Function at 0x4028c1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
xor esi, esi
mov dword [ebp - 8], ebx
push edi
push 0x4023ec
push dword [ebp + 0x10]
call fcn.0040255e
test eax, eax
je 0x4028f3
mov esi, edi
mov dword [ebp - 8], edi
jmp 0x4028da
push edi
push 0x4023e4
push dword [ebp + 0x10]
call fcn.0040255e
test eax, eax
je 0x402909
mov esi, edi
jmp 0x4028da
push edi
push 0x4023dc
push dword [ebp + 0x10]
call fcn.0040255e
test eax, eax
je 0x402920
mov dword [ebp - 4], edi
jmp 0x4028da
push 0x4023cc
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x402934
mov esi, edi
mov dword [ebp - 8], edi
cmp esi, ebx
jne 0x402abe
push ebx
push ebx
push 0x4021c0
push 0x402178
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueA]
test eax, eax
jne 0x402abe
call dword [sym.imp.SHLWAPI.dll_WhichPlatform]
cmp eax, 2
jne 0x402abe
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x402abe
mov eax, dword [ebp + 0x14]
push 0x109c
push 0x40
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x402b21
mov esi, dword [ebp + 0x10]
push 0x824
push edi
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004024e8
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x402ab1
cmp byte [esi], bl
mov dword [ebp + 0x10], ebx
jne 0x4029dc
call fcn.004025b9
test eax, eax
je 0x4029ed
cmp dword [ebp - 4], ebx
jne 0x4029ed
lea eax, [ebp - 0x1c]
push eax
call fcn.004024e8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jne 0x4029ff
cmp byte [esi], bl
je 0x4029ff
cmp dword [ebp - 4], ebx
je 0x402a9c
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
push 0x4a
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
mov dword [ebp + 0x14], ebx
je 0x402a99
push 0x2710
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], ebx
je 0x402a99
push dword [ebp + 8]
call fcn.004025f6
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 8], eax
push 0xff
push 0xffffffffffffffff
lea eax, [ebp + 0x10]
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp edi, ebx
jne 0x402a68
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
call esi
test eax, eax
je 0x402a95
cmp dword [ebp - 0x34], 0x12
je 0x402a93
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x402a68
xor edi, edi
cmp edi, ebx
jne 0x402a45
mov edi, dword [ebp + 0x14]
cmp dword [ebp + 0x10], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x402aac
push dword [ebp + 0x10]
call esi
push dword [ebp - 8]
call esi
cmp edi, ebx
je 0x402b21
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x402b21
call fcn.0040275f
cmp dword [ebp - 8], ebx
je 0x402b13
push dword [ebp + 8]
call fcn.004026ba
call fcn.0040266f
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4023bc
call esi
push 0x4023ac
call esi
push 0x4023a0
call esi
push 0x402394
call esi
push 0x402388
call esi
push 0x40237c
call esi
push 0x402370
call esi
push 0x402364
call esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004023f4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10