Function at 0x402495
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x20], 4
and dword [ebp - 0x1c], 0
and dword [ebp - 8], 0
call sym.NPROTECT.EXE__NPSystemGetWindowsType_0
cmp eax, 2
jne 0x4024c2
xor eax, eax
jmp 0x402736
push 0
push dword [0x422044]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4024e2
cmp dword [ebp - 0x18], 0x102
jne 0x4024e7
jmp 0x402734
lea eax, [ebp - 0x28]
push eax
push 1
push 0
push str.SoftwareSymantecNorton_UtilitiesNorton_UnEraseStateIcons
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40251a
push str.IconUpdateInternal:No_ICON_registry_present
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov byte [0x41b0cc], 2
jmp 0x40272f
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.NPShield
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402563
cmp dword [ebp - 0x14], 0
jne 0x402563
push str.IconUpdateInternal:Icon_registry_present_turned_off
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
call fcn.004027b9
mov byte [0x41b0cc], al
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40272a
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040a1c2
pop ecx
pop ecx
test eax, eax
je 0x40259f
push dword [0x422044]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [0x41b0cc], 2
jmp 0x402728
call fcn.004027b9
mov byte [ebp - 4], al
cmp dword [0x41b0c4], 0
je 0x4025c0
mov byte [0x41b0cc], 2
and dword [0x41b0c4], 0
jmp 0x4025ca
call fcn.00409dfc
mov byte [0x41b0cc], al
cmp dword [ebp - 0x24], 0
je 0x4025e9
cmp dword [ebp - 0x10], 0
je 0x4025e9
movzx eax, byte [ebp - 4]
movzx ecx, byte [0x41b0cc]
cmp eax, ecx
je 0x4026a2
push 0x41b814
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jbe 0x402678
push str.UpdateIconState
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x402652
call fcn.004027b9
mov byte [ebp - 4], al
movzx eax, byte [ebp - 4]
movzx ecx, byte [0x41b0cc]
cmp eax, ecx
je 0x402650
push dword [ebp - 4]
call dword [ebp - 0x2c]
test eax, eax
je 0x402650
push str.IconUpdateInternal:pfnUpdateIconState___NOERR
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov eax, dword [0x422088]
inc eax
mov dword [0x422088], eax
jmp 0x402726
jmp 0x40266d
push str.IconUpdateInternal::GetProcAddress_failed
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov eax, dword [0x422088]
inc eax
mov dword [0x422088], eax
jmp 0x402724
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402693
push str.IconUpdateInternal::LoadLibrary_failed
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
mov eax, dword [0x422088]
inc eax
mov dword [0x422088], eax
jmp 0x402722
mov al, byte [ebp - 4]
mov byte [0x41b0cc], al
mov dword [ebp - 0x1c], 1
and dword [0x422088], 0
push dword [0x422044]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00402738
mov eax, dword [ebp - 0x1c]
jmp 0x402736
push str.IconUpdateInternal:_Failure_
call sym.NPROTECT.EXE_int___cdecl_dprintf_char__
pop ecx
cmp dword [ebp - 8], 0
je 0x4026d9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
or byte [0x41b0cc], 0xff
cmp dword [0x422088], 5
jl 0x402711
call fcn.00402738
push 0
push 0x802
call fcn.00404ab4
pop ecx
pop ecx
push dword [0x422044]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
and dword [0x422088], 0
jmp 0x40271d
push dword [0x422044]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 0x1c]
jmp 0x402736
jmp 0x4026bf
jmp 0x4026bf
jmp 0x4026bf
jmp 0x4026ba
jmp 0x4026a2
jmp 0x4026a2
jmp 0x4026ba
leave
ret