Function at 0x402bc0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x100
mov eax, 0x43346f
call fcn.00432eed
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc0]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x90], esi
call fcn.00401d45
push eax
push ecx
push dword [0x43853c]
lea ecx, [ebp - 0x10c]
call fcn.00415519
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 3
mov ecx, esi
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x94], eax
call fcn.0040553d
xor edx, edx
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xec], edx
test eax, eax
je 0x402c69
mov ecx, eax
call fcn.0040bd8c
mov edi, eax
xor edx, edx
mov dword [ebp - 0xc4], edi
jmp 0x402c71
mov edi, edx
mov dword [ebp - 0xc4], edx
test esi, esi
je 0x402c8b
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x402c8b
call fcn.0040bd8c
mov esi, eax
mov dword [ebp - 0x8c], esi
jmp 0x402c93
mov esi, edx
mov dword [ebp - 0x8c], edx
lea eax, [edi + 0x104]
mov byte [ebp - 0x71], 1
cmp eax, 0x104
jb 0x4036dc
push 3
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], eax
call fcn.0040a572
mov eax, dword [ebp - 0x80]
lea ecx, [eax + esi]
cmp ecx, eax
jb 0x4036dc
push 2
pop edi
mov dword [ebp - 0x80], ecx
lea ecx, [ebp - 0x80]
push edi
call fcn.0040a572
mov esi, dword [ebp - 0x80]
xor ecx, ecx
mov eax, esi
mul edi
cmp edx, ecx
ja 0x4036dc
jb 0x402cee
cmp eax, 0xffffffff
ja 0x4036dc
mov ecx, eax
call fcn.00401cbf
mov ecx, dword [ebp - 0x78]
mov edi, eax
call fcn.0040bd8c
add eax, 7
mov dword [ebp - 0x7c], eax
lea ecx, [eax + eax]
call fcn.00401cbf
mov edx, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0xc8], eax
call fcn.0040a0e2
mov dword [ebp - 0xe8], eax
xor eax, eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xc8], eax
je 0x4035ab
test edi, edi
je 0x4035c7
mov eax, dword [ebp - 0x78]
mov edx, 0x851
mov dword [ebp - 0xa8], eax
mov ecx, 0x170a8ce
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xb0]
push eax
push str.FActivateWithDde:
push 0x64
mov dword [ebp - 0xac], str.Param
call fcn.00401c18
push dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xc8]
mov edx, 0x437434
call fcn.0040bfdc
push dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc8]
call fcn.0040c02b
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 0x88]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x9c]
call fcn.0040c5c8
test eax, eax
jne 0x4035ab
mov eax, dword [ebp - 0x84]
cmp eax, 0xffffffff
je 0x40342e
cmp eax, 0xa
mov eax, dword [ebp + 0x10]
jae 0x402e1c
test eax, eax
je 0x402e1c
mov ecx, dword [ebp - 0x90]
call fcn.00402b17
test eax, eax
jne 0x402e13
imul ecx, dword [ebp - 0x84], 0x30
mov ecx, dword [ecx + 0x437ff8]
call fcn.00402abe
test eax, eax
je 0x402e19
xor edx, edx
mov eax, edx
jmp 0x402e1e
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x84]
cmp ecx, 0xa
jae 0x40342e
test eax, eax
je 0x40342e
imul eax, ecx, 0x30
mov dword [ebp - 0x9c], eax
mov eax, dword [eax + 0x437fe4]
mov dword [ebp - 0x7c], eax
cmp word [eax], dx
jne 0x402e6a
mov ecx, dword [ebp - 0x88]
call fcn.004036e2
mov dword [ebp - 0xec], eax
test eax, eax
je 0x4035ab
mov dword [ebp - 0x7c], eax
xor edx, edx
push edx
push 0x10
push 0x401fad
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.USER32.dll_DdeInitializeW]
test eax, eax
jne 0x4035ab
push 0x4b0
push dword [ebp - 0x7c]
push dword [ebp - 0x94]
call dword [sym.imp.USER32.dll_DdeCreateStringHandleW]
mov dword [ebp - 0xf4], eax
test eax, eax
je 0x40342e
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push dword [ebp - 0x94]
call dword [sym.imp.USER32.dll_DdeConnectList]
mov dword [ebp - 0xd4], eax
test eax, eax
je 0x40342e
mov ecx, dword [ebp - 0x78]
mov edx, 0x43829c
push 2
pop eax
mov dword [ebp - 0x7c], eax
call fcn.0040be84
test eax, eax
jne 0x402f07
mov ecx, dword [ebp - 0x78]
mov edx, str.OpenAsReadOnly
call fcn.0040be84
test eax, eax
jne 0x402f07
mov edx, dword [ebp - 0x9c]
mov ecx, edi
push esi
mov edx, dword [edx + 0x437ff4]
call fcn.0040bfdc
jmp 0x402f0c
xor eax, eax
mov word [edi], ax
xor edx, edx
mov eax, edi
mov ecx, edx
cmp word [edi], dx
je 0x402f20
lea eax, [eax + 2]
inc ecx
cmp word [eax], dx
jne 0x402f17
add ecx, ecx
mov dword [ebp - 0x78], ecx
cmp dword [ebp - 0xe8], edx
je 0x402f46
push esi
mov edx, str._Activate___1___
mov ecx, edi
call fcn.0040bfdc
mov dword [ebp - 0x78], 0x20
jmp 0x402ff5
test ecx, ecx
jne 0x402ff5
mov eax, dword [ebp - 0xc4]
mov edx, str.ddeexec
lea eax, [eax*2 + 0x208]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0xd0]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.0040c5c8
test eax, eax
jne 0x402ff0
cmp dword [ebp - 0xdc], 1
mov eax, dword [ebp - 0xd0]
jne 0x402f92
xor ecx, ecx
mov byte [edi], cl
lea ecx, [ebp - 0x78]
push ecx
push edi
lea ecx, [ebp - 0xdc]
push ecx
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402ff0
cmp dword [ebp - 0x8c], eax
je 0x40317f
xor edx, edx
mov ecx, edi
call fcn.0040c06a
mov dword [ebp - 0x98], eax
test eax, eax
je 0x402ff5
push esi
mov edx, eax
mov ecx, edi
call fcn.0040c02b
mov ecx, dword [ebp - 0x98]
call fcn.00401cf4
mov eax, dword [ebp - 0x78]
lea eax, [eax*2 - 2]
mov dword [ebp - 0x78], eax
jmp 0x402ff5
xor eax, eax
mov byte [ebp - 0x71], al
cmp dword [ebp - 0x8c], 0
je 0x40317f
mov edx, str.__1_
mov ecx, edi
call fcn.0040c0b1
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x403032
mov edx, 0x43758c
mov ecx, edi
call fcn.0040c0b1
mov dword [ebp - 0x98], eax
test eax, eax
je 0x40317f
mov esi, dword [ebp - 0x90]
push 0x22
pop edx
mov ecx, dword [esi + 0x10]
cmp word [ecx], dx
jne 0x403065
mov edx, dword [ebp - 0x8c]
push 0x22
pop esi
cmp word [ecx + edx*2 - 2], si
mov esi, dword [ebp - 0x90]
jne 0x403065
mov dword [ebp - 0xd8], 1
jmp 0x40306d
xor ecx, ecx
mov dword [ebp - 0xd8], ecx
push 4
pop ecx
push 0x22
pop edx
cmp word [eax], dx
mov edx, 0x851
push 2
pop eax
cmovne ecx, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
xor eax, eax
mov dword [ebp - 0x7c], ecx
mov word [ebp - 0xa4], ax
mov ecx, 0x170a8cf
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xac], str.Param
push eax
push str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 0x64
mov dword [ebp - 0xa8], edi
call fcn.00401c18
mov eax, dword [esi + 0x10]
mov edx, 0x851
mov dword [ebp - 0xa8], eax
mov ecx, 0x170a8d0
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xb0]
push eax
push str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 0x64
mov dword [ebp - 0xac], str.Param
call fcn.00401c18
mov esi, dword [esi + 0x10]
lea eax, [ebp - 0xf8]
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.0040a5a8
push dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x78]
push esi
push ecx
push dword [ebp - 0x98]
shr edx, 1
mov ecx, edi
push dword [eax]
call fcn.00403cd7
test eax, eax
je 0x4035ab
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa4], ax
mov edx, 0x851
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xac], str.Param
push eax
push edi
push 0xc8
mov ecx, 0x170a8d1
