Function at 0x402c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x450
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x59]
mov byte [esp + 0x58], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x14], 0
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call esi
test eax, eax
je 0x402cac
lea ecx, [esp + 8]
push ecx
push str.SOFTWAREFinalDataOptions
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 8]
push eax
push 0xf003f
push 0
push str.SOFTWAREFinalDataOptions
push 0x80000002
call esi
test eax, eax
jne 0x402dd2
mov ecx, dword [esp + 0x45c]
lea eax, [ecx - 1]
cmp eax, 9
ja case.default.0x402cbf
jmp dword [eax*4 + 0x402e5c]
push 0x407264
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, 4
add esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
jmp 0x402e0b
push 0x407260
jmp 0x402d26
push 0x40725c
jmp 0x402d87
push 0x407258
jmp 0x402ccb
push 0x407254
jmp 0x402d26
push 0x407250
jmp 0x402d87
push 0x40724c
jmp 0x402ccb
push 0x407248
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
mov eax, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402e3f
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x450
ret 4
push str.DataPath
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, 4
add esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402e3f
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x450
ret 4
lea edx, [esp + 0x18]
push str.ProtectPaths
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], 0x400
push eax
lea ecx, [esp + 0x5c]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402e3f
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x450
ret 4
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x450
ret 4