Function at 0x402246
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x43c064]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x330], 0x208
xor edx, edx
inc edx
push edi
mov edi, ecx
mov ecx, eax
and ecx, edx
mov dword [ebp - 0x2fc], edi
mov dword [ebp - 0x2f8], ecx
mov edx, eax
mov ecx, eax
and ecx, 2
mov dword [ebp - 0x2f0], ecx
mov ecx, eax
and ecx, 4
mov dword [ebp - 0x334], ecx
mov ecx, eax
and ecx, 8
mov dword [ebp - 0x320], ecx
mov ecx, eax
and ecx, 0x10
mov dword [ebp - 0x314], ecx
mov ecx, eax
and ecx, 0x20
mov dword [ebp - 0x31c], ecx
mov ecx, eax
and ecx, 0x40
mov dword [ebp - 0x338], ecx
mov ecx, eax
and ecx, 0x200
mov dword [ebp - 0x33c], ecx
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x2f4], ecx
test eax, 0x100
mov dword [ebp - 0x30c], ecx
mov dword [ebp - 0x308], ecx
mov eax, str.Show
mov dword [ebp - 0x304], ecx
mov ecx, str.open
cmove eax, ecx
mov dword [ebp - 0x310], ebx
cmp dword [ebp - 0x2f8], ebx
mov ecx, 0x41c0fc
cmove ecx, eax
and dl, 0x80
mov eax, str.ViewProtected
cmove eax, ecx
cmp dword [ebp - 0x31c], ebx
mov ecx, str.OpenAsReadOnly
cmove ecx, eax
cmp dword [ebp - 0x2f0], ebx
mov eax, 0x41c1cc
cmove eax, ecx
cmp dword [ebp - 0x314], ebx
mov ecx, str.edit
cmove ecx, eax
mov dword [ebp - 0x300], ecx
mov ecx, esi
call fcn.00409cea
test eax, eax
je 0x402396
lea eax, [ebp - 0x32c]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push eax
push dword [esi + 8]
mov edx, 0x851
mov dword [ebp - 0x328], str.Param
push 0xc8
mov ecx, 0x170a8c9
mov dword [ebp - 0x324], str.Original_File_Name
call fcn.00401cbf
cmp dword [ebp - 0x334], ebx
je 0x4023b4
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4023aa
call fcn.00401e39
mov ecx, edi
call fcn.0040b1a4
mov dword [esi + 0xc], eax
cmp edi, 0xffffffff
je 0x4023be
cmp edi, 9
jne 0x4023e1
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x4023e1
xor edx, edx
cmp dword [ebp - 0x338], edx
setne dl
call fcn.0040b0d2
cmp eax, 0xffffffff
cmovne edi, eax
mov dword [ebp - 0x2fc], edi
cmp dword [ebp - 0x320], ebx
je 0x402553
mov ecx, esi
call fcn.00405237
mov ecx, eax
mov dword [ebp - 0x320], eax
call fcn.0040994d
test eax, eax
jne 0x402553
mov edi, dword [ebp - 0x320]
mov ecx, edi
call fcn.0040980c
test eax, eax
je 0x40252c
mov esi, dword [esi + 0xc]
test esi, esi
je 0x40252c
push ecx
lea edx, [ebp - 0xdc]
mov ecx, esi
call fcn.0040216f
test eax, eax
je 0x40254b
cmp word [ebp - 0xdc], 0
lea eax, [ebp - 0x2f4]
push eax
mov ebx, 0x20019
lea edx, [ebp - 0xdc]
push ebx
push ecx
cmove edx, esi
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x40254b
lea eax, [ebp - 0x30c]
mov edx, str.shell
push eax
push ebx
push ecx
mov ecx, dword [ebp - 0x2f4]
call fcn.0040bac7
test eax, eax
jne 0x40254b
mov edx, dword [ebp - 0x300]
lea eax, [ebp - 0x308]
push eax
push ebx
push ecx
mov ecx, dword [ebp - 0x30c]
call fcn.0040bac7
test eax, eax
jne 0x40254b
lea eax, [ebp - 0x304]
mov edx, str.command
push eax
push ebx
push ecx
mov ecx, dword [ebp - 0x308]
