Function at 0x4031e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, dword [ebp + 0xc]
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403300
mov ecx, eax
mov ebx, esp
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00403cc8
mov edi, esp
push ecx
push edi
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
test eax, eax
je 0x40340c
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 0x10]
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x403307
mov ecx, eax
lea eax, [eax*2 + 3]
and eax, 0xfffffffc
call fcn.00403cc8
mov esi, esp
push ecx
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
mov ebx, dword [ebp - 0x14]
mov ecx, 0
je 0x40340c
lea eax, [ebp - 0x1c]
and dword [eax], 0
push eax
push 0
push 0
push 0xffff
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x403311
lea eax, [ebp - 0x18]
and dword [eax], 0
push eax
push 0x20119
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
jne 0x40340c
lea edi, [ebp - 0x24]
and dword [edi], 0
push edi
push 0
push 0
push 0xffff
push esi
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x40335f
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40330a
xor ecx, ecx
jmp 0x40340e
mov ebx, dword [ebp - 0x14]
xor ecx, ecx
jmp 0x40340c
mov dword [ebp - 0x10], esp
mov eax, dword [ebp - 0x1c]
and eax, 0xfffffffe
add eax, 3
and eax, 0xfffffffc
call fcn.00403cc8
mov ecx, esp
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], ecx
push ecx
push 0
push 0xffff
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
test eax, eax
jne 0x403407
sub esp, 0x20
movaps xmm0, xmmword [0x40d910]
movups xmmword [esp + 0xc], xmm0
mov esi, dword [ebp - 0x20]
jmp 0x4033ac
mov dword [ebp - 0x10], esp
mov eax, dword [ebp - 0x24]
and eax, 0xfffffffe
add eax, 3
and eax, 0xfffffffc
call fcn.00403cc8
mov eax, esi
mov esi, esp
push edi
push esi
push 0
push 0xffff
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
or eax, ebx
jne 0x4033f6
sub esp, 0x20
movaps xmm0, xmmword [0x40d910]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], esi
and dword [esp + 0x1c], 0
and dword [esp + 4], 0
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x403402
mov ebx, eax
push eax
call sub.msvcrt.dll_malloc
pop ecx
test eax, eax
je 0x403402
mov edi, eax
push 0
push 0
push ebx
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x4033fb
mov ecx, edi
mov ebx, dword [ebp - 0x14]
jmp 0x403407
push edi
call sub.msvcrt.dll_free
pop eax
mov ebx, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov esp, eax
mov esp, ebx
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret