Function at 0x417340
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x43c730]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x228]
mov ecx, dword [esp + 0x230]
mov edx, dword [esp + 0x234]
push ebp
push esi
mov esi, dword [esp + 0x234]
push edi
mov edi, dword [esp + 0x230]
xor ebp, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
cmp edi, ebp
je 0x4175ab
cmp eax, ebp
je 0x4175ab
cmp esi, ebp
je 0x4175ab
cmp ecx, ebp
je 0x4175ab
cmp edx, ebp
je 0x4175ab
mov dword [edi], 1
push ebx
xor ebx, ebx
mov word [eax], bx
mov eax, dword [esp + 0x230]
mov dword [esi + 4], ebp
mov dword [esi], ebp
mov dword [esi + 8], 0x320
mov dword [esi + 0xc], 0x258
mov dword [ecx], 0x20
mov dword [edx], 0x3c
cmp eax, ebp
jne 0x4173f2
push 0x20019
call fcn.00416fe0
jmp 0x417401
cmp eax, 1
jne 0x41740a
push 0x20019
call fcn.00417100
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x417425
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00422272
add esp, 0x21c
ret
mov eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push ebp
push str.MSDispNum
mov dword [esp + 0x24], ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
call ebp
test eax, eax
jne 0x41745e
mov eax, dword [esp + 0x10]
mov dword [edi], eax
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [esp + 0x32]
push edx
mov dword [esp + 0x24], 1
mov word [esp + 0x34], cx
call fcn.00422290
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.MSDevName
push ebx
mov dword [esp + 0x2c], 0x200
call ebp
mov eax, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.left
push ebx
call ebp
test eax, eax
jne 0x4174d1
mov eax, dword [esp + 0x10]
mov dword [esi], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0x435260
push ebx
call ebp
test eax, eax
jne 0x4174f5
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.right
push ebx
call ebp
test eax, eax
jne 0x417519
mov edx, dword [esp + 0x10]
mov dword [esi + 8], edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push str.bottom
push ebx
call ebp
test eax, eax
jne 0x41753d
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0x43523c
push ebx
call ebp
test eax, eax
jne 0x417564
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov dword [edx], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0x435234
push ebx
call ebp
test eax, eax
jne 0x41758b
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov edi, dword [esp + 0x20]
mov ecx, 0x80
lea esi, [esp + 0x28]
push ebx
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x41740c
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00422272
add esp, 0x21c
ret