Function at 0x403730
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x424], ecx
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x414], ecx
nop
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x404]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4039b2
lea eax, [ebp - 0x410]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40398a
mov esi, dword [ebp - 0x410]
xor edi, edi
mov dword [ebp - 0x408], esi
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x403962
lea eax, [ebp - 0x40c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x204]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403957
lea edx, [ebp - 0x204]
lea ecx, [ebp - 0x404]
call fcn.00402ea0
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x424]
mov esi, eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [esi + 0x14], eax
mov edx, dword [ebp - 0x40c]
call fcn.004034e0
add esp, 8
mov edi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x67
jne 0x4038d2
push dword [esi + 0xc]
call fcn.0040f3ca
push dword [esi + 0x10]
call fcn.0040f3ca
push dword [esi + 0x18]
call fcn.0040f3ca
push dword [esi + 0x1c]
call fcn.0040f3ca
push dword [esi + 0x20]
call fcn.0040f3ca
push dword [esi + 0x28]
call fcn.0040f3ca
mov ecx, dword [esi]
call fcn.00402fb0
mov ecx, dword [esi + 4]
mov dword [esi], 0
call fcn.00402fb0
push esi
mov dword [esi + 4], 0
call fcn.0040f3ca
mov esi, dword [ebp - 0x408]
add esp, 0x1c
xor edi, edi
inc ebx
jmp 0x4037d4
test edi, edi
jne 0x403951
mov ecx, dword [ebp - 0x428]
mov edx, esi
call fcn.00403160
mov edi, eax
test edi, edi
je 0x403951
push dword [esi + 0xc]
call fcn.0040f3ca
push dword [esi + 0x10]
call fcn.0040f3ca
push dword [esi + 0x18]
call fcn.0040f3ca
push dword [esi + 0x1c]
call fcn.0040f3ca
push dword [esi + 0x20]
call fcn.0040f3ca
push dword [esi + 0x28]
call fcn.0040f3ca
mov ecx, dword [esi]
call fcn.00402fb0
mov ecx, dword [esi + 4]
mov dword [esi], 0
call fcn.00402fb0
push esi
mov dword [esi + 4], 0
call fcn.0040f3ca
mov esi, dword [ebp - 0x408]
add esp, 0x1c
cmp edi, 0x6e
jne 0x403957
xor edi, edi
inc ebx
jmp 0x4037d4
mov esi, dword [ebp - 0x408]
inc ebx
test edi, edi
je 0x4037d4
jmp 0x403978
cmp eax, 0x103
je 0x403978
push str.Failed_to_read_installs__tags__from_the_registry
push 0
call fcn.004011c0
add esp, 8
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x414]
inc ecx
mov dword [ebp - 0x414], ecx
test edi, edi
je 0x403770
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405fcc
mov esp, ebp
pop ebp
ret
cmp eax, 0x103
je 0x4039c8
push str.Failed_to_read_distributors__company__from_the_registry
push 0
call fcn.004011c0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405fcc
mov esp, ebp
pop ebp
ret