Function at 0x4042d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4811c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x408]
push edi
mov edi, dword [ebp + 0xc]
push eax
push 0x20219
push 0
mov dword [esi], 0
push dword [0x481084]
mov dword [ebp - 0x408], 0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x404343
test edi, edi
je 0x40432e
push 1
push str.getInstalledManifestOwners::_Failed_to_open_syscore_installation_registry_key
call edi
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042111c
mov esp, ebp
pop ebp
ret 8
xor ebx, ebx
lea eax, [ebp - 0x204]
push 0x1fe
push ebx
push eax
mov dword [ebp - 0x414], ebx
call fcn.00423060
push 0x1fe
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.00423060
add esp, 0x18
jmp 0x404380
lea eax, [ebp - 0x410]
mov dword [ebp - 0x410], 0x1fe
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x40c], 0xff
push eax
lea eax, [ebp - 0x414]
push eax
push 0
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
inc ebx
test edi, edi
jne 0x4047ac
cmp dword [ebp - 0x40c], eax
je 0x404380
cmp word [ebp - 0x204], 0x7b
jne 0x404380
lea eax, [ebp - 0x204]
push eax
push dword [0x481044]
call fcn.00440675
add esp, 8
test eax, eax
je 0x4047a4
lea eax, [ebp - 0x204]
push eax
push dword [0x48102c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x4047a4
lea eax, [ebp - 0x204]
push eax
push dword [0x481048]
call fcn.00440675
add esp, 8
test eax, eax
je 0x4047a4
lea eax, [ebp - 0x204]
push eax
push dword [0x48106c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x4047a4
lea eax, [ebp - 0x204]
push eax
push dword [0x481078]
call fcn.00440675
add esp, 8
test eax, eax
je 0x4047a4
lea eax, [ebp - 0x204]
push eax
push dword [0x48100c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x40479c
lea eax, [ebp - 0x204]
push eax
push dword [0x481070]
call fcn.00440675
add esp, 8
test eax, eax
je 0x40479c
lea eax, [ebp - 0x204]
push eax
push dword [0x481074]
call fcn.00440675
add esp, 8
test eax, eax
je 0x40479c
lea eax, [ebp - 0x204]
push eax
push dword [section..data]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481004]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481008]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481010]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481014]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481018]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x48101c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481020]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481024]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481028]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481030]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481034]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481038]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x48103c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481040]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x48104c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481050]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481054]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481058]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x48105c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481060]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481064]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481068]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x48107c]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
lea eax, [ebp - 0x204]
push eax
push dword [0x481080]
call fcn.00440675
add esp, 8
test eax, eax
je 0x404794
or dword [esi], 1
jmp 0x404380
or dword [esi], 0xa
jmp 0x404380
or dword [esi], 2
jmp 0x404380
or dword [esi], 6
jmp 0x404380
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
lea eax, [edi - 0x103]
neg eax
sbb eax, eax
xor ecx, ebp
and eax, edi
pop edi
pop esi
pop ebx
call fcn.0042111c
mov esp, ebp
pop ebp
ret 8