov ecx, dword [ebp + 8]
call method.std::pair_unsigned_long__std::vector_unsigned_char__std::allocator_unsigned_char_____.pair_int__void__int__std::vector_unsigned_char__std::allocator_unsigned_char____const_
sub esp, 8
lea eax, [ebp - 0x60]
mov ecx, eax
call fcn.00422ee8
jmp 0x402986
lea eax, [ebp - 0x64]
mov ecx, eax
call fcn.0041df10
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
jmp 0x4023d5
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x5c
je 0x402354
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x2f
jne 0x4023c4
lea eax, [ebp - 0x49]
mov ecx, eax
call fcn.0041bfd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
sub edx, eax
mov eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x49]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_wchar_t_const__unsigned_int__std::allocator_wchar_t__const_
sub esp, 0xc
lea eax, [ebp - 0x64]
lea edx, [ebp - 0x50]
mov dword [esp], edx
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.operator_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
sub esp, 4
lea eax, [ebp - 0x50]
mov ecx, eax
call sym.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea eax, [ebp - 0x49]
mov ecx, eax
call sym.std::allocator_wchar_t_::allocator__
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CharNextW_4
sub esp, 4
mov dword [ebp - 0xc], eax
jmp 0x4023e4
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CharNextW_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
test ax, ax
jne 0x40233c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x68]
mov ecx, eax
call fcn.0041df10
lea eax, [ebp - 0x6c]
mov ecx, eax
call fcn.0041df10
jmp 0x402411
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CharNextW_4
sub esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
test ax, ax
jne 0x402400
jmp 0x40250a
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x5c
je 0x40243d
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x2f
jne 0x4024f2
lea eax, [ebp - 0x41]
mov ecx, eax
call fcn.0041bfd0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
sub edx, eax
mov eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x48]
lea ecx, [ebp - 0x41]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x18]
mov dword [esp], edx
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_wchar_t_const__unsigned_int__std::allocator_wchar_t__const_
sub esp, 0xc
lea eax, [ebp - 0x68]
lea edx, [ebp - 0x48]
mov dword [esp], edx
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.operator_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
sub esp, 4
lea eax, [ebp - 0x48]
mov ecx, eax
call sym.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea eax, [ebp - 0x41]
mov ecx, eax
call sym.std::allocator_wchar_t_::allocator__
lea eax, [ebp - 0x39]
mov ecx, eax
call fcn.0041bfd0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CharNextW_4
sub esp, 4
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x39]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ecx, edx
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.basic_string_wchar_t_const__std::allocator_wchar_t__const_
sub esp, 8
lea eax, [ebp - 0x6c]
lea edx, [ebp - 0x40]
mov dword [esp], edx
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.operator_std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____
sub esp, 4
lea eax, [ebp - 0x40]
mov ecx, eax
call sym.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea eax, [ebp - 0x39]
mov ecx, eax
call sym.std::allocator_wchar_t_::allocator__
jmp 0x402516
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._CharPrevW_8
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
ja 0x402421
mov dword [esp + 4], str.HKEY_CLASSES_ROOT
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
jne 0x402544
mov dword [esp + 4], str.HKCR
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
je 0x40254b
mov eax, 1
jmp 0x402550
mov eax, 0
test al, al
je 0x402560
mov dword [ebp - 0x10], 0x80000000
jmp 0x4026cc
mov dword [esp + 4], str.HKEY_CURRENT_USER
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
jne 0x40258e
mov dword [esp + 4], str.HKCU
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
je 0x402595
mov eax, 1
jmp 0x40259a
mov eax, 0
test al, al
je 0x4025aa
mov dword [ebp - 0x10], 0x80000001
jmp 0x4026cc
mov dword [esp + 4], str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
