Function at 0x402bc8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x108
mov eax, 0x438c0e
call fcn.0043869b
mov dword [ebp - 0x80], edx
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc4]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xe8], esi
call fcn.00401d46
push eax
push ecx
push dword [0x43d4ac]
lea ecx, [ebp - 0x114]
call fcn.00415376
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0xd4], ebx
mov byte [ebp - 4], 3
mov ecx, esi
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x9c], ebx
call fcn.00405498
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xf4], ebx
test eax, eax
je 0x402c6e
mov ecx, eax
call fcn.0040b9b7
mov edi, eax
mov dword [ebp - 0xcc], edi
jmp 0x402c76
mov edi, ebx
mov dword [ebp - 0xcc], ebx
test esi, esi
je 0x402c90
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x402c90
call fcn.0040b9b7
mov ebx, eax
mov dword [ebp - 0x88], eax
jmp 0x402c96
mov dword [ebp - 0x88], ebx
lea eax, [edi + 0x104]
mov byte [ebp - 0x75], 1
cmp eax, 0x104
jb 0x40378e
mov dword [ebp - 0x8c], eax
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xa0], 3
push eax
mov ecx, eax
call fcn.0040a3d8
mov eax, dword [ebp - 0x8c]
lea ecx, [eax + ebx]
cmp ecx, eax
jb 0x40378e
push 2
pop ebx
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x8c], ecx
push eax
lea edx, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
mov ecx, eax
call fcn.0040a3d8
mov esi, dword [ebp - 0x8c]
xor edi, edi
mov eax, esi
mul ebx
cmp edx, edi
ja 0x40378e
jb 0x402d22
cmp eax, 0xffffffff
ja 0x40378e
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push eax
call edi
pop ecx
mov ecx, dword [ebp - 0x80]
mov ebx, eax
call fcn.0040b9b7
add eax, 7
mov dword [ebp - 0x84], eax
lea ecx, [eax + eax]
push ecx
call edi
mov edi, dword [ebp - 0xe8]
mov edx, dword [ebp - 0x90]
pop ecx
mov ecx, edi
mov dword [ebp - 0xd0], eax
call fcn.00409ee5
mov dword [ebp - 0xa0], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xf0], ecx
cmp dword [ebp - 0xd0], eax
je 0x40367c
test ebx, ebx
je 0x403680
mov eax, dword [ebp - 0x80]
mov edx, 0x851
mov dword [ebp - 0xac], eax
mov ecx, 0x170a8ce
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xb4]
push eax
push str.FActivateWithDde:
push 0x64
mov dword [ebp - 0xb0], str.Param
call fcn.00401c4f
push dword [ebp - 0x84]
mov ecx, dword [ebp - 0xd0]
mov edx, 0x43c3a4
call fcn.0040bc07
push dword [ebp - 0x84]
mov edx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0xd0]
call fcn.0040bc56
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0x94]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xe4]
call fcn.0040c1f1
test eax, eax
jne 0x403623
mov eax, dword [ebp - 0x90]
cmp eax, 0xffffffff
je 0x4034d7
cmp eax, 0xa
mov eax, dword [ebp + 0x10]
jae 0x402e5b
test eax, eax
je 0x402e5b
mov ecx, edi
call fcn.00402b1f
test eax, eax
jne 0x402e52
imul ecx, dword [ebp - 0x90], 0x30
mov ecx, dword [ecx + 0x43cf78]
call fcn.00402acd
test eax, eax
je 0x402e58
xor edx, edx
mov eax, edx
jmp 0x402e5d
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x90]
cmp ecx, 0xa
jae 0x4034d7
test eax, eax
je 0x4034d7
imul eax, ecx, 0x30
mov dword [ebp - 0xe4], eax
mov eax, dword [eax + 0x43cf64]
mov dword [ebp - 0x84], eax
cmp word [eax], dx
jne 0x402eaf
mov ecx, dword [ebp - 0x94]
call fcn.00403794
mov dword [ebp - 0xf4], eax
test eax, eax
je 0x403623
mov dword [ebp - 0x84], eax
xor edx, edx
push edx
push 0x10
push 0x401f92
lea eax, [ebp - 0x9c]
push eax
call dword [sym.imp.USER32.dll_DdeInitializeW]
test eax, eax
jne 0x403623
push 0x4b0
push dword [ebp - 0x84]
push dword [ebp - 0x9c]
