Function at 0x402cf0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f845f
mov eax, dword fs:[0]
push eax
sub esp, 0x2f8
mov eax, dword [0x5370e4]
xor eax, esp
mov dword [esp + 0x2f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5370e4]
xor eax, esp
push eax
lea eax, [esp + 0x30c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x31c]
mov ebp, dword [esp + 0x320]
xor ebx, ebx
mov dword [esp + 0x1c], ebx
push 0x19
mov esi, edx
mov dword [esp + 0x5c], ecx
mov edi, 0xf
push str.SoftwareiniLINECrossEX_
lea ecx, [esp + 0xac]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x64], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
call fcn.00402130
mov dword [esp + 0x314], ebx
push ebx
push 0x5255b3
lea ecx, [esp + 0xc8]
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
call fcn.00402130
mov byte [esp + 0x314], 1
push ebx
push 0x5255b3
lea ecx, [esp + 0x90]
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
call fcn.00402130
mov byte [esp + 0x314], 2
push ebx
push 0x5255b3
lea ecx, [esp + 0xe4]
mov dword [esp + 0xfc], edi
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
call fcn.00402130
push str.IsWow64Process
mov byte [esp + 0x318], 3
push str.kernel32
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x549f10], eax
cmp eax, ebx
je 0x402e48
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x549f10]
cmp dword [esp + 0x20], ebx
je 0x402e61
push 0x25
push str.SoftwareWow6432NodeiniLINECrossEX_
lea ecx, [esp + 0xac]
call fcn.00402130
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402e66
sub eax, edx
push eax
push esi
lea eax, [esp + 0xac]
call fcn.00401d60
cmp dword [esp + 0xbc], 0x10
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x20], reloc.WS2_32.dll_accept
jae 0x402e9d
lea eax, [esp + 0xa8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push eax
push reloc.WS2_32.dll_accept
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402f4c
push 0x103
lea edx, [esp + 0x205]
push ebx
push edx
mov byte [esp + 0x20c], bl
call fcn.0042fdd0
add esp, 0xc
lea eax, [esp + 0x54]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x204]
push ecx
lea edx, [esp + 0x70]
push edx
push ebx
push 0x5255b3
push eax
mov dword [esp + 0x6c], 0x104
mov dword [esp + 0x80], ebx
call edi
test eax, eax
jne 0x402ffb
lea eax, [esp + 0x200]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402f21
sub eax, edx
push eax
lea ecx, [esp + 0x204]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00402130
mov dword [esp + 0x20], reloc.WS2_32.dll_accept
jmp 0x402ffb
cmp dword [esp + 0xbc], 0x10
mov eax, dword [esp + 0xa8]
jae 0x402f64
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push ebx
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x403006
push 0x103
lea edx, [esp + 0xfd]
push ebx
push edx
mov byte [esp + 0x104], bl
call fcn.0042fdd0
add esp, 0xc
lea eax, [esp + 0x60]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0x6c]
push edx
push ebx
push 0x5255b3
push eax
mov dword [esp + 0x78], 0x104
mov dword [esp + 0x7c], ebx
call edi
test eax, eax
jne 0x402ffb
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402fd5
sub eax, edx
push eax
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00402130
mov dword [esp + 0x20], reloc.WS2_32.dll_bind
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 5
xor ecx, ecx
lea esi, [esp + 0x3c]
lea edx, [esp + 0xc4]
call fcn.00401cd0
mov edi, 0x10
cmp dword [eax + 0x18], edi
jb 0x403029
mov eax, dword [eax + 4]
jmp 0x40302c
add eax, 4
mov esi, str.list:
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x403051
cmp cl, bl
je 0x40304d
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x403051
add eax, 2
add esi, 2
cmp cl, bl
jne 0x403031
xor eax, eax
jmp 0x403056
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
setne byte [esp + 0x1b]
cmp dword [esp + 0x50], edi
jb 0x403070
mov eax, dword [esp + 0x3c]
push eax
call fcn.0041ef45
add esp, 4
push 0xffffffffffffffff
cmp byte [esp + 0x1f], bl
je 0x403092
push ebx
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [esp + 0x94]
call fcn.00401e70
jmp 0x403479
mov ecx, 5
lea esi, [esp + 0x3c]
lea edx, [esp + 0xc4]
call fcn.00401cd0
mov byte [esp + 0x314], 4
cmp dword [eax + 0x18], edi
jb 0x4030b9
mov eax, dword [eax + 4]
jmp 0x4030bc
add eax, 4
lea edx, [esp + 0x2c]
push edx
mov ecx, eax
call fcn.00405880
mov byte [esp + 0x314], 6
cmp dword [esp + 0x50], edi
jb 0x4030e3
mov eax, dword [esp + 0x3c]
push eax
call fcn.0041ef45
add esp, 4
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x24], ebx
call fcn.0041ef5b
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x403111
push 0x80004005
call fcn.00401040
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x320], 7
call fcn.00405930
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x318], 8
call fcn.00405e30
mov byte [esp + 0x314], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403177
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x28]
jmp 0x403180
push 0x5255b3
push edi
call fcn.0042a05e
add esp, 8
cmp eax, ebx
setne al
cmp al, bl
je 0x403263
xor eax, eax
cmp ebp, ebx
setne al
cmp eax, ebx
je 0x403107
push ebp
push edi
call fcn.0042a05e
add esp, 8
cmp eax, ebx
je 0x403377
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.00405930
mov byte [esp + 0x314], 9
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
lea esi, [edi - 0x10]
cmp eax, esi
je 0x403232
cmp dword [esi + 0xc], ebx
