Function at 0x401170
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x48c
mov dl, byte [0x40a940]
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19d]
mov byte [esp + 0x19c], dl
mov byte [esp + 0x29c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x29d]
mov byte [esp + 0x1c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x39c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x39d]
mov ebx, dword [esp + 0x4a0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4081d0]
lea edx, [esp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.1.0.2.7]
push edx
mov dword [esp + 0xa0], eax
xor eax, eax
mov dword [esp + 0xa4], ecx
push 1
mov ecx, 0x3e
lea edi, [esp + 0xac]
push eax
push 0x408168
rep stosd dword es:[edi], eax
push 0x80000002
mov dword [esp + 0x28], 0x100
mov dword [esp + 0x2c], 0
mov dword [ebx], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40124e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x48c
ret
mov edi, 0x40815c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x19c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x29c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x1a8]
push 0
push ecx
push edx
call ebp
test eax, eax
je 0x4012bd
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x48c
ret
mov edi, 0x408094
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x29c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401312
test cl, cl
je 0x40130e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401312
add eax, 2
add esi, 2
test cl, cl
jne 0x4012ee
xor eax, eax
jmp 0x401317
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401321
mov dword [ebx], 1
mov edi, str.Version
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x19c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x39c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x1a8]
push 0
push ecx
push edx
call ebp
test eax, eax
je 0x40138a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x48c
ret
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4013c9
mov al, byte [esp + edx + 0x9c]
mov cl, byte [esp + edx + 0x39c]
cmp al, cl
ja 0x4013e1
jb 0x4013fa
lea edi, [esp + 0x9c]
or ecx, 0xffffffff
xor eax, eax
inc edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jb 0x40139f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48c
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x48c
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48c
ret