Function at 0x402da0
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
sub esp, 0x14
mov esi, ecx
mov ecx, esi
push 0x41a40c
push 0x41a404
call fcn.00403310
mov ecx, esi
call fcn.004031fc
mov dword [esp + 4], 1
lea eax, [esp]
mov edx, 0x80000002
mov dword [esp], edx
push eax
push 0xf003f
push 0
push 0x41a418
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
lea eax, [esp + 4]
push eax
xor ecx, ecx
push edx
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x41a424
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 8]
lea eax, [esp + 4]
push eax
xor ecx, ecx
push edx
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x41a42c
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a438
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402e64
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
setne dl
mov byte [esi + 4], dl
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a440
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402e97
mov eax, dword [esp + 0x10]
mov dword [esi + 0x7e0], eax
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a450
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402ed1
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
setne dl
mov byte [esi + 0x3ed], dl
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a460
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402f0b
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
setne dl
mov byte [esi + 0x3ee], dl
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a474
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402f3e
mov eax, dword [esp + 0x10]
mov dword [esi + 0x3f0], eax
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a484
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402f78
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
setne dl
mov byte [esi + 0x3f4], dl
mov dword [esp + 0xc], 4
lea edx, [esp + 0x10]
xor ecx, ecx
lea eax, [esp + 0xc]
push eax
push edx
push ecx
push ecx
push 0x41a498
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402fb2
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
setne dl
mov byte [esi + 0x3f5], dl
mov dword [esp + 0xc], 0x3e8
lea eax, [esp + 0xc]
xor ecx, ecx
lea edx, [esi + 0x3f6]
push eax
push edx
push ecx
push ecx
push 0x41a4ac
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0xc], 0x578
lea eax, [esp + 0xc]
xor edx, edx
add esi, 0x7e4
push eax
push esi
push edx
push edx
push 0x41a4c0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x14
pop esi
ret