Function at 0x401a70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
push ebx
push ebp
mov ebp, dword [esp + 0x128]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
xor esi, esi
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x401aef
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x401ace
mov edx, dword [0x4350bc]
add eax, 0xfffffff4
cmp eax, edx
je 0x401aef
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x401ac3
mov eax, dword [ebp]
sub eax, 0xc
push eax
call fcn.00426ac0
add esp, 4
mov ecx, dword [0x4350b8]
mov dword [ebp], ecx
jmp 0x401aef
mov edx, 0x43965c
test edx, edx
jne 0x401adb
xor eax, eax
jmp 0x401ae2
push 0x43965c
call ebx
push 0x43965c
push eax
mov ecx, ebp
call fcn.00401f40
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SOFTWARERisingRav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cdf
push edi
mov ecx, 0x41
lea edi, [esp + 0x25]
mov byte [esp + 0x24], al
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.installpath
push ecx
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401cc5
lea edx, [esp + 0x24]
test edx, edx
jne 0x401b65
xor ebx, ebx
jmp 0x401b6e
lea eax, [esp + 0x24]
push eax
call ebx
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00401e70
test eax, eax
je 0x401b9e
mov edi, dword [ebp]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov dword [eax - 8], ebx
mov ecx, dword [ebp]
mov byte [ecx + ebx], 0
mov eax, dword [ebp]
mov esi, 1
mov ecx, dword [eax - 8]
cmp ecx, esi
jge 0x401baf
mov esi, ecx
mov ecx, dword [0x4350b8]
mov dword [esp + 0x10], ecx
mov edi, dword [eax - 8]
sub edi, esi
test esi, esi
jne 0x401bc8
mov dword [esp + 0x10], ecx
jmp 0x401bef
push esi
lea ecx, [esp + 0x14]
call fcn.00401dd0
test eax, eax
je 0x401bef
mov ecx, esi
mov esi, dword [ebp]
mov edx, ecx
add esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call fcn.00401cf0
lea ecx, [esp + 0x10]
call fcn.00401f10
mov ecx, dword [esp + 0x14]
push 0x4351b8
push ecx
call fcn.00426d16
mov ecx, dword [0x4350bc]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x14]
sete bl
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x401c4c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x401c4c
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.00426ac0
add esp, 4
test bl, bl
je 0x401cc0
mov eax, dword [ebp]
mov ecx, dword [eax - 0xc]
mov ebx, dword [eax - 8]
lea esi, [eax - 0xc]
cmp ecx, 1
jle 0x401cb8
mov ecx, dword [0x4350bc]
add eax, 0xfffffff4
cmp eax, ecx
je 0x401c91
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x401c88
mov ecx, dword [ebp]
sub ecx, 0xc
push ecx
call fcn.00426ac0
add esp, 4
mov edx, dword [0x4350b8]
mov dword [ebp], edx
mov eax, dword [esi + 4]
mov ecx, ebp
push eax
call fcn.00401dd0
test eax, eax
je 0x401cb8
mov ecx, dword [esi + 4]
mov edi, dword [ebp]
inc ecx
add esi, 0xc
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov byte [eax + ebx - 1], 0
mov esi, 1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4