mov dword [ebp - 0xa8], str.DDE_Command
call fcn.00401c18
mov edx, str.__1_
mov ecx, edi
call fcn.0040c0b1
mov esi, eax
test esi, esi
jne 0x4031ac
mov edx, 0x43758c
mov ecx, edi
call fcn.0040c0b1
mov esi, eax
test esi, esi
jne 0x4031ac
xor ecx, ecx
mov al, cl
jmp 0x403426
push 0x22
pop eax
cmp word [esi], ax
mov edx, 0x851
mov eax, dword [ebp - 0x7c]
push 4
pop ecx
cmove eax, ecx
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x7c], eax
mov ecx, 0x170a8d2
xor eax, eax
mov dword [ebp - 0xac], str.Param
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xb0]
push eax
push str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 0x64
mov dword [ebp - 0xa8], edi
call fcn.00401c18
mov eax, dword [ebp - 0xe0]
mov edx, 0x851
mov dword [ebp - 0xa8], eax
mov ecx, 0x170a8d3
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xb0]
push eax
push str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 0x64
mov dword [ebp - 0xac], str.Param
call fcn.00401c18
push ecx
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x80]
call fcn.0040a5a8
mov edx, dword [ebp - 0x78]
xor ecx, ecx
push ecx
push dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x7c]
push ecx
push esi
push dword [eax]
shr edx, 1
mov ecx, edi
add edx, dword [ebp - 0x8c]
call fcn.00403cd7
test eax, eax
je 0x4035ab
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa4], ax
mov edx, 0x851
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xac], str.Param
push eax
push edi
push 0xc8
mov ecx, 0x170a8d4
mov dword [ebp - 0xa8], str.DDE_Command
call fcn.00401c18
mov al, byte [ebp - 0x71]
test al, al
je 0x40342e
mov ecx, dword [ebp - 0x84]
or eax, 0xffffffff
cmp ecx, 1
mov edx, 0xbb8
cmove eax, edx
mov dword [ebp - 0xd8], eax
xor eax, eax
push eax
push dword [ebp - 0xd4]
call dword [sym.imp.USER32.dll_DdeQueryNextServer]
mov esi, eax
test esi, esi
je 0x4033ae
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0xc4]
add eax, eax
mov dword [ebp - 0x98], eax
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa4], ax
mov edx, 0x851
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xac], str.Param
push eax
push str.FActivateWithDde:_Before_HevDdeClientTransaction_with
push 0x64
mov ecx, 0x170a8d5
mov dword [ebp - 0xa8], edi
call fcn.00401c18
call fcn.0040d61d
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x78]
add ecx, 2
add eax, ecx
xor ecx, ecx
push ecx
push dword [ebp - 0xd8]
push 0x4050
push ecx
push ecx
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_DdeClientTransaction]
mov dword [ebp - 0xf0], eax
test eax, eax
jne 0x4033ab
cmp dword [ebp - 0x84], 1
je 0x4033ab
push esi
push dword [ebp - 0xd4]
call dword [sym.imp.USER32.dll_DdeQueryNextServer]
mov esi, eax
test esi, esi
jne 0x403313
jmp 0x4033ae
xor ebx, ebx
inc ebx
test ebx, ebx
je 0x403423
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
cmp dword [eax + 0x438000], ecx
je 0x403423
push 0x60
push ecx
lea eax, [ebp - 0x70]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x70], 0x60
lea eax, [ebp - 0x70]
push eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_DdeQueryConvInfo]
mov esi, dword [ebp - 0x14]
jmp 0x4033f3
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x4033ea
cmp dword [ebp - 0x14], eax
je 0x403423
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x403417
push 9
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040d61d
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, byte [ebp - 0x71]
test al, al
jne 0x4035ab
