Function at 0x402fb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x498
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x24], 2
jne 0x403177
mov ebx, dword [esp + 0x4ac]
cmp ebx, 0x80000002
jne 0x403158
mov edi, dword [esp + 0x4b0]
mov esi, str.SOFTWARETrident_MicrosystemsDevice_Control_
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40301d
test cl, cl
je 0x403019
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40301d
add eax, 2
add esi, 2
test cl, cl
jne 0x402ff9
xor eax, eax
jmp 0x403022
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40304d
mov edi, str.SOFTWARETrident_MicrosystemsDevice_Control_
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xa8]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x4032e1
mov esi, str.SystemCurrentControlSetServicesClassDisplay_
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403078
test cl, cl
je 0x403074
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403078
add eax, 2
add esi, 2
test cl, cl
jne 0x403054
xor eax, eax
jmp 0x40307d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40311e
lea eax, [esp + 0xa8]
push 0x400
push eax
call fcn.004037e0
add esp, 8
test eax, eax
je 0x403369
mov ebp, dword [esp + 0x4b4]
mov esi, str.UTILITY
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4030d4
test cl, cl
je 0x4030d0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4030d4
add eax, 2
add esi, 2
test cl, cl
jne 0x4030b0
xor eax, eax
jmp 0x4030d9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4032e6
mov edi, 0x42324c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xa8]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xa8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
jmp 0x4032c1
mov esi, str.SystemCurrentControlSetServicesClassMonitor_
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403261
test cl, cl
je 0x40325d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403261
add eax, 2
add esi, 2
test cl, cl
jne 0x403125
xor eax, eax
jmp 0x403266
cmp ebx, 0x80000001
jne 0x403369
mov edi, dword [esp + 0x4b0]
lea edx, [esp + 0xa8]
jmp 0x403296
mov ebp, dword [esp + 0x4b0]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xa8]
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebx, dword [esp + 0x4ac]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp ebx, 0x80000002
rep movsb byte es:[edi], byte [esi]
jne 0x403281
mov esi, str.SystemCurrentControlSetServicesClassDisplay_
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4031e2
test cl, cl
je 0x4031de
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4031e2
add eax, 2
add esi, 2
test cl, cl
jne 0x4031be
xor eax, eax
jmp 0x4031e7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403236
lea eax, [esp + 0xa8]
push 0x400
push eax
call fcn.004037e0
add esp, 8
test eax, eax
je 0x403369
mov edi, 0x42324c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xa8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
jmp 0x4032ae
mov esi, str.SystemCurrentControlSetServicesClassMonitor_
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x403261
test cl, cl
je 0x40325d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x403261
add eax, 2
add esi, 2
test cl, cl
jne 0x40323d
xor eax, eax
jmp 0x403266
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4032e6
lea eax, [esp + 0xa8]
push 0x400
push eax
call fcn.00403860
add esp, 8
jmp 0x4032e6
cmp ebx, 0x80000001
jne 0x403369
lea edx, [esp + 0xa8]
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea edx, [esp + 0xa8]
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x4b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xa8]
push eax
push 0xf003f
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403369
mov edx, dword [esp + 0x4c0]
mov eax, dword [esp + 0x4bc]
push edx
mov edx, dword [esp + 0x4bc]
lea ecx, [esp + 0x4c8]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40334e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x498
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x498
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x498
ret