call fcn.0040bac7
test eax, eax
jne 0x40254b
movzx eax, byte [ebp - 0x2ec]
xor ecx, ecx
cmp dword [ebp - 0x318], 1
cmove eax, ecx
xor esi, esi
mov byte [ebp - 0x2ec], al
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x318]
push eax
push esi
push esi
push dword [ebp - 0x304]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40254b
push ecx
push esi
push esi
mov ecx, edi
call fcn.0040b2d4
push eax
mov edx, edi
lea ecx, [ebp - 0x2ec]
call fcn.0040377f
jmp 0x40254b
call fcn.0040c5e3
xor eax, eax
xor ecx, ecx
cmp dword [ebp - 0x314], eax
mov edx, str.edit
push eax
push eax
push edi
cmove edx, ecx
call fcn.0040c550
xor ebx, ebx
inc ebx
jmp 0x402945
cmp edi, 1
jne 0x4025a5
cmp dword [esi + 0xc], ebx
je 0x402569
mov ecx, dword [esi + 0xc]
call fcn.0040b160
cmp eax, edi
je 0x4025a5
mov ecx, dword [esi + 8]
call fcn.0040994d
test eax, eax
jne 0x402580
mov ecx, dword [esi]
call fcn.0040994d
test eax, eax
je 0x4025a5
cmp dword [esi + 0xc], ebx
je 0x40258d
mov ecx, dword [esi + 0xc]
call fcn.00401e39
xor edx, edx
mov ecx, str.Excel.WebQuery
call fcn.0040b555
mov dword [ebp - 0x300], str.edit
jmp 0x4025cf
cmp dword [esi + 0xc], ebx
je 0x4025c8
cmp edi, 0xffffffff
je 0x4025d2
cmp edi, 9
je 0x4025d2
mov ecx, dword [esi + 0xc]
call fcn.0040b160
cmp edi, eax
je 0x4025d2
mov ecx, dword [esi + 0xc]
call fcn.00401e39
mov ecx, edi
call fcn.0040b1a4
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x314], eax
cmp edi, 0xffffffff
je 0x402908
test eax, eax
je 0x402908
xor ecx, ecx
cmp word [eax], cx
je 0x402908
cmp edi, 4
jne 0x402608
cmp dword [ebp - 0x2f8], ecx
jne 0x402908
mov dword [ebp - 0x324], eax
mov edx, 0x851
lea eax, [ebp - 0x32c]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push eax
push str.FHevActivateApp:
push 0x64
mov ecx, 0x170a8cb
mov dword [ebp - 0x328], str.Param
call fcn.00401cbf
push ecx
mov ecx, dword [ebp - 0x314]
lea edx, [ebp - 0xdc]
call fcn.0040216f
test eax, eax
je 0x402908
cmp word [ebp - 0xdc], 0
lea eax, [ebp - 0x2f4]
push eax
mov ebx, 0x20019
lea edx, [ebp - 0xdc]
cmove edx, dword [ebp - 0x314]
push ebx
push ecx
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x402902
lea eax, [ebp - 0x30c]
mov edx, str.shell
push eax
push ebx
push ecx
mov ecx, dword [ebp - 0x2f4]
call fcn.0040bac7
test eax, eax
jne 0x402902
mov eax, dword [ebp - 0x2f8]
test eax, eax
jne 0x402727
cmp dword [ebp - 0x2f0], eax
je 0x4026e1
mov edx, dword [ebp - 0x2f4]
lea eax, [ebp - 0x2fc]
push eax
push ecx
push ecx
mov ecx, esi
call fcn.00402053
mov edi, dword [ebp - 0x2fc]
test eax, eax
je 0x402721
mov edx, edi
mov ecx, esi
call fcn.00409c27
test eax, eax
je 0x402721
push 2
pop edx
cmp edi, edx
jne 0x40271b
mov ecx, esi
call fcn.00409c27
test eax, eax
je 0x40271b
xor eax, eax
push eax
push esi
push edx
mov edx, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x2f4]
call fcn.00402ab2
jmp 0x4028fa
push 1
push esi
push edi
jmp 0x402705
mov eax, dword [ebp - 0x2f8]
cmp edi, 9
je 0x40277d
test eax, eax
jne 0x40277d
