Function at 0x401e33
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x464
mov eax, 0x4dc4d3
call fcn.004c1130
mov dword [ebp - 0x470], ecx
and dword [ebp - 0x460], 0
mov ecx, 0x20119
cmp dword [ebp + 0xc], 0
mov edi, 0x20019
mov eax, dword [ebp + 8]
cmovne edi, ecx
mov dword [ebp - 0x464], eax
lea ecx, [ebp - 0x460]
push ecx
push edi
push 0
push 0x4fe498
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4021cc
cmp dword [ebp - 0x460], eax
je 0x4021cc
push 0x208
xor ebx, ebx
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x426]
mov dword [ebp - 0x438], 0x104
push ebx
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x438]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x428]
push eax
push ecx
jmp 0x40219a
lea ecx, [ebp - 0x458]
call fcn.004021d6
and dword [ebp - 4], 0
inc ebx
and dword [ebp - 0x42c], 0
call fcn.00401363
push eax
lea ecx, [ebp - 0x42c]
call fcn.004025be
mov byte [ebp - 4], 2
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
push 0x4fe500
push eax
call fcn.00402b3f
mov esi, dword [ebp - 0x42c]
add esp, 0xc
cmp dword [esi - 0xc], 0
jne 0x401f2d
jmp 0x402167
and dword [ebp - 0x430], 0
push ecx
lea ecx, [ebp - 0x46c]
call fcn.0040232e
mov byte [ebp - 4], 4
mov edx, eax
push ecx
lea ecx, [ebp - 0x468]
call fcn.0040242d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x42c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x430]
call fcn.004023d7
pop ecx
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x468]
call fcn.004025e7
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x46c]
call fcn.004025e7
and dword [ebp - 0x45c], 0
lea eax, [ebp - 0x45c]
push eax
push edi
push 0
push dword [ebp - 0x430]
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401fc5
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x430]
call fcn.004025e7
jmp 0x402167
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.004be330
add esp, 0xc
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x434]
mov dword [ebp - 0x43c], 7
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0x4fe508
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x458]
call fcn.0040239c
mov eax, 0x104
push eax
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0x4fe520
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x454]
call fcn.0040239c
mov eax, 0x104
push eax
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push str.Publisher
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x450]
call fcn.0040239c
mov eax, dword [ebp - 0x458]
cmp dword [eax - 0xc], 0
je 0x40212f
cmp dword [esi - 0xc], 0
jl 0x4021c2
cmp word [esi], 0x4b
jne 0x40211d
cmp dword [esi - 0xc], 1
jl 0x4021c2
cmp word [esi + 2], 0x42
jne 0x40211d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x430]
call fcn.004025e7
jmp 0x402167
mov ecx, dword [ebp - 0x470]
lea eax, [ebp - 0x458]
push eax
call fcn.00402484
mov eax, 0x104
push eax
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.004be330
add esp, 0xc
push dword [ebp - 0x45c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x430]
call fcn.004025e7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x42c]
call fcn.004025e7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.00402290
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push dword [ebp - 0x460]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x401ed5
push dword [ebp - 0x460]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x4021ce
push 0x80070057
call fcn.00401d83
xor eax, eax
call fcn.004c10df
ret 8