Function at 0x401d71
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x890
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x880], ecx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x86c]
mov dword [ebp - 0x868], esi
push eax
push esi
push esi
push esi
mov ebx, edx
push 0x80000000
mov dword [ebp - 0x870], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x401dd1
push eax
push 0x40124c
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
pop ecx
jmp 0x40208a
push edi
mov edi, dword [ebp - 0x86c]
add edi, 0xfffffffe
jmp 0x40207a
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x878]
mov dword [ebp - 0x878], 0x64
push eax
lea eax, [ebp - 0x194]
push eax
push edi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x402079
lea ecx, [ebp - 0x194]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x401e19
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 6]
mov ecx, 0x96
cmp eax, ecx
jae 0x402089
push ecx
lea eax, [ebp - 0x194]
mov edx, ecx
push eax
push ecx
lea ecx, [ebp - 0x450]
call fcn.00401763
push 0x401378
mov edx, 0x96
lea ecx, [ebp - 0x450]
call fcn.004016f5
lea eax, [ebp - 0x87c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x450]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402079
mov esi, dword [ebp - 0x87c]
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x890], esi
push eax
lea eax, [ebp - 0x88c]
mov dword [ebp - 0x864], 0xc8
push eax
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 0x196], cx
test eax, eax
jne 0x402098
lea eax, [ebp - 0x25c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x402098
xor ebx, ebx
cmp dword [ebp - 0x86c], ebx
jbe 0x402066
mov esi, dword [ebp - 0x880]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x884]
mov dword [ebp - 0x884], 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
push ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40205a
cmp word [ebp - 0xcc], 0x2e
je 0x401f49
cmp word [ebp - 0xcc], 0x2a
jne 0x40205a
lea eax, [ebp - 0x888]
push eax
push 0x20019
push 0
lea eax, [ebp - 0xcc]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40204d
mov edi, dword [ebp - 0x888]
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x864], 0xc8
push eax
lea eax, [ebp - 0x88c]
push eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 0x25e], cx
test eax, eax
jne 0x402042
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x402042
lea eax, [ebp - 0x658]
mov edx, esi
push eax
lea eax, [ebp - 0x860]
mov ecx, 0x80000000
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.00401ae1
test eax, eax
jne 0x402042
mov eax, dword [ebp - 0x868]
test al, 1
jne 0x402020
test eax, eax
je 0x40200b
push 0x401388
call dword [sym.imp.msvcrt.dll_printf]
pop ecx
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x40138c
jmp 0x402033
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x4013a4
call dword [sym.imp.msvcrt.dll_printf]
add esp, 0xc
inc dword [ebp - 0x868]
test edi, edi
je 0x40204d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [ebp - 0x86c]
jb 0x401efd
mov esi, dword [ebp - 0x890]
mov edi, dword [ebp - 0x874]
test esi, esi
je 0x402071
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x870]
xor esi, esi
dec edi
mov dword [ebp - 0x874], edi
cmp edi, 0xffffffff
jne 0x401de0
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00402590
leave
ret
test esi, esi
je 0x402077
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402077