Function at 0x403ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x454288]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x456db0], 0
push esi
push edi
jne 0x404354
lea eax, [ebp - 0x28]
push eax
push 1
push 0
push 0x43e974
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404386
push 0x200
mov dword [ebp - 0x20], 0x200
mov dword [ebp - 0x24], 1
call fcn.00426bea
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push str.Programs
push dword [ebp - 0x28]
call edi
test eax, eax
je 0x403d7f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x200
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push 0x43e9a8
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x404386
cmp word [esi], 0
jne 0x403d89
xor ecx, ecx
jmp 0x403d9f
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403d90
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, 0x456db4
call fcn.00404510
cmp dword [0x456dc8], 8
mov ecx, 0x456db4
mov eax, dword [0x456dc4]
cmovae ecx, dword [0x456db4]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x403dda
push 0x43e9ac
mov ecx, 0x456db4
call fcn.00403040
push esi
call fcn.004275a9
add esp, 4
lea ecx, [ebp - 0x1c]
mov edx, 0x456db4
push 0x43e9b0
call fcn.00403190
mov esi, eax
add esp, 4
cmp esi, 0x456de4
je 0x403e40
cmp dword [0x456df8], 8
jb 0x403e19
push dword [0x456de4]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [0x456df8], 7
push esi
mov ecx, 0x456de4
mov dword [0x456df4], 0
mov word [0x456de4], ax
call fcn.00403090
cmp dword [ebp - 8], 8
jb 0x403e51
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.skin_
mov edx, 0x456de4
lea ecx, [ebp - 0x1c]
call fcn.00403190
mov esi, eax
add esp, 4
cmp esi, 0x456dfc
je 0x403eae
cmp dword [0x456e10], 8
jb 0x403e87
push dword [0x456dfc]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [0x456e10], 7
push esi
mov ecx, 0x456dfc
mov dword [0x456e0c], 0
mov word [0x456dfc], ax
call fcn.00403090
cmp dword [ebp - 8], 8
jb 0x403ebf
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Data_
mov edx, 0x456db4
lea ecx, [ebp - 0x1c]
call fcn.00403190
mov esi, eax
add esp, 4
cmp esi, 0x456e14
je 0x403f1c
cmp dword [0x456e28], 8
jb 0x403ef5
push dword [0x456e14]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [0x456e28], 7
push esi
mov ecx, 0x456e14
mov dword [0x456e24], 0
mov word [0x456e14], ax
call fcn.00403090
cmp dword [ebp - 8], 8
jb 0x403f2d
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Docs_
mov edx, 0x456db4
lea ecx, [ebp - 0x1c]
call fcn.00403190
mov esi, eax
add esp, 4
cmp esi, 0x456e2c
je 0x403f8a
cmp dword [0x456e40], 8
jb 0x403f63
push dword [0x456e2c]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [0x456e40], 7
push esi
mov ecx, 0x456e2c
mov dword [0x456e3c], 0
mov word [0x456e2c], ax
call fcn.00403090
cmp dword [ebp - 8], 8
jb 0x403f9b
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.TFTPDROOT_
mov edx, 0x456db4
lea ecx, [ebp - 0x1c]
call fcn.00403190
mov esi, eax
add esp, 4
cmp esi, 0x456e44
je 0x403ff8
cmp dword [0x456e58], 8
jb 0x403fd1
push dword [0x456e44]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [0x456e58], 7
push esi
mov ecx, 0x456e44
mov dword [0x456e54], 0
mov word [0x456e44], ax
call fcn.00403090
cmp dword [ebp - 8], 8
jb 0x404009
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Wizard_
mov edx, 0x456e14
lea ecx, [ebp - 0x1c]
call fcn.00403190
mov esi, eax
add esp, 4
cmp esi, 0x456e5c
je 0x404066
cmp dword [0x456e70], 8
jb 0x40403f
push dword [0x456e5c]
call fcn.00426e53
add esp, 4
xor eax, eax
mov dword [0x456e70], 7
push esi
mov ecx, 0x456e5c
mov dword [0x456e6c], 0
mov word [0x456e5c], ax
call fcn.00403090
cmp dword [ebp - 8], 8
jb 0x404077
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push 0x200
mov dword [ebp - 0x20], 0x200
mov dword [ebp - 0x24], 1
call fcn.00426bea
add esp, 4
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push 0
push str.Data
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x404386
push esi
mov ecx, 0x456dcc
call fcn.004043a0
cmp dword [0x456de0], 8
mov ecx, 0x456dcc
mov eax, dword [0x456ddc]
cmovae ecx, dword [0x456dcc]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x4040eb
push 0x43e9ac
mov ecx, 0x456dcc
call fcn.00403040
push str.Connections_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456e74
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x40411c
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Everyone_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456e8c
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x40414d
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Logs_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456ebc
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x40417e
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Templates_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456ed4
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x4041af
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Terminals_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456eec
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x4041e0
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Keys_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456ea4
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x404211
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.DHCP_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456f04
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x404242
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Audit_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456f1c
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x404273
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Graphic_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456f34
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x4042a4
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.Chrome_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456f4c
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x4042d5
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.VLC_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456f64
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x404306
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push str.UpdateImages_
mov edx, 0x456dcc
lea ecx, [ebp - 0x1c]
call fcn.00403190
add esp, 4
mov ecx, 0x456f7c
push eax
call fcn.00401f80
cmp dword [ebp - 8], 8
jb 0x404337
push dword [ebp - 0x1c]
call fcn.00426e53
add esp, 4
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x404366
push esi
call fcn.004275a9
add esp, 4
mov byte [0x456db0], 1
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret
call fcn.00426c8a
push dword [eax]
push str.INTERNAL_ERROR___d_._Please__contact_WTware_tech_support.
push 0x54
push str.....common_fileio.cpp
push str.ERROR
call fcn.0040ae90
add esp, 0x14
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00426c47
mov esp, ebp
pop ebp
ret