Function at 0x402eb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x410060]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x49c], 0
mov word [ebp - 0x498], 0
mov ecx, 0x14
xor eax, eax
lea edi, [ebp - 0x496]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x440], 1
mov eax, dword [ebp + 0xc]
mov word [eax], 0
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.00403650
add esp, 8
lea ecx, [ebp - 0x438]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x18]
add edx, 0x618
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x210], eax
cmp dword [ebp + 0x20], 0
je 0x402f74
mov ecx, dword [ebp + 0x20]
mov dword [ecx], 0
cmp dword [ebp - 0x210], 0
jne 0x402fce
cmp dword [ebp + 0x20], 0
je 0x402f8c
mov edx, dword [ebp + 0x20]
mov dword [edx], 1
mov dword [ebp - 0x49c], 0x50
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x498]
push ecx
lea edx, [ebp - 0x20c]
push edx
push 0
push 0x40a79c
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x210], eax
mov word [ebp - 0x448], 0
cmp dword [ebp - 0x210], 0
je 0x40307b
push 0x105
lea ecx, [ebp - 0x420]
push ecx
call fcn.00406c40
add esp, 8
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x403003
jmp 0x403182
cmp dword [ebp + 0x1c], 0
je 0x40301c
mov edx, dword [ebp + 0x10]
push edx
push 0x40a7b4
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x40a7c4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406c90
add esp, 0xc
mov eax, dword [ebp + 0x18]
add eax, 0x820
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406c90
add esp, 0xc
push 0x40a7cc
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406c90
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406c90
add esp, 0xc
jmp 0x403182
push 0x40a7d0
push 0xff
lea edx, [ebp - 0x208]
push edx
call fcn.00402b80
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jge 0x4030a5
jmp 0x403182
lea eax, [ebp - 0x498]
push eax
push 0xff
lea ecx, [ebp - 0x208]
push ecx
call fcn.00402400
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jge 0x4030d1
jmp 0x403182
push 0x40a7ec
push 0xff
lea edx, [ebp - 0x208]
push edx
call fcn.00402400
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jge 0x4030fb
jmp 0x403182
lea eax, [ebp - 0x43c]
push eax
push 0x40e360
lea ecx, [ebp - 0x208]
push ecx
call dword [0x4106e0]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
jge 0x403125
jmp 0x403182
lea edx, [ebp - 0x430]
push edx
push 0x40a7f0
mov eax, dword [ebp - 0x43c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x43c]
push edx
call dword [ecx + 0x3c]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x428], 0
je 0x403182
cmp dword [ebp + 0x1c], 0
je 0x40316b
mov eax, dword [ebp + 0x10]
push eax
push 0x40a814
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x428]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406c90
add esp, 0xc
lea edx, [ebp - 0x430]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x438], 0
je 0x4031a5
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x43c], 0
je 0x4031c0
mov ecx, dword [ebp - 0x43c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x43c]
push eax
call dword [edx + 8]
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 4]
call fcn.00409559
pop edi
mov esp, ebp
pop ebp
ret