Function at 0x402f60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x48c8b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x234], eax
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x40346b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x403475
mov eax, dword [ecx]
lea ebx, [esi + 4]
mov dword [ebp - 0x238], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x40347f
mov eax, dword [ecx]
lea ebx, [esi + 8]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
xor eax, eax
push 0x206
add esi, 0xc
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
mov dword [ebp - 0x230], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.004470b0
add esp, 0xc
mov dword [ebp - 0x218], 1
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x403489
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
call fcn.00425809
mov ecx, eax
test ecx, ecx
je 0x403493
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
mov ecx, esi
call fcn.0040e210
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40308d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4030aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x234]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.InstallSource
push esi
call edi
test eax, eax
je 0x4030fc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.InstallSource
push esi
call edi
test eax, eax
jne 0x403164
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403105
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
push eax
call fcn.00416dd0
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax]
mov edx, dword [ecx - 0xc]
test edx, edx
je 0x403164
lea eax, [edx - 2]
cmp eax, 0xffffffff
je 0x403164
lea ecx, [ecx + eax*2]
test eax, eax
js 0x40349d
cmp eax, edx
jg 0x40349d
cmp word [ecx], 0x5c
je 0x40343e
dec eax
sub ecx, 2
cmp eax, 0xffffffff
jne 0x403141
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.DisplayVersion
push esi
call edi
test eax, eax
je 0x4031ae
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.DisplayVersion
push esi
call edi
test eax, eax
jne 0x4032dc
cmp dword [ebp - 0x21c], 0
je 0x403452
xor edi, edi
cmp word [ebp - 0x214], 0x2e
je 0x403246
lea eax, [ebp - 0x214]
lea ecx, [ecx]
movzx eax, word [eax]
test ax, ax
je 0x403246
mov dword [ebp - 0x224], eax
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x22c], ecx
lea esi, [ecx + 1]
test esi, esi
js 0x40349d
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x40320d
push esi
mov ecx, ebx
call fcn.00416cf0
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x224]
mov word [eax + ecx*2], dx
mov eax, dword [ebx]
cmp esi, dword [eax - 8]
jg 0x40349d
mov dword [eax - 0xc], esi
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax + esi*2], cx
inc edi
lea eax, [ebp - 0x214]
cmp word [eax + edi*2], 0x2e
lea eax, [eax + edi*2]
jne 0x4031d0
movzx eax, word [ebp + edi*2 - 0x212]
inc edi
test ax, ax
je 0x4032d6
jmp 0x403260
movzx eax, ax
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x230]
mov ebx, dword [eax]
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x224], ecx
lea esi, [ecx + 1]
test esi, esi
js 0x40349d
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or ecx, eax
jge 0x4032a0
push esi
mov ecx, ebx
call fcn.00416cf0
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x224]
mov edx, dword [ebp - 0x22c]
mov word [eax + ecx*2], dx
mov eax, dword [ebx]
cmp esi, dword [eax - 8]
jg 0x40349d
mov dword [eax - 0xc], esi
mov eax, dword [ebx]
xor ecx, ecx
inc edi
mov word [eax + esi*2], cx
movzx eax, word [ebp + edi*2 - 0x214]
test ax, ax
jne 0x403260
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.DisplayName
push ebx
call edi
test eax, eax
je 0x403328
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.DisplayName
push ebx
call edi
test eax, eax
jne 0x403353
lea edx, [ebp - 0x214]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x403331
mov ecx, dword [ebp - 0x238]
sub edx, esi
sar edx, 1
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.00416dd0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.LocalPackage
push ebx
call edi
test eax, eax
je 0x403399
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.LocalPackage
push ebx
call edi
test eax, eax
jne 0x4033cc
mov eax, dword [ebp - 0x230]
lea edx, [ebp - 0x214]
mov ecx, dword [eax]
add ecx, 4
lea esi, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4033b0
sub edx, esi
sar edx, 1
push edx
lea eax, [ebp - 0x214]
push eax
call fcn.00416dd0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.Language
push ebx
mov dword [ebp - 0x218], 4
call edi
test eax, eax
je 0x40341c
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.Language
push ebx
call edi
test eax, eax
jne 0x403452
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x214]
mov dword [eax + 0x18], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x220]
inc eax
push eax
push 0
call fcn.0040da90
jmp 0x403164
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x220]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80004005
call fcn.00416fc0
push 0x80070057
call fcn.00416fc0
int3