Function at 0x40a280
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xcec
mov eax, dword [0x441008]
xor eax, esp
mov dword [esp + 0xce8], eax
mov eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0x18]
push ebx
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
push esi
mov esi, edx
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp + 0x20]
push edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], ecx
mov ecx, dword [0x4410a0]
cmp ecx, 0x4410a0
je 0x40a2ef
test dword [ecx + 0x1c], 0x20000
je 0x40a2ef
cmp byte [ecx + 0x19], 4
jae 0x420d04
lea eax, [esp + 0x50]
xor edi, edi
test eax, eax
je 0x420d25
lea eax, [esp + 0x20]
push eax
push 0x20019
push edi
push 0x402080
push Ordinal_2
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x420d2f
xor esi, esi
mov dword [esp + 0x24], esi
jmp 0x40a330
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x48]
push ecx
xor edi, edi
mov dword [esp + 0x48], eax
push edi
push edi
push edi
lea ecx, [esp + 0x24]
mov dword [esp + 0x20], 0
push ecx
lea ecx, [esp + 0x904]
mov dword [esp + 0x28], 0x200
push ecx
push esi
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x420d43
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_StringFromCLSID]
mov ebx, eax
test ebx, ebx
js 0x40a3a0
push dword [esp + 0x10]
lea eax, [esp + 0x8f4]
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x40a4d6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40a3b7
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoTaskMemFree]
mov dword [esp + 0x10], 0
test ebx, ebx
js 0x40a3c8
inc esi
mov dword [esp + 0x24], esi
test edi, edi
je 0x40a330
push dword [esp + 0x20]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov esi, dword [esp + 0x30]
test ebx, ebx
js 0x40a3e2
test edi, edi
je 0x420d80
test ebx, ebx
js 0x420db3
cmp dword [esp + 0x478], 1
jne 0x420dae
cmp dword [esp + 0x470], 1
jne 0x420dae
push 0x1c
call fcn.0041a033
mov edi, eax
add esp, 4
mov dword [esp + 0x28], edi
test edi, edi
je 0x420d8a
mov eax, dword [esp + 0x60]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 2
mov dword [edi], 0x402044
mov dword [edi + 0x18], eax
test edi, edi
je 0x420d91
push 0x2c
call fcn.0041a033
mov ecx, eax
add esp, 4
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x420d91
mov eax, dword [ebp + 8]
mov dword [ecx + 0x28], 0
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x50]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x54]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x58]
mov dword [ecx + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [ecx + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [ecx + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [ecx + 0x20], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0x24], eax
mov eax, dword [esp + 0x3c]
mov dword [eax], edi
mov dword [edi + 0x10], ecx
mov ecx, dword [esp + 0xcf4]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041a3d0
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
lea eax, [esp + 0x8fc]
push eax
push dword [esp + 0x54]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x420d58
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x4a8]
mov ecx, dword [esp + 0x18]
push eax
call fcn.0040a5e0
mov ebx, eax
test ebx, ebx
js 0x40a5cc
lea eax, [esp + 0x14]
mov dword [esp + 0x8d8], 1
push eax
lea eax, [esp + 0x8f4]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0x402064
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x420d6c
lea eax, [esp + 0x498]
push eax
lea eax, [esp + 0x8f4]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CLSIDFromString]
mov ebx, eax
test ebx, ebx
js 0x40a5cc
mov eax, dword [esp + 0x498]
lea esi, [esp + 0x4a8]
mov dword [esp + 0x8dc], eax
lea edi, [esp + 0x50]
mov eax, dword [esp + 0x49c]
mov ecx, 0x111
mov dword [esp + 0x8e0], eax
mov eax, dword [esp + 0x4a0]
mov dword [esp + 0x8e4], eax
mov eax, dword [esp + 0x4a4]
mov dword [esp + 0x8e8], eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x24]
mov edi, 1
push dword [esp + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x40a3a0
push eax
push dword [ecx + 0x14]
mov edx, 0x404f84
push dword [ecx + 0x10]
mov ecx, 0x12
call fcn.0043078f
mov ecx, dword [0x4410a0]
jmp 0x40a2ef
mov ebx, 0x80004003
jmp 0x420db9
jle 0x40a3d8
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a3d6
cmp eax, 0xea
je 0x40a36f
mov ebx, 0x887c003a
jmp 0x40a3a0
jle 0x40a3a0
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a3a0
jle 0x40a5cc
movzx ebx, bx
or ebx, 0x80070000
jmp 0x40a5cc
mov ebx, 0x887c001a
jmp 0x40a3e2
xor edi, edi
jmp 0x40a44a
mov ebx, 0x8007000e
test edi, edi
je 0x420db3
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x442374]
mov ecx, edi
call esi
jmp 0x420db3
mov ebx, 0x887c0037
mov ecx, dword [0x4410a0]
cmp ecx, 0x4410a0
je 0x40a4bd
test dword [ecx + 0x1c], 0x20000
je 0x40a4bd
cmp byte [ecx + 0x19], 2
jb 0x40a4bd
push ebx
push dword [ecx + 0x14]
mov edx, 0x404f84
push dword [ecx + 0x10]
mov ecx, 0x13
call fcn.00419c0e
jmp 0x40a4bd