Function at 0x402117
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00401657
pop ecx
test al, al
jne 0x401773
or eax, 0xffffffff
pop ebp
ret
push dword [ebp + 0xc]
call fcn.004016b3
pop ecx
test al, al
jne 0x401785
push 0xfffffffffffffffe
pop eax
pop ebp
ret
cmp dword [ebp + 0x14], 0
jne 0x40178f
push 0xfffffffffffffffc
jmp 0x401782
pop ebp
jmp 0x402117
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x2c4
mov eax, dword [0x412320]
xor eax, ebp
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x78]
push ebx
mov ebx, dword [ebp + 0x74]
push esi
push edi
mov edi, dword [ebp + 0x70]
mov dword [ebp - 0x25c], eax
xor eax, eax
push 0x4c
mov word [ebp - 0x44], ax
xor esi, esi
lea eax, [ebp - 0x42]
push esi
push eax
mov dword [ebp - 0x248], ebx
call fcn.00402ec0
xor eax, eax
push 0x4c
mov word [ebp - 0x94], ax
lea eax, [ebp - 0x92]
push esi
push eax
call fcn.00402ec0
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push edi
call fcn.00401906
add esp, 0x28
mov dword [ebp - 0x244], eax
cmp eax, esi
jne 0x4023e9
xor eax, eax
push 0x1a8
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x23e]
push esi
push eax
call fcn.00402ec0
xor eax, eax
push 0x54
mov word [ebp + 0xc], ax
lea eax, [ebp + 0xe]
push esi
push eax
call fcn.00402ec0
add esp, 0x18
push 0xd5
lea eax, [ebp - 0x240]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov ebx, 0xfde9
push ebx
call edi
test eax, eax
jne 0x4021ef
mov dword [ebp - 0x244], 0xfffffffd
cmp dword [ebp - 0x248], esi
je 0x402223
cmp dword [ebp - 0x244], esi
jne 0x4023e9
push 0x2b
lea eax, [ebp + 0xc]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x248]
push esi
push ebx
call edi
test eax, eax
jne 0x40222f
mov dword [ebp - 0x244], 0xfffffffd
cmp dword [ebp - 0x244], esi
jne 0x4023e9
lea eax, [ebp - 0x24c]
push eax
push 0x7fffffff
push 0x40e570
mov dword [ebp - 0x244], 0xfffffffd
mov dword [ebp - 0x24c], esi
call fcn.00401e8b
mov edi, dword [ebp - 0x24c]
add edi, 0xd4
cmp dword [ebp - 0x248], esi
je 0x40226c
add edi, 0x2b
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
inc edi
lea eax, [edi + edi]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x40e570
push edi
push eax
mov dword [ebp - 0x250], eax
call fcn.00401e1b
lea eax, [ebp - 0x240]
push eax
push edi
push dword [ebp - 0x250]
call fcn.00401e1b
cmp dword [ebp - 0x248], esi
je 0x4022d0
push 0x40e56c
push edi
push dword [ebp - 0x250]
call fcn.00401e1b
lea eax, [ebp + 0xc]
push eax
push edi
push dword [ebp - 0x250]
call fcn.00401e1b
lea eax, [ebp - 0x254]
push eax
push 0x20019
push esi
push dword [ebp - 0x250]
mov dword [ebp - 0x258], esi
push 0x80000002
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x254], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4023cf
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x24c]
push eax
push esi
lea eax, [ebp - 0x258]
push eax
push esi
push 0x40e54c
push dword [ebp - 0x254]
call edi
test eax, eax
jne 0x4023c1
cmp dword [ebp - 0x258], 1
jne 0x4023b7
cmp dword [ebp - 0x25c], esi
je 0x4023b7
mov eax, dword [ebp - 0x24c]
cmp eax, dword [ebp + 0x7c]
jae 0x4023b7
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0x24c]
push ecx
push eax
push esi
push esi
push 0x40e54c
push dword [ebp - 0x254]
mov dword [ebp - 0x248], eax
call edi
test eax, eax
jne 0x4023a5
push esi
push esi
push dword [ebp + 0x7c]
push dword [ebp - 0x25c]
push 0xffffffffffffffff
push dword [ebp - 0x248]
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4023a5
mov dword [ebp - 0x244], esi
push dword [ebp - 0x248]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4023c1
mov dword [ebp - 0x244], 0xfffffffc
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4023d9
mov dword [ebp - 0x244], 0xfffffffa
push dword [ebp - 0x250]
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp + 0x64]
mov eax, dword [ebp - 0x244]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004024bc
add ebp, 0x68
leave
ret