Function at 0x402ab0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1ac
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x15c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
sub esp, 8
test eax, eax
je 0x403070
cmp dword [ebp - 0x15c], 1
sbb eax, eax
mov dword [ebp - 0x174], eax
xor al, al
not dword [ebp - 0x174]
add eax, 0x20119
and dword [ebp - 0x174], 0x10000
mov dword [ebp - 0x178], eax
mov ebx, dword [ebp - 0x178]
lea ecx, [ebp - 0x158]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x158], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products
mov dword [esp], 0x80000002
mov dword [ebp - 0x188], esi
call esi
sub esp, 0x14
test eax, eax
jne 0x4030f3
mov edi, dword [ebp - 0x158]
lea eax, [ebp - 0x160]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [ebp - 0x16c], edi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test eax, eax
jne 0x403090
mov ebx, dword [ebp - 0x160]
test ebx, ebx
je 0x403216
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea esi, [ebp - 0x118]
mov dword [ebp - 0x17c], edx
jmp 0x402c60
lea ecx, [ebp - 0x130]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040aaf0
mov edx, dword [ebp - 0x130]
mov dword [esp + 4], ebx
mov dword [esp], str.RegEnumKeyExA_failed__li__s_n
mov dword [esp + 8], edx
call fcn.00402a90
mov ebx, dword [ebp - 0x130]
lea ecx, [ebx - 0xc]
cmp ecx, 0x484aa4
jne 0x403227
add edi, 1
cmp dword [ebp - 0x160], edi
jbe 0x403050
mov ecx, dword [ebp - 0x16c]
lea eax, [ebp - 0x154]
mov dword [ebp - 0x154], 0x100
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
sub esp, 0x20
test eax, eax
mov ebx, eax
jne 0x402c10
lea edx, [ebp - 0x130]
mov dword [esp + 4], edx
lea ecx, [ebp - 0x150]
mov dword [esp], str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products
call fcn.00455060
lea ecx, [ebp - 0x150]
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], 0x485a31
call fcn.00453e00
mov edx, esi
sub esp, 8
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
mov ecx, eax
and ecx, 0x80808080
je 0x402cf6
mov ebx, ecx
shr ebx, 0x10
test eax, 0x8080
mov eax, ecx
cmove eax, ebx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
sbb edx, 3
sub edx, esi
mov dword [esp + 4], edx
lea ecx, [ebp - 0x150]
mov dword [esp], esi
call fcn.00453e00
lea ecx, [ebp - 0x150]
sub esp, 8
mov dword [esp + 4], 0x12
mov dword [esp], str.InstallProperties
call fcn.00453e00
mov ebx, dword [ebp - 0x178]
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x14c], 0
sub esp, 8
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call dword [ebp - 0x188]
sub esp, 0x14
test eax, eax
jne 0x402ec7
mov eax, dword [0x485a6e]
mov ecx, dword [ebp - 0x14c]
mov ebx, dword [str.DisplayName]
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x12c], eax
mov eax, dword [0x485a7a]
mov edx, ecx
mov dword [ebp - 0x170], ecx
mov ecx, dword [0x485a72]
mov dword [ebp - 0x130], ebx
mov ebx, dword [0x485a76]
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x174]
mov dword [esp + 0x14], 0
mov dword [ebp - 0x128], ecx
mov ecx, dword [0x485a7e]
mov dword [ebp - 0x124], ebx
lea ebx, [ebp - 0x148]
or eax, 2
mov dword [ebp - 0x180], eax
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov dword [ebp - 0x11c], ecx
lea ecx, [ebp - 0x130]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], edx
mov dword [ebp - 0x184], eax
call eax
sub esp, 0x1c
cmp eax, 0xea
je 0x402f04
test eax, eax
je 0x402f04
lea ebx, [ebp - 0x138]
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x180], eax
call fcn.0040aaf0
mov ecx, dword [ebp - 0x138]
mov edx, dword [ebp - 0x180]
mov dword [esp], str.RegGetValueW_failed__li__s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call fcn.00402a90
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0xc]
cmp ecx, 0x484aa4
jne 0x4032e9
mov ecx, dword [ebp - 0x170]
mov dword [esp], ecx
call dword [ebp - 0x17c]
sub esp, 4
mov ebx, dword [ebp - 0x150]
lea ecx, [ebx - 0xc]
cmp ecx, 0x484aa4
je 0x402c51
mov edx, 0xffffffff
lock xadd dword [ebx - 4], edx
test edx, edx
jg 0x402c51
lea eax, [ebp - 0x13c]
mov dword [esp], eax
call fcn.00453930
sub esp, 4
jmp 0x402c51
lea ecx, [ebp - 0x138]
call fcn.0040abe0
mov ecx, dword [ebp - 0x148]
shr ecx, 1
mov dword [esp], ecx
lea ecx, [ebp - 0x138]
call fcn.0040ac20
lea ecx, [ebp - 0x138]
