Function at 0x403050
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov al, byte [0x410030]
sub esp, 0x3fc
test al, al
push esi
je 0x4030a2
mov esi, dword [esp + 0x404]
mov al, 1
test esi, esi
jne 0x40306f
xor al, al
mov ecx, dword [esp + 0x408]
test ecx, ecx
jne 0x40307c
xor al, al
mov ecx, dword [esp + 0x40c]
test ecx, ecx
jne 0x403089
xor al, al
mov ecx, dword [esp + 0x410]
test ecx, ecx
je 0x403098
test al, al
jne 0x4030a9
xor al, al
pop esi
add esp, 0x3fc
ret
mov esi, dword [esp + 0x404]
lea eax, [esp + 8]
push ebx
push eax
push 0xf003f
push 0
push esi
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4032e4
mov ecx, dword [esp + 0x418]
mov edx, dword [esp + 0x40c]
push ebp
push edi
push ecx
push edx
push esi
call fcn.00403450
mov bl, al
add esp, 0xc
test bl, bl
je 0x40315d
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x41c]
not ecx
dec ecx
cmp eax, ecx
jbe 0x40315b
lea eax, [esp + 0x10]
lea ecx, [esp + 0x218]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.Driver
push eax
mov dword [esp + 0x28], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40315b
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x418]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4032d7
xor bl, bl
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x24]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410278
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x1f4
sub eax, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
push ecx
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebp
push ebp
push edx
lea eax, [esp + ecx + 0x38]
mov ecx, dword [esp + 0x28]
push eax
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4032d7
mov edx, dword [esp + 0x420]
mov eax, dword [esp + 0x41c]
mov ecx, dword [esp + 0x418]
push edx
mov edx, dword [esp + 0x418]
push eax
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00403050
mov bl, al
add esp, 0x14
test bl, bl
jne 0x4032d7
mov edi, dword [esp + 0x410]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x410278
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x1f4
sub eax, ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
push ecx
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
inc ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
push 0
push 0
lea eax, [esp + ecx + 0x34]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4031fb
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
mov al, bl
pop ebx
pop esi
add esp, 0x3fc
ret