mov edx, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x2f4]
push 1
push esi
push edi
call fcn.00402ab2
mov ebx, eax
test ebx, ebx
jne 0x402945
mov ecx, dword [ebp - 0x2f0]
test ecx, ecx
jne 0x40290e
cmp dword [ebp - 0x31c], ecx
jne 0x402945
cmp edi, 4
je 0x402917
push 1
push esi
push edi
mov edx, 0x41b290
jmp 0x40270b
mov ecx, esi
call fcn.00405237
cmp dword [ebp - 0x2f8], 0
mov dword [ebp - 0x2fc], eax
jne 0x4027a4
mov ecx, eax
call fcn.0040980c
test eax, eax
jne 0x4027d0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x2f0], 0
je 0x4028bc
test eax, eax
je 0x4027d0
xor ecx, ecx
cmp word [eax], cx
je 0x4027d0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x4028bc
cmp word [eax], cx
je 0x4028bc
mov edx, dword [ebp - 0x300]
lea eax, [ebp - 0x308]
push eax
push ebx
push ecx
mov ecx, dword [ebp - 0x30c]
call fcn.0040bac7
test eax, eax
jne 0x402902
lea eax, [ebp - 0x304]
mov edx, str.command
push eax
push ebx
push ecx
mov ecx, dword [ebp - 0x308]
call fcn.0040bac7
test eax, eax
jne 0x402902
movzx eax, byte [ebp - 0x2ec]
xor ecx, ecx
cmp dword [ebp - 0x318], 1
cmove eax, ecx
mov byte [ebp - 0x2ec], al
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x318]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x304]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402902
lea eax, [ebp - 0x2ec]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x324], eax
mov edx, 0x851
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x328], str.Param
push eax
push str.FHevActivateApp:_Before_FSimpleSpawn_with
push 0x64
mov ecx, 0x170a8cc
call fcn.00401cbf
push ecx
push dword [esi + 0x14]
mov ecx, dword [ebp - 0x2fc]
push dword [esi + 0x10]
call fcn.0040b2d4
mov edx, dword [ebp - 0x2fc]
lea ecx, [ebp - 0x2ec]
push eax
call fcn.0040377f
jmp 0x4028fa
push 2
pop edx
cmp edi, edx
jne 0x4028d2
mov ecx, esi
call fcn.00409c27
test eax, eax
jne 0x40254b
mov eax, dword [ebp - 0x2f8]
mov edx, str.print
mov edi, dword [ebp - 0x2fc]
test eax, eax
push ecx
cmove edx, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x2f4]
push eax
push edi
call fcn.004036e1
mov ebx, eax
test ebx, ebx
je 0x402908
jmp 0x402945
mov ebx, dword [ebp - 0x310]
mov ecx, dword [ebp - 0x2f0]
cmp dword [ebp - 0x31c], 0
jne 0x402945
cmp dword [ebp - 0x33c], 0
jne 0x402945
cmp dword [ebp - 0x2f8], 0
je 0x40292e
push 2
pop eax
jmp 0x40293c
xor eax, eax
inc eax
test ecx, ecx
push 3
movzx eax, al
pop edx
cmovne eax, edx
mov dl, al
mov ecx, esi
call fcn.00403bbb
cmp dword [ebp - 0x304], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40295c
push dword [ebp - 0x304]
call esi
xor edi, edi
mov dword [ebp - 0x304], edi
cmp dword [ebp - 0x308], edi
je 0x402974
push dword [ebp - 0x308]
call esi
mov dword [ebp - 0x308], edi
cmp dword [ebp - 0x30c], edi
je 0x40298a
push dword [ebp - 0x30c]
call esi
mov dword [ebp - 0x30c], edi
cmp dword [ebp - 0x2f4], edi
je 0x4029a0
push dword [ebp - 0x2f4]
call esi
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416bd0
mov esp, ebp
pop ebp
ret 4