Function at 0x403610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43d288]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x43f460], 0
push esi
push edi
jne 0x403c84
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.SoftwareWTware
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403cb6
push 0x200
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 8], 1
call fcn.0041a9be
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push str.Programs
push dword [ebp - 0x10]
call edi
test eax, eax
je 0x4036af
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x200
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4318c0
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x403cb6
cmp word [esi], 0
jne 0x4036b9
xor ecx, ecx
jmp 0x4036cf
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4036c0
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, 0x43f464
call fcn.00404040
cmp dword [0x43f478], 8
mov ecx, 0x43f464
mov eax, dword [0x43f474]
cmovae ecx, dword [0x43f464]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x40370a
push 0x4318c4
mov ecx, 0x43f464
call fcn.00402f80
push esi
call fcn.0041b379
add esp, 4
lea ecx, [ebp - 0x28]
mov edx, 0x43f464
push 0x4318c8
call fcn.004030d0
mov esi, eax
add esp, 4
cmp esi, 0x43f494
je 0x403770
cmp dword [0x43f4a8], 8
jb 0x403749
push dword [0x43f494]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [0x43f4a8], 7
push esi
mov ecx, 0x43f494
mov dword [0x43f4a4], 0
mov word [0x43f494], ax
call fcn.00402fd0
cmp dword [ebp - 0x14], 8
jb 0x403781
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.skin_
mov edx, 0x43f494
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov esi, eax
add esp, 4
cmp esi, 0x43f4ac
je 0x4037de
cmp dword [0x43f4c0], 8
jb 0x4037b7
push dword [0x43f4ac]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [0x43f4c0], 7
push esi
mov ecx, 0x43f4ac
mov dword [0x43f4bc], 0
mov word [0x43f4ac], ax
call fcn.00402fd0
cmp dword [ebp - 0x14], 8
jb 0x4037ef
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Data_
mov edx, 0x43f464
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov esi, eax
add esp, 4
cmp esi, 0x43f4c4
je 0x40384c
cmp dword [0x43f4d8], 8
jb 0x403825
push dword [0x43f4c4]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [0x43f4d8], 7
push esi
mov ecx, 0x43f4c4
mov dword [0x43f4d4], 0
mov word [0x43f4c4], ax
call fcn.00402fd0
cmp dword [ebp - 0x14], 8
jb 0x40385d
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Docs_
mov edx, 0x43f464
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov esi, eax
add esp, 4
cmp esi, 0x43f4dc
je 0x4038ba
cmp dword [0x43f4f0], 8
jb 0x403893
push dword [0x43f4dc]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [0x43f4f0], 7
push esi
mov ecx, 0x43f4dc
mov dword [0x43f4ec], 0
mov word [0x43f4dc], ax
call fcn.00402fd0
cmp dword [ebp - 0x14], 8
jb 0x4038cb
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.TFTPDROOT_
mov edx, 0x43f464
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov esi, eax
add esp, 4
cmp esi, 0x43f4f4
je 0x403928
cmp dword [0x43f508], 8
jb 0x403901
push dword [0x43f4f4]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [0x43f508], 7
push esi
mov ecx, 0x43f4f4
mov dword [0x43f504], 0
mov word [0x43f4f4], ax
call fcn.00402fd0
cmp dword [ebp - 0x14], 8
jb 0x403939
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Wizard_
mov edx, 0x43f4c4
lea ecx, [ebp - 0x28]
call fcn.004030d0
mov esi, eax
add esp, 4
cmp esi, 0x43f50c
je 0x403996
cmp dword [0x43f520], 8
jb 0x40396f
push dword [0x43f50c]
call fcn.0041ac27
add esp, 4
xor eax, eax
mov dword [0x43f520], 7
push esi
mov ecx, 0x43f50c
mov dword [0x43f51c], 0
mov word [0x43f50c], ax
call fcn.00402fd0
cmp dword [ebp - 0x14], 8
jb 0x4039a7
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push 0x200
mov dword [ebp - 0xc], 0x200
mov dword [ebp - 8], 1
call fcn.0041a9be
add esp, 4
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push str.Data
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x403cb6
push esi
mov ecx, 0x43f47c
call fcn.00403ed0
cmp dword [0x43f490], 8
mov ecx, 0x43f47c
mov eax, dword [0x43f48c]
cmovae ecx, dword [0x43f47c]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x403a1b
push 0x4318c4
mov ecx, 0x43f47c
call fcn.00402f80
push str.Connections_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f524
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403a4c
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Everyone_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f53c
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403a7d
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Logs_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f56c
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403aae
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Templates_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f584
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403adf
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Terminals_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f59c
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403b10
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Keys_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f554
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403b41
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.DHCP_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f5b4
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403b72
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Audit_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f5cc
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403ba3
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Graphic_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f5e4
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403bd4
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.Chrome_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f5fc
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403c05
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.VLC_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f614
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403c36
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push str.UpdateImages_
mov edx, 0x43f47c
lea ecx, [ebp - 0x28]
call fcn.004030d0
add esp, 4
mov ecx, 0x43f62c
push eax
call fcn.00401d50
cmp dword [ebp - 0x14], 8
jb 0x403c67
push dword [ebp - 0x28]
call fcn.0041ac27
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x403c96
push esi
call fcn.0041b379
add esp, 4
mov byte [0x43f460], 1
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret
call fcn.0041aa5e
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x54
push str.....common_fileio.cpp
push str.ERROR
call fcn.004161a0
add esp, 0x14
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.0041aa1b
mov esp, ebp
pop ebp
ret