jne 0x4025d8
mov dword [esp + 4], str.HKLM
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
je 0x4025df
mov eax, 1
jmp 0x4025e4
mov eax, 0
test al, al
je 0x4025f4
mov dword [ebp - 0x10], 0x80000002
jmp 0x4026cc
mov dword [esp + 4], str.HKEY_USERS
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
jne 0x402622
mov dword [esp + 4], 0x42c196
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
je 0x402629
mov eax, 1
jmp 0x40262e
mov eax, 0
test al, al
je 0x40263e
mov dword [ebp - 0x10], 0x80000003
jmp 0x4026cc
mov dword [esp + 4], str.HKEY_CURRENT_CONFIG
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
jne 0x40266c
mov dword [esp + 4], str.HKCC
lea eax, [ebp - 0x64]
mov dword [esp], eax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
je 0x402673
mov eax, 1
jmp 0x402678
mov eax, 0
test al, al
je 0x402685
mov dword [ebp - 0x10], 0x80000005
jmp 0x4026cc
mov dword [esp], 0x57
call sym._SetLastError_4
sub esp, 4
lea eax, [ebp - 0x38]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
lea eax, [ebp - 0x2c]
mov dword [esp], eax
mov ecx, dword [ebp + 8]
call method.std::pair_unsigned_long__std::vector_unsigned_char__std::allocator_unsigned_char_____.pair_int__void__int__std::vector_unsigned_char__std::allocator_unsigned_char____const_
sub esp, 8
lea eax, [ebp - 0x38]
mov ecx, eax
call fcn.00422ee8
jmp 0x4028a8
call sym.IsWow64__
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x68]
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.empty___const
test al, al
je 0x4026e9
mov eax, 0
jmp 0x4026f3
lea eax, [ebp - 0x68]
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.c_str___const
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x6c]
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.empty___const
test al, al
je 0x40270b
mov eax, 0
jmp 0x402715
lea eax, [ebp - 0x6c]
mov ecx, eax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___.c_str___const
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x74], 0
lea eax, [ebp - 0x80]
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x1c], 0
je 0x402766
lea eax, [ebp - 0x70]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20119
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
je 0x402796
lea eax, [ebp - 0x70]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne 0x40279d
mov eax, 1
jmp 0x4027a2
mov eax, 0
test al, al
je 0x402869
mov dword [ebp - 0x84], 0
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x84]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x40285b
mov edx, dword [ebp - 0x84]
lea eax, [ebp - 0x80]
mov dword [esp], edx
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.resize_unsigned_int_
sub esp, 4
lea eax, [ebp - 0x80]
mov dword [esp], 0
mov ecx, eax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.operator___unsigned_int_
sub esp, 4
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x84]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x74]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._RegQueryValueExW_24
sub esp, 0x18
test eax, eax
sete al
movzx eax, al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
lea eax, [ebp - 0x80]
mov dword [esp], eax
call method.std::remove_reference_std::vector_unsigned_char__std::allocator_unsigned_char____::type_std::move_std::vector_unsigned_char__std.allocator_unsigned_char_____std::vector_unsigned_char__std::allocator_unsigned_char____
mov edx, eax
cmp dword [ebp - 0x14], 0
je 0x402881
mov eax, dword [ebp - 0x74]
jmp 0x402886
mov eax, 0
mov dword [ebp - 0x28], eax
mov dword [esp + 4], edx
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov ecx, dword [ebp + 8]
call method.std::pair_unsigned_long__std::vector_unsigned_char__std::allocator_unsigned_char_____::pair_unsigned_long__std::vector_unsigned_char__std.allocator_unsigned_char_____void__unsigned_long__std::vector_unsigned_char__std::allocator_unsigned_char___
sub esp, 8
lea eax, [ebp - 0x80]
mov ecx, eax
call fcn.00422ee8
lea eax, [ebp - 0x6c]
mov ecx, eax
call sym.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea eax, [ebp - 0x68]
mov ecx, eax
call sym.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea eax, [ebp - 0x64]
mov ecx, eax
call sym.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
jmp 0x402986
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
leave
ret