Function at 0x401ec0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x12c
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x128], eax
push ebx
push ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SofwareMicrosoftWindowsCurrentVersionPoliciesAssociations
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], 0xfe
mov dword [esp + 0x24], 1
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401fe8
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push str.ModRiskFileTypes
push ecx
call ebp
test eax, eax
jne 0x401fd7
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401f50
sub eax, edx
push eax
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x20]
call fcn.00401c30
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401f70
sub eax, edx
push eax
push ebx
push esi
lea ecx, [esp + 0x24]
call fcn.00401380
cmp eax, 0xffffffff
je 0x401fc3
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x30], 0x10
jb 0x401fa9
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0042ec92
add esp, 4
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00466555
add esp, 0x12c
ret
cmp dword [esp + 0x30], 0x10
jb 0x401fd7
mov edx, dword [esp + 0x1c]
push edx
call fcn.0042ec92
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push ebx
push str.SofwareMicrosoftWindowsCurrentVersionPoliciesAssociations
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x4020e1
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.ModRiskFileTypes
push edx
call ebp
test eax, eax
jne 0x4020d0
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402048
sub eax, edx
push eax
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
call fcn.00401c30
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402065
sub eax, edx
push eax
push ebx
push esi
lea ecx, [esp + 0x24]
call fcn.00401380
cmp eax, 0xffffffff
je 0x4020bc
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x30], 0x10
jb 0x401fa9
mov edx, dword [esp + 0x1c]
push edx
call fcn.0042ec92
add esp, 4
pop edi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00466555
add esp, 0x12c
ret
cmp dword [esp + 0x30], 0x10
jb 0x4020d0
mov eax, dword [esp + 0x1c]
push eax
call fcn.0042ec92
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x134]
pop edi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.00466555
add esp, 0x12c
ret