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x9c], 0x208
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x88]
mov edx, str.command
call fcn.0040c5c8
test eax, eax
jne 0x4035ab
cmp dword [ebp - 0xdc], 1
mov eax, dword [ebp - 0xcc]
jne 0x403470
xor ecx, ecx
mov byte [edi], cl
lea ecx, [ebp - 0x9c]
push ecx
push edi
lea ecx, [ebp - 0xdc]
push ecx
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4035ab
mov word [ebp - 0xa4], ax
mov esi, vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], esi
push eax
push str.FActivateWithDde:_Before_FSimpleSpawn_with
push 0x64
mov edx, 0x851
mov dword [ebp - 0xac], str.Param
mov ecx, 0x170a8d6
mov dword [ebp - 0xa8], edi
call fcn.00401c18
xor eax, eax
mov dword [ebp - 0xb0], esi
mov esi, dword [ebp - 0xe0]
mov edx, 0x851
mov word [ebp - 0xa4], ax
mov ecx, 0x170a8d7
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xac], str.Param
push eax
push str.FActivateWithDde:_Before_FSimpleSpawn_with
push 0x64
mov dword [ebp - 0xa8], esi
call fcn.00401c18
mov edx, dword [ebp - 0x84]
push 4
pop eax
cmp edx, eax
jne 0x403565
call fcn.0040a387
mov dword [ebp - 0xe4], eax
test eax, eax
je 0x4035ab
push 0x208
mov edx, edi
mov ecx, eax
call fcn.0040c02b
mov eax, dword [ebp - 0x90]
xor edx, edx
test eax, eax
je 0x40354e
mov ecx, dword [eax + 0x14]
jmp 0x403550
mov ecx, edx
test eax, eax
je 0x403559
mov eax, dword [eax + 0x10]
jmp 0x40355b
mov eax, edx
push ecx
push ecx
mov ecx, dword [ebp - 0xe4]
jmp 0x403597
mov eax, dword [ebp - 0x90]
xor ebx, ebx
test eax, eax
je 0x403576
mov ecx, dword [eax + 0x14]
jmp 0x403578
mov ecx, ebx
test eax, eax
je 0x403581
mov eax, dword [eax + 0x10]
jmp 0x403583
mov eax, ebx
cmp edx, 2
jne 0x403593
cmp dword [ebp - 0xe8], 0
je 0x403593
mov esi, ebx
push ecx
push ecx
mov ecx, edi
push eax
push dword [ebp - 0xc4]
mov edx, esi
call fcn.00403948
neg eax
sbb ebx, ebx
neg ebx
test edi, edi
je 0x4035b6
mov ecx, edi
call fcn.00401cf4
mov eax, dword [ebp - 0xec]
test eax, eax
je 0x4035c7
mov ecx, eax
call fcn.00401cf4
mov esi, dword [ebp - 0xc8]
test esi, esi
je 0x4035d8
mov ecx, esi
call fcn.00401cf4
mov eax, dword [ebp - 0xe4]
test eax, eax
je 0x4035e9
mov ecx, eax
call fcn.00401cf4
mov eax, dword [ebp - 0xf0]
test eax, eax
je 0x4035fa
push eax
call dword [sym.imp.USER32.dll_DdeFreeDataHandle]
mov eax, dword [ebp - 0xf4]
test eax, eax
je 0x403611
push eax
push dword [ebp - 0x94]
call dword [sym.imp.USER32.dll_DdeFreeStringHandle]
mov eax, dword [ebp - 0xd4]
test eax, eax
je 0x403622
push eax
call dword [sym.imp.USER32.dll_DdeDisconnectList]
cmp dword [ebp - 0x94], 0
je 0x403637
push dword [ebp - 0x94]
call dword [sym.imp.USER32.dll_DdeUninitialize]
xor eax, eax
mov dword [ebp - 0xb0], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 0xa4], ax
mov edx, 0x851
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xac], str.Param
push eax
push str.FActivateWithDde_
push 0x64
mov ecx, 0x170a8d8
mov dword [ebp - 0xa8], ebx
call fcn.00401c18
cmp dword [ebp - 0xcc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40368e
push dword [ebp - 0xcc]
call esi
xor eax, eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0x88], eax
je 0x4036a8
push dword [ebp - 0x88]
call esi
xor eax, eax
cmp dword [ebp - 0xd0], 0
mov dword [ebp - 0x88], eax
je 0x4036c1
push dword [ebp - 0xd0]
call esi
xor eax, eax
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0xd0], eax
call fcn.00415566
mov eax, ebx
call fcn.00432ea2
ret 0xc
call fcn.00401ca9
int3