Function at 0x402563
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe58
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push str.MicrosoftUpdates
push dword [0x40ea60]
call fcn.004096c5
add esp, 0xc
test eax, eax
jne 0x402866
push 0x7f
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x12b]
push ebx
push eax
mov byte [ebp - 0x12c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x18], ebx
push ebx
jmp 0x402848
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x14]
call fcn.004096c5
add esp, 0xc
test eax, eax
jne 0x40283b
push esi
lea eax, [ebp - 0xab]
push ebx
push eax
mov byte [ebp - 0xac], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
mov dword [ebp - 0x24], ebx
push ebx
jmp 0x40281d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0x10]
call fcn.004096c5
add esp, 0xc
test eax, eax
jne 0x402810
mov esi, 0x3ff
push esi
lea eax, [ebp - 0xe53]
push ebx
push eax
mov byte [ebp - 0xe54], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xe54]
push eax
push str.Description
push dword [ebp - 8]
mov eax, esi
call fcn.004096df
add esp, 0xc
cmp byte [ebp - 0xe54], bl
je 0x40268c
lea esi, [ebp - 0xa54]
call fcn.0040199b
lea eax, [ebp - 0xac]
push eax
mov eax, 0x40b407
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00401d8a
test eax, eax
je 0x40268c
mov eax, dword [ebp + 8]
mov edi, esi
call fcn.00402546
push 0x7f
pop esi
push esi
lea eax, [ebp - 0x1ab]
push ebx
push eax
mov byte [ebp - 0x1ac], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1ac]
push eax
push ebx
push dword [ebp - 8]
mov dword [ebp - 0x20], ebx
jmp 0x4027f5
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x2c], ebx
call fcn.004096c5
add esp, 0xc
test eax, eax
jne 0x4027aa
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x28], ebx
jne 0x40279c
push esi
lea eax, [ebp - 0x22b]
push ebx
push eax
mov byte [ebp - 0x22c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov eax, esi
jmp 0x402790
lea eax, [ebp - 0x22c]
push str.filelist
push eax
call sub.msvcrt.dll__strcmpi
test eax, eax
pop ecx
pop ecx
je 0x40277d
lea esi, [ebp - 0xa54]
mov dword [ebp - 0x2c], 1
call fcn.0040199b
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x22c]
call fcn.00401d8a
test eax, eax
je 0x40277d
mov eax, dword [ebp + 8]
mov edi, esi
call fcn.00402546
inc dword [ebp - 0x1c]
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
push 0x7f
pop eax
call fcn.00409702
add esp, 0xc
test eax, eax
je 0x402726
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2c], ebx
jne 0x4027e2
lea esi, [ebp - 0xa54]
call fcn.0040199b
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x12c]
push eax
mov eax, 0x40b407
call fcn.00401d8a
test eax, eax
je 0x4027e2
mov eax, dword [ebp + 8]
mov edi, esi
call fcn.00402546
inc dword [ebp - 0x20]
lea eax, [ebp - 0x1ac]
push eax
push dword [ebp - 0x20]
push dword [ebp - 8]
push 0x7f
pop esi
mov eax, esi
call fcn.00409702
add esp, 0xc
test eax, eax
je 0x4026b9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x24]
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x10]
mov eax, esi
call fcn.00409702
add esp, 0xc
test eax, eax
je 0x4025ff
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x18]
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x14]
mov eax, esi
call fcn.00409702
add esp, 0xc
test eax, eax
je 0x4025ba
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4