call dword [sym.imp.USER32.dll_DdeCreateStringHandleW]
mov dword [ebp - 0xfc], eax
test eax, eax
je 0x4034d7
xor ecx, ecx
push ecx
push ecx
push ecx
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.USER32.dll_DdeConnectList]
mov dword [ebp - 0xdc], eax
test eax, eax
je 0x4034d7
mov ecx, dword [ebp - 0x80]
mov edx, 0x43d21c
push 2
pop eax
mov dword [ebp - 0x84], eax
call fcn.0040baaf
test eax, eax
jne 0x402f52
mov ecx, dword [ebp - 0x80]
mov edx, str.OpenAsReadOnly
call fcn.0040baaf
test eax, eax
jne 0x402f52
mov edx, dword [ebp - 0xe4]
mov ecx, ebx
push esi
mov edx, dword [edx + 0x43cf74]
call fcn.0040bc07
jmp 0x402f57
xor eax, eax
mov word [ebx], ax
xor edx, edx
mov eax, ebx
mov ecx, edx
cmp word [ebx], dx
je 0x402f6b
lea eax, [eax + 2]
inc ecx
cmp word [eax], dx
jne 0x402f62
add ecx, ecx
mov dword [ebp - 0x80], ecx
cmp dword [ebp - 0xa0], edx
je 0x402f91
push esi
mov edx, str._Activate___1___
mov ecx, ebx
call fcn.0040bc07
mov dword [ebp - 0x80], 0x20
jmp 0x403042
test ecx, ecx
jne 0x403042
mov eax, dword [ebp - 0xcc]
mov edx, str.ddeexec
lea eax, [eax*2 + 0x208]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0xd8]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x94]
call fcn.0040c1f1
test eax, eax
jne 0x40303d
cmp dword [ebp - 0xec], 1
mov eax, dword [ebp - 0xd8]
jne 0x402fdd
xor ecx, ecx
mov byte [ebx], cl
lea ecx, [ebp - 0x80]
push ecx
push ebx
lea ecx, [ebp - 0xec]
push ecx
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40303d
cmp dword [ebp - 0x88], eax
je 0x4031bb
xor edx, edx
mov ecx, ebx
call fcn.0040bc95
mov dword [ebp - 0x98], eax
test eax, eax
je 0x403042
push esi
mov edx, eax
mov ecx, ebx
call fcn.0040bc56
push dword [ebp - 0x98]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x80]
pop ecx
lea eax, [eax*2 - 2]
mov dword [ebp - 0x80], eax
jmp 0x403042
xor eax, eax
mov byte [ebp - 0x75], al
mov esi, dword [ebp - 0x88]
test esi, esi
je 0x4031bb
mov edx, str.__1_
mov ecx, ebx
call fcn.0040bcdf
mov dword [ebp - 0x98], eax
test eax, eax
jne 0x403080
mov edx, 0x43c4fc
mov ecx, ebx
call fcn.0040bcdf
mov dword [ebp - 0x98], eax
test eax, eax
je 0x4031bb
mov ecx, dword [edi + 0x10]
push 0x22
pop edx
cmp word [ecx], dx
jne 0x40309e
cmp word [ecx + esi*2 - 2], dx
jne 0x40309e
mov dword [ebp - 0xe0], 1
jmp 0x4030a6
xor ecx, ecx
mov dword [ebp - 0xe0], ecx
cmp word [eax], dx
mov esi, str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 4
pop ecx
push 2
pop eax
cmovne ecx, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
xor eax, eax
mov dword [ebp - 0x84], ecx
mov word [ebp - 0xa8], ax
mov edx, 0x851
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb0], str.Param
push eax
push esi
push 0x64
mov ecx, 0x170a8cf
mov dword [ebp - 0xac], ebx
call fcn.00401c4f
mov eax, dword [edi + 0x10]
mov edx, 0x851
mov dword [ebp - 0xac], eax
mov ecx, 0x170a8d0
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xb4]
push eax
push esi
push 0x64
mov dword [ebp - 0xb0], str.Param
call fcn.00401c4f
mov esi, dword [edi + 0x10]
lea eax, [ebp - 0x100]
push ecx
push eax
lea ecx, [ebp - 0x8c]
call fcn.0040a3a8
push dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x80]
push esi
push ecx
push dword [ebp - 0x98]
shr edx, 1
mov ecx, ebx
push dword [eax]
call fcn.00403d8b
test eax, eax
je 0x403623
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
mov edx, 0x851
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb0], str.Param
push eax
push ebx
push 0xc8
mov ecx, 0x170a8d1
mov dword [ebp - 0xac], str.DDE_Command
call fcn.00401c4f
mov edx, str.__1_
mov ecx, ebx
call fcn.0040bcdf
mov esi, eax
test esi, esi
