Function at 0x4029d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x430
mov eax, dword [0x417118]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov ecx, str.SYSTEMCurrentControlSetServicesResetPassword
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.00402560
test al, al
jne 0x402a50
push 0x414e44
push str.C:ResetPassword.log
call fcn.00402f57
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x402a3a
push str.open_regkey_faile__
push 0x414e48
push esi
call fcn.00403b8c
add esp, 0xc
push esi
call fcn.004031c9
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x402a49
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x402cd4
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x448]
push ebp
push ebp
push ebp
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x244]
push edx
push eax
push edi
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x402aca
push 0x414e44
push str.C:ResetPassword.log
call fcn.00402f57
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x402ab8
push str.EnumKey_faile__
push 0x414e48
push esi
call fcn.00403b8c
add esp, 0xc
push esi
call fcn.004031c9
add esp, 4
cmp edi, ebp
je 0x402ac3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x402cd4
lea ecx, [esp + 0x230]
push str.parameters
push ecx
call fcn.00403b2b
add esp, 8
test eax, eax
jne 0x402b02
push str.wcsstr_faile__
call fcn.004011c0
add esp, 4
cmp edi, ebp
je 0x402ac3
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x402cd4
lea edx, [esp + 0x230]
push edx
push str.SYSTEMCurrentControlSetServicesResetPassword
lea eax, [esp + 0x30]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [esp + 0x20]
push ecx
mov edx, str.OperateType
lea ecx, [esp + 0x3c]
call fcn.00402750
add esp, 0x14
test al, al
je 0x402cba
lea ebx, [esi + 4]
mov edx, str.UserName
lea ecx, [esp + 0x28]
call fcn.004025f0
test al, al
je 0x402cba
mov eax, dword [esp + 0x10]
mov dword [esi], eax
cmp eax, ebp
je 0x402c6f
cmp eax, 2
je 0x402c6f
cmp eax, 3
je 0x402c6f
cmp eax, 5
jne 0x402bae
lea edx, [esp + 0x10]
push edx
mov edx, str.active
lea ecx, [esp + 0x2c]
call fcn.00402750
add esp, 4
test al, al
jne 0x402b9c
mov byte [esi + 0x61c], 1
cmp dword [esp + 0x10], ebp
setne al
mov byte [esi + 0x61c], al
jmp 0x402caa
cmp eax, 6
jne 0x402be6
lea ecx, [esp + 0x10]
push ecx
mov edx, str.passwordchg
lea ecx, [esp + 0x2c]
call fcn.00402750
add esp, 4
test al, al
jne 0x402bd4
mov byte [esi + 0x61d], 1
cmp dword [esp + 0x10], ebp
setne dl
mov byte [esi + 0x61d], dl
jmp 0x402caa
cmp eax, 7
jne 0x402caa
lea eax, [esp + 0x10]
push eax
mov edx, str.expires_year
lea ecx, [esp + 0x2c]
call fcn.00402750
add esp, 4
test al, al
jne 0x402c0f
mov dword [esi + 0x620], ebp
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
mov dword [esi + 0x620], ecx
push edx
mov edx, str.expires_month
lea ecx, [esp + 0x2c]
call fcn.00402750
add esp, 4
test al, al
jne 0x402c39
mov dword [esi + 0x624], ebp
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
mov edx, str.expires_day
lea ecx, [esp + 0x2c]
mov dword [esi + 0x624], eax
call fcn.00402750
add esp, 4
test al, al
jne 0x402c63
mov dword [esi + 0x628], ebp
mov edx, dword [esp + 0x10]
mov dword [esi + 0x628], edx
jmp 0x402caa
lea ebx, [esi + 0x414]
mov edx, str.LocalGroup
lea ecx, [esp + 0x28]
call fcn.004025f0
lea ebx, [esi + 0x20c]
mov edx, str.Password
lea ecx, [esp + 0x28]
call fcn.004025f0
test al, al
jne 0x402caa
push 0x104
push ebp
push ebx
call fcn.00409010
add esp, 0xc
lea esi, [esp + 0x14]
call fcn.00401110
call fcn.004010f0
jmp 0x402cd2
push str.QueryRegistryDwordValue_or_QueryRegistryStringValue_fail
call fcn.004011c0
add esp, 4
cmp edi, ebp
je 0x402cd2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402da4
add esp, 0x430
ret