lea edi, [esi + 0xc]
jl 0x403220
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x403220
push eax
call fcn.004062a0
mov ebp, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x403213
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
lea edi, [ebp + 0x10]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x28], edi
jmp 0x403232
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00406210
mov edi, dword [esp + 0x28]
mov byte [esp + 0x314], 7
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403180
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x403180
mov esi, dword [esp + 0x34]
push ebx
mov ebp, 0xf
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push 0x5255b3
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00402130
lea eax, [edi - 0x10]
mov byte [esp + 0x314], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4032a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x314], 3
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4032ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, 0x10
cmp dword [esp + 0xf4], edi
jb 0x4032ec
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.0041ef45
add esp, 4
mov dword [esp + 0xf4], ebp
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0xa0], edi
jb 0x40331a
mov edx, dword [esp + 0x8c]
push edx
call fcn.0041ef45
add esp, 4
mov dword [esp + 0xa0], ebp
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0xd8], edi
jb 0x403348
mov eax, dword [esp + 0xc4]
push eax
call fcn.0041ef45
add esp, 4
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0xbc], edi
jb 0x40372c
mov ecx, dword [esp + 0xa8]
push ecx
jmp 0x403724
cmp dword [esp + 0xbc], 0x10
mov eax, dword [esp + 0xa8]
jae 0x40338f
lea eax, [esp + 0xa8]
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40342d
push 0x103
lea ecx, [esp + 0xfd]
push ebx
push ecx
mov byte [esp + 0x104], bl
call fcn.0042fdd0
add esp, 0xc
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebp
push edx
mov dword [esp + 0x48], 0x104
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403422
lea eax, [esp + 0xf8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403404
sub eax, edx
push eax
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x90]
call fcn.00402130
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi - 0x10]
mov byte [esp + 0x314], 6
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403451
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x314], 3
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403479
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp byte [esp + 0x324], 1
jne 0x4035e4
push 0xc
push str.BLOCK:CLIENT
lea ecx, [esp + 0xe4]
call fcn.00402130
push 1
push 0x52575c
lea ecx, [esp + 0x90]
push ecx
xor eax, eax
call fcn.00405a10
mov edi, eax
cmp edi, 0xffffffff
je 0x403660
push 0xffffffffffffffff
lea ecx, [edi + 1]
lea esi, [esp + 0x3c]
lea edx, [esp + 0x8c]
call fcn.00401cd0
mov ebp, 0x10
mov byte [esp + 0x314], 0xa
cmp dword [eax + 0x18], ebp
jb 0x4034e7
mov eax, dword [eax + 4]
jmp 0x4034ea
add eax, 4
lea edx, [esp + 0x24]
push edx
mov ecx, eax
call fcn.00405880
mov byte [esp + 0x314], 0xc
cmp dword [esp + 0x50], ebp
jb 0x403511
mov eax, dword [esp + 0x3c]
push eax
call fcn.0041ef45
add esp, 4
push edi
xor ecx, ecx
lea esi, [esp + 0x70]
lea edx, [esp + 0x8c]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.00401cd0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x320], 0xd
call fcn.00401e70
mov byte [esp + 0x314], 0xc
cmp dword [esp + 0x84], ebp
jb 0x40356a
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0041ef45
add esp, 4
mov eax, dword [esp + 0x8c]
cmp dword [esp + 0xa0], ebp
jae 0x403581
lea eax, [esp + 0x8c]
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x60]
push edx
push eax
call fcn.0041a070
add esp, 0xc
cmp al, 1
jne 0x4035b3
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0xe8]
call fcn.00401e70
mov byte [esp + 0x314], 3
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403665
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x403665
push 1
push 0x52575c
lea ecx, [esp + 0x90]
push ecx
xor eax, eax
call fcn.00405a10
cmp eax, 0xffffffff
je 0x403649
push eax
xor ecx, ecx
lea esi, [esp + 0x70]
lea edx, [esp + 0x8c]
call fcn.00401cd0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x320], 0xe
call fcn.00401e70
mov byte [esp + 0x314], 3
cmp dword [esp + 0x84], 0x10
jb 0x403649
mov edx, dword [esp + 0x70]
push edx
call fcn.0041ef45
add esp, 4
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0xe8]
call fcn.00401e70
mov ebp, 0x10
mov esi, dword [esp + 0x34]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xe4]
mov edi, 0xf
push ecx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00401e70
cmp dword [esp + 0xf4], ebp
jb 0x4036a2
mov edx, dword [esp + 0xe0]
push edx
call fcn.0041ef45
add esp, 4
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0xa0], ebp
jb 0x4036d0
mov eax, dword [esp + 0x8c]
push eax
call fcn.0041ef45
add esp, 4
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0xd8], ebp
jb 0x4036fe
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.0041ef45
add esp, 4
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0xbc], ebp
jb 0x40372c
mov edx, dword [esp + 0xa8]
push edx
call fcn.0041ef45
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x30c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2f4]
xor ecx, esp
call fcn.00428ddf
add esp, 0x304
ret