jne 0x4031ea
mov edx, 0x43c4fc
mov ecx, ebx
call fcn.0040bcdf
mov esi, eax
test esi, esi
jne 0x4031ea
xor ecx, ecx
mov al, cl
mov esi, ecx
jmp 0x4034c0
push 0x22
pop eax
cmp word [esi], ax
mov edx, 0x851
mov eax, dword [ebp - 0x84]
push 4
pop ecx
cmove eax, ecx
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x84], eax
mov ecx, 0x170a8d2
xor eax, eax
mov dword [ebp - 0xb0], str.Param
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xb4]
push eax
push str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 0x64
mov dword [ebp - 0xac], ebx
call fcn.00401c4f
mov eax, dword [ebp - 0xc8]
mov edx, 0x851
mov dword [ebp - 0xac], eax
mov ecx, 0x170a8d3
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xb4]
push eax
push str.FActivateWithDde:_Before_FReplaceStrForStr_with
push 0x64
mov dword [ebp - 0xb0], str.Param
call fcn.00401c4f
push ecx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x8c]
call fcn.0040a3a8
mov edx, dword [ebp - 0x80]
xor ecx, ecx
push ecx
push dword [ebp - 0xc8]
mov ecx, dword [ebp - 0x84]
push ecx
push esi
push dword [eax]
shr edx, 1
mov ecx, ebx
add edx, dword [ebp - 0x88]
call fcn.00403d8b
test eax, eax
je 0x403623
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
mov edx, 0x851
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb0], str.Param
push eax
push ebx
push 0xc8
mov ecx, 0x170a8d4
mov dword [ebp - 0xac], str.DDE_Command
call fcn.00401c4f
mov al, byte [ebp - 0x75]
test al, al
je 0x4034d2
mov ecx, dword [ebp - 0x90]
or eax, 0xffffffff
cmp ecx, 1
mov edx, 0xbb8
cmove eax, edx
mov dword [ebp - 0x84], eax
xor eax, eax
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.USER32.dll_DdeQueryNextServer]
mov esi, eax
mov dword [ebp - 0x98], esi
test esi, esi
je 0x403407
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0xcc]
add eax, eax
mov dword [ebp - 0xe0], eax
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
mov edx, 0x851
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb0], str.Param
push eax
push str.FActivateWithDde:_Before_HevDdeClientTransaction_with
push 0x64
mov ecx, 0x170a8d5
mov dword [ebp - 0xac], ebx
call fcn.00401c4f
call fcn.0040d231
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x80]
add ecx, 2
add eax, ecx
xor ecx, ecx
push ecx
push dword [ebp - 0x84]
push 0x4050
push ecx
push ecx
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_DdeClientTransaction]
mov dword [ebp - 0xf8], eax
test eax, eax
jne 0x4034ca
cmp dword [ebp - 0x90], 1
je 0x4034ca
push esi
push dword [ebp - 0xdc]
call dword [sym.imp.USER32.dll_DdeQueryNextServer]
mov esi, eax
mov dword [ebp - 0x98], esi
test esi, esi
jne 0x403363
mov esi, dword [ebp - 0x7c]
test esi, esi
je 0x4034bd
mov eax, dword [ebp - 0xe4]
xor ecx, ecx
cmp dword [eax + 0x43cf80], ecx
je 0x4034bd
push 0x60
push ecx
lea eax, [ebp - 0x74]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x74], 0x60
lea eax, [ebp - 0x74]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x98]
call dword [sym.imp.USER32.dll_DdeQueryConvInfo]
mov eax, dword [ebp - 0x18]
push eax
mov dword [ebp - 0x88], eax
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x403488
mov edi, dword [ebp - 0x88]
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
jne 0x403468
mov dword [ebp - 0x88], edi
mov edi, dword [ebp - 0xe8]
cmp dword [ebp - 0x18], 0
je 0x4034bd
push dword [ebp - 0x88]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4034ac
push 9
push dword [ebp - 0x88]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040d231
push dword [ebp - 0x88]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov al, byte [ebp - 0x75]
