Function at 0x402188
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa64
mov eax, dword [0x421130]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push ebx
push edi
mov dword [ebp - 0x59c], eax
xor ebx, ebx
push 0x3e8
mov word [ebp - 0x580], bx
lea eax, [ebp - 0x57e]
xor ebx, ebx
push ebx
push eax
call fcn.004087d0
mov edi, 0xc6
push edi
xor eax, eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push ebx
push eax
call fcn.004087d0
push edi
xor eax, eax
mov word [ebp - 0x194], ax
push ebx
lea eax, [ebp - 0x192]
push eax
call fcn.004087d0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x24
mov esi, GetStdHandle
lea eax, [ebp - 0x588]
push eax
push esi
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x58c], 0xc8
mov dword [ebp - 0x588], ebx
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x598], ebx
mov dword [ebp - 0x594], ebx
call edi
or eax, eax
je 0x402247
xor eax, eax
jmp 0x402460
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x594]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x588]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
or eax, eax
je 0x402276
push dword [ebp - 0x588]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402240
mov eax, dword [ebp - 0x594]
dec eax
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x590], eax
cmp eax, ebx
jl 0x402433
lea eax, [ebp - 0x580]
push 0x1f4
push eax
push dword [ebp - 0x590]
push dword [ebp - 0x588]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea eax, [ebp - 0x584]
push eax
push esi
lea eax, [ebp - 0x580]
push ebx
push eax
push dword [ebp - 0x588]
mov dword [ebp - 0x584], ebx
call edi
cmp eax, ebx
jne 0x4023fe
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0xcc]
push eax
push ebx
push ebx
push str.ComponentId
push dword [ebp - 0x584]
mov dword [ebp - 0x58c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xcc]
push str.neo_SVPadapter
push eax
call fcn.0040a1de
pop ecx
pop ecx
or eax, eax
jne 0x4023cf
lea eax, [ebp - 0xcc]
push 0xc8
push ebx
push eax
call fcn.004087d0
lea eax, [ebp - 0x58c]
add esp, 0xc
push eax
lea eax, [ebp - 0xcc]
push eax
push ebx
push ebx
push str.NetCfgInstanceId
push dword [ebp - 0x584]
mov dword [ebp - 0x58c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x584]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x584]
push eax
push esi
push ebx
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x584], ebx
call edi
test eax, eax
jne 0x402268
lea eax, [ebp - 0x598]
push eax
push esi
lea eax, [ebp - 0xcc]
push ebx
push eax
push dword [ebp - 0x584]
call edi
or eax, eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x194]
push eax
je 0x40240c
call fcn.0040888a
pop ecx
pop ecx
push dword [ebp - 0x584]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x584], ebx
jmp 0x4023fe
cmp dword [ebp - 0x584], ebx
je 0x4023e3
push dword [ebp - 0x584]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x580]
push 0x3ea
push ebx
push eax
mov dword [ebp - 0x584], ebx
call fcn.004087d0
sub esp, 0xfffffff4
dec dword [ebp - 0x590]
jns 0x402291
jmp 0x40241f
call fcn.0040888a
pop ecx
pop ecx
push dword [ebp - 0x598]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x584], ebx
je 0x402433
push dword [ebp - 0x584]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x588]
mov dword [ebp - 0x584], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
lea eax, [ebp - 0x194]
push eax
push dword [ebp - 0x59c]
call fcn.0040a269
xor eax, eax
sub esp, 0xfffffff4
inc eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
call fcn.0040884a
leave
ret