Function at 0x402fe0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x408270]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push ebx
mov ebx, dword [esp + 0x218]
push esi
push edi
push eax
lea eax, [esp + 0x18]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea ecx, [esp + 0x20]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcschr]
lea edx, [esp + 0x28]
push 0x5c
push edx
mov esi, eax
call dword [sym.imp.MSVCR80.dll_wcsrchr]
mov edi, eax
mov word [esi], 0
add esp, 0x1c
mov word [edi], 0
add esi, 2
add edi, 2
mov ecx, str.HKCR
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403076
test dx, dx
je 0x403072
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403076
add eax, 4
add ecx, 4
test dx, dx
jne 0x403050
xor eax, eax
jmp 0x40307b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x403089
mov eax, 0x80000000
jmp 0x4031cb
mov ecx, str.HKCU
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4030b8
test dx, dx
je 0x4030b4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4030b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x403092
xor eax, eax
jmp 0x4030bd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4030cb
mov eax, 0x80000001
jmp 0x4031cb
mov ecx, str.HKLM
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4030fa
test dx, dx
je 0x4030f6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4030fa
add eax, 4
add ecx, 4
test dx, dx
jne 0x4030d4
xor eax, eax
jmp 0x4030ff
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40310d
mov eax, 0x80000002
jmp 0x4031cb
mov ecx, 0x4061a4
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40313c
test dx, dx
je 0x403138
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40313c
add eax, 4
add ecx, 4
test dx, dx
jne 0x403116
xor eax, eax
jmp 0x403141
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40314f
mov eax, 0x80000003
jmp 0x4031cb
mov ecx, str.HKCC
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40317e
test dx, dx
je 0x40317a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40317e
add eax, 4
add ecx, 4
test dx, dx
jne 0x403158
xor eax, eax
jmp 0x403183
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40318e
mov eax, 0x80000005
jmp 0x4031cb
mov ecx, str.HKDD
lea eax, [esp + 0x14]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4031bd
test dx, dx
je 0x4031b9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4031bd
add eax, 4
add ecx, 4
test dx, dx
jne 0x403197
xor eax, eax
jmp 0x4031c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40320b
mov eax, 0x80000006
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40320b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x224]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x403225
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00404656
add esp, 0x20c
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00404656
add esp, 0x20c
ret