test al, al
jne 0x403626
jmp 0x4034da
xor esi, esi
inc esi
jmp 0x40340a
mov esi, dword [ebp - 0x7c]
jmp 0x4034c0
mov esi, dword [ebp - 0x7c]
lea eax, [ebp - 0xd4]
mov dword [ebp - 0xe8], 0x208
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x94]
mov edx, str.command
call fcn.0040c1f1
test eax, eax
jne 0x403626
cmp dword [ebp - 0xec], 1
mov eax, dword [ebp - 0xd4]
jne 0x40351c
xor ecx, ecx
mov byte [ebx], cl
lea ecx, [ebp - 0xe8]
push ecx
push ebx
lea ecx, [ebp - 0xec]
push ecx
xor ecx, ecx
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403626
mov word [ebp - 0xa8], ax
mov edx, 0x851
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push eax
push str.FActivateWithDde:_Before_FSimpleSpawn_with
push 0x64
mov ecx, 0x170a8d6
mov dword [ebp - 0xb0], str.Param
mov dword [ebp - 0xac], ebx
call fcn.00401c4f
mov eax, dword [ebp - 0xc8]
mov edx, 0x851
mov dword [ebp - 0xac], eax
mov ecx, 0x170a8d7
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xb4]
push eax
push str.FActivateWithDde:_Before_FSimpleSpawn_with
push 0x64
mov dword [ebp - 0xb0], str.Param
call fcn.00401c4f
mov edx, dword [ebp - 0x90]
push 4
pop eax
cmp edx, eax
jne 0x403646
call fcn.0040a1b4
mov dword [ebp - 0xf0], eax
test eax, eax
je 0x403626
push 0x208
mov edx, ebx
mov ecx, eax
call fcn.0040bc56
xor eax, eax
test edi, edi
je 0x4035f7
mov ecx, dword [edi + 0x14]
jmp 0x4035f9
mov ecx, eax
test edi, edi
je 0x403600
mov eax, dword [edi + 0x10]
mov edx, dword [ebp - 0xc8]
push ecx
push ecx
mov ecx, dword [ebp - 0xf0]
push eax
push dword [ebp - 0xcc]
call fcn.004039fd
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp - 0x7c]
test ebx, ebx
je 0x403632
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, dword [ebp - 0xf4]
test eax, eax
je 0x403682
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x403682
xor eax, eax
test edi, edi
je 0x403651
mov ecx, dword [edi + 0x14]
jmp 0x403653
mov ecx, eax
test edi, edi
je 0x40365a
mov eax, dword [edi + 0x10]
push 2
pop esi
cmp edx, esi
jne 0x403670
cmp dword [ebp - 0xa0], 0
je 0x403670
xor edi, edi
mov edx, edi
jmp 0x403676
mov edx, dword [ebp - 0xc8]
push ecx
push ecx
mov ecx, ebx
jmp 0x40360e
mov esi, eax
jmp 0x403626
mov esi, eax
mov ebx, dword [ebp - 0xd0]
test ebx, ebx
je 0x403694
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, dword [ebp - 0xf0]
test eax, eax
je 0x4036a6
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x4036b7
push eax
call dword [sym.imp.USER32.dll_DdeFreeDataHandle]
mov eax, dword [ebp - 0xfc]
test eax, eax
je 0x4036ce
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.USER32.dll_DdeFreeStringHandle]
mov eax, dword [ebp - 0xdc]
test eax, eax
je 0x4036df
push eax
call dword [sym.imp.USER32.dll_DdeDisconnectList]
cmp dword [ebp - 0x9c], 0
je 0x4036f4
push dword [ebp - 0x9c]
call dword [sym.imp.USER32.dll_DdeUninitialize]
xor eax, eax
mov dword [ebp - 0xb4], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 0xa8], ax
lea eax, [ebp - 0xb4]
push eax
push str.FActivateWithDde_
push ecx
mov ecx, 0x170a8d8
mov dword [ebp - 0xb0], str.Param
mov dword [ebp - 0xac], esi
call fcn.00401ce6
cmp dword [ebp - 0xd4], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x403745
push dword [ebp - 0xd4]
call edi
xor ebx, ebx
mov dword [ebp - 0xd4], ebx
cmp dword [ebp - 0x94], ebx
je 0x40375d
push dword [ebp - 0x94]
call edi
mov dword [ebp - 0x94], ebx
cmp dword [ebp - 0xd8], ebx
je 0x403773
push dword [ebp - 0xd8]
call edi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0xd8], ebx
call fcn.004153c3
mov eax, esi
call fcn.00438650
ret 0xc
call fcn.00401ce0
int3