Function at 0x401289
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
push esi
push edi
lea edi, [ebp - 0x480]
mov ecx, 0x120
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x3fff
and dword [ebp - 0x228], 0
mov esi, esp
lea eax, [ebp - 0x240]
push eax
push 0x20019
push 0
push 0x414400
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
je 0x4012f5
mov eax, dword [ebp - 8]
jmp 0x4014da
mov esi, esp
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
push 0
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x4014c2
cmp dword [ebp - 0x228], 0
jbe 0x4014c2
and dword [ebp - 0x248], 0
jmp 0x401360
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x228]
jae 0x4014c2
mov dword [ebp - 0x21c], 0xff
mov esi, esp
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x4014bd
mov esi, esp
lea eax, [ebp - 0x254]
push eax
push 1
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
jne 0x4014a8
and dword [ebp - 0x260], 0
push 0x208
push 0
lea eax, [ebp - 0x470]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0x47c], 0x104
mov esi, esp
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.00411cf8
test eax, eax
jne 0x4014a8
mov esi, esp
push str.IApplicationAssociationRegistrationInternal
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00411cf8
test eax, eax
jne 0x4014a8
mov esi, esp
lea eax, [ebp - 0x210]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00411cf8
mov esi, esp
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411cf8
mov dword [ebp - 8], 1
jmp 0x4014c2
mov esi, esp
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411cf8
jmp 0x401353
mov esi, esp
push dword [ebp - 0x240]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00411cf8
mov eax, dword [ebp - 8]
push edx
mov ecx, ebp
push eax
lea edx, [0x401509]
call fcn.00411ca2
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411d30
add esp, 0x480
cmp ebp, esp
call fcn.00411cf8
leave
ret