sub esp, 4
call fcn.0040ac10
mov edx, dword [ebp - 0x170]
mov dword [esp + 0x18], ebx
lea ebx, [ebp - 0x130]
mov dword [esp + 8], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x180]
mov dword [esp + 0xc], eax
call dword [ebp - 0x184]
sub esp, 0x1c
test eax, eax
mov ebx, eax
je 0x402fc8
lea eax, [ebp - 0x13c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0040aaf0
mov ecx, dword [ebp - 0x13c]
mov dword [esp + 4], ebx
mov dword [esp], str.RegGetValueW_failed__li__s_n
mov dword [esp + 8], ecx
call fcn.00402a90
mov ebx, dword [ebp - 0x13c]
lea ecx, [ebx - 0xc]
cmp ecx, 0x484aa4
jne 0x403299
lea ecx, [ebp - 0x138]
call fcn.0040abf0
jmp 0x402eb5
lea ecx, [ebp - 0x138]
mov dword [esp], ecx
lea ecx, [ebp - 0x144]
call fcn.0040b230
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x144]
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40314a
lea ecx, [ebx - 0xc]
cmp ecx, 0x484aa4
jne 0x4032c1
lea ecx, [ebp - 0x138]
call fcn.0040abf0
mov ecx, dword [ebp - 0x170]
mov dword [esp], ecx
call dword [ebp - 0x17c]
mov ebx, dword [ebp - 0x150]
lea ecx, [ebx - 0xc]
sub esp, 4
cmp ecx, 0x484aa4
jne 0x402edc
add edi, 1
cmp dword [ebp - 0x160], edi
ja 0x402c60
lea esi, [esi]
xor ebx, ebx
mov esi, dword [ebp - 0x16c]
mov dword [esp], esi
call dword [ebp - 0x17c]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x178], 0x20019
jmp 0x402b20
lea edi, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], edi
mov dword [ebp - 0x170], eax
call fcn.0040aaf0
mov ecx, dword [ebp - 0x170]
mov esi, dword [ebp - 0x118]
mov dword [esp], str.RegQueryInfoKeyW_failed__li__s_n
mov dword [esp + 4], ecx
mov dword [esp + 8], esi
call fcn.00402a90
mov eax, dword [ebp - 0x118]
lea ecx, [eax - 0xc]
cmp ecx, 0x484aa4
jne 0x403311
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0xffffffff
mov dword [ebp - 0x17c], edi
jmp 0x403052
lea ecx, [ebp - 0x118]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [ebp - 0x16c], eax
call fcn.0040aaf0
mov eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x16c]
mov dword [esp], str.RegOpenKeyEx_failed__li__s_n
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call fcn.00402a90
mov ebx, dword [ebp - 0x118]
lea ecx, [ebx - 0xc]
cmp ecx, 0x484aa4
jne 0x40324f
mov ebx, 0xffffffff
jmp 0x403064
mov eax, dword [ebp - 0x174]
lea esi, [ebp - 0x140]
mov ebx, 0xffffffff
mov edx, dword [ebp - 0x170]
lea edi, [ebp - 0x13c]
mov dword [esp + 0x14], esi
mov dword [ebp - 0x13c], 4
or eax, 0x18
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Version
mov dword [esp + 4], 0
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov esi, dword [ebp - 0x144]
lea ecx, [esi - 0xc]
sub esp, 0x1c
test eax, eax
cmove ebx, dword [ebp - 0x140]
cmp ecx, 0x484aa4
jne 0x403277
lea ecx, [ebp - 0x138]
call fcn.0040abf0
mov ecx, dword [ebp - 0x170]
mov dword [esp], ecx
call dword [ebp - 0x17c]
mov esi, dword [ebp - 0x150]
lea ecx, [esi - 0xc]
sub esp, 4
cmp ecx, 0x484aa4
je 0x403052
mov edx, 0xffffffff
lock xadd dword [esi - 4], edx
test edx, edx
jg 0x403052
mov dword [esp], edi
call fcn.00453930
sub esp, 4
jmp 0x403052
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x17c], esi
jmp 0x403050
mov eax, 0xffffffff
lock xadd dword [ebx - 4], eax
test eax, eax
jg 0x402c51
lea edx, [ebp - 0x138]
mov dword [esp], edx
call fcn.00453930
sub esp, 4
jmp 0x402c51
mov edi, 0xffffffff
lock xadd dword [ebx - 4], edi
test edi, edi
jg 0x403140
lea esi, [ebp - 0x130]
mov dword [esp], esi
call fcn.00453930
sub esp, 4
jmp 0x403140
mov eax, 0xffffffff
lock xadd dword [esi - 4], eax
test eax, eax
jg 0x4031c2
mov dword [esp], edi
call fcn.00453930
sub esp, 4
jmp 0x4031c2
mov edx, 0xffffffff
lock xadd dword [ebx - 4], edx
test edx, edx
jg 0x402fb8
lea eax, [ebp - 0x140]
mov dword [esp], eax
call fcn.00453930
sub esp, 4
jmp 0x402fb8
mov edx, 0xffffffff
lock xadd dword [ebx - 4], edx
test edx, edx
jg 0x40300b
lea ebx, [ebp - 0x13c]
mov dword [esp], ebx
call fcn.00453930
sub esp, 4
jmp 0x40300b
mov ebx, 0xffffffff
lock xadd dword [eax - 4], ebx
test ebx, ebx
jg 0x402eb5
lea edx, [ebp - 0x13c]
mov dword [esp], edx
call fcn.00453930
sub esp, 4
jmp 0x402eb5
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4030dd
lea ebx, [ebp - 0x130]
mov dword [esp], ebx
call fcn.00453930
sub esp, 4
jmp 0x4030dd