Function at 0x4029e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x40
mov eax, 0x14
mov dword [esp + 4], eax
push ebx
lea ecx, [esp + 4]
push esi
push edi
xor esi, esi
push ebp
xor edi, edi
mov dword [esp + 0x18], eax
push ecx
push str.SOFTWAREMICROSOFTRPCCLIENTPROTOCOLS
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402a27
push esi
push esi
push 0x13
call fcn.00401c00
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
lea eax, [esp + 0x34]
lea ecx, [esp + 0x30]
lea edx, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
lea edx, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push ecx
lea ecx, [esp + 0x30]
push edx
lea edx, [esp + 0x30]
push eax
lea eax, [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x30]
push 0
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x402a8c
push 0
push eax
push 0x13
call fcn.00401c00
mov eax, dword [esp + 0x1c]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
mov eax, dword [esp + 0x54]
push 4
mov ecx, dword [eax]
push ecx
call fcn.00404340
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x402ac6
push 0
push 0
push 0x11
call fcn.00401c00
mov eax, dword [esp + 0x1c]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
push 1
push 0x14
call fcn.00404340
add esp, 8
mov dword [ebx], eax
test eax, eax
jne 0x402b04
push 0
push 0
push 0x11
call fcn.00401c00
add esp, 0xc
push ebx
call fcn.00404320
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
lea ebp, [ebx + edi*4]
push 0
lea eax, [esp + 0x18]
push 0
push 0
mov ecx, dword [ebp]
mov edx, dword [esp + 0x1c]
push 0
push eax
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x402bf5
test eax, eax
je 0x402b6a
push 0
push eax
push 0x13
call fcn.00401c00
add esp, 0xc
test edi, edi
je 0x402b56
mov eax, dword [ebp - 4]
sub ebp, 4
dec edi
push eax
call fcn.00404320
add esp, 4
jmp 0x402b40
push ebx
call fcn.00404320
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
mov eax, dword [esp + 0x54]
mov dword [esp + 0x14], 0x14
cmp dword [eax], esi
jbe 0x402bf5
push str.ncalrpc
mov eax, dword [ebx + edi*4]
push eax
call fcn.00407200
add esp, 8
test eax, eax
je 0x402b04
lea ebp, [ebx + edi*4 + 4]
inc edi
push 1
push 0x14
call fcn.00404340
add esp, 8
mov dword [ebp], eax
test eax, eax
jne 0x402b04
push 0
lea esi, [ebx + edi*4]
push 0
push 0x11
call fcn.00401c00
add esp, 0xc
test edi, edi
je 0x402bd7
mov eax, dword [esi - 4]
sub esi, 4
dec edi
push eax
call fcn.00404320
add esp, 4
jmp 0x402bc1
push ebx
call fcn.00404320
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
inc edi
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x10]
mov dword [eax], edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret