Function at 0x412f30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x454288]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x48]
mov edi, edx
push 0
push eax
mov ebx, ecx
call fcn.00430ad0
add esp, 0xc
xor ecx, ecx
lea esp, [esp]
cmp ecx, 0x3f
je 0x412f80
mov al, byte [ecx + str.6.2.28]
mov byte [ebp + ecx - 0x48], al
inc ecx
cmp byte [ecx + str.6.2.28], 0
jne 0x412f60
mov byte [ebp + ecx - 0x48], 0
jmp 0x412f84
mov byte [ebp - 9], 0
lea eax, [ebp - 0x90]
mov dword [ebp - 0x8c], 0
push eax
push 1
push 0
push str.SoftwareWTware
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x412fe6
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 4
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 0
push str.httpboot
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [edi + 0x2e], 0
lea ecx, [edi + 0x2e]
je 0x413019
test ecx, ecx
jne 0x412ff8
mov byte [ebp - 0x48], cl
jmp 0x413019
xor edx, edx
cmp byte [ecx], dl
je 0x413014
lea esi, [ebp - 0x48]
sub esi, ecx
cmp edx, 0x3f
je 0x413030
mov al, byte [ecx]
inc edx
mov byte [esi + ecx], al
inc ecx
cmp byte [ecx], 0
jne 0x413003
mov byte [ebp + edx - 0x48], 0
mov eax, dword [edi + 0x40]
test eax, eax
je 0x413036
xor edx, edx
cmp eax, 2
sete dl
mov dword [ebp - 0x8c], edx
jmp 0x41303c
mov byte [ebp - 9], 0
jmp 0x413019
mov edx, dword [ebp - 0x8c]
xor ecx, ecx
cmp edx, 1
jne 0x413070
cmp ecx, 0x3f
je 0x413096
mov al, byte [ecx + str.wtware.http]
mov byte [ebp + ecx - 0x88], al
inc ecx
cmp byte [ecx + str.wtware.http], 0
jne 0x413043
mov byte [ebp + ecx - 0x88], 0
jmp 0x41309a
cmp ecx, 0x3f
je 0x413096
mov al, byte [ecx + str.wtware.pxe]
mov byte [ebp + ecx - 0x88], al
inc ecx
cmp byte [ecx + str.wtware.pxe], 0
jne 0x413070
mov byte [ebp + ecx - 0x88], 0
jmp 0x41309a
mov byte [ebp - 0x49], 0
mov eax, dword [edi + 4]
cmp eax, 3
jne 0x4130dd
push str.CLIENT_CLASS_INFO_is_PI2__bootfilename_is_kernel7.img
call fcn.0040ae40
add esp, 4
xor ecx, ecx
cmp ecx, 0x3f
je 0x4130d7
mov al, byte [ecx + str.kernel7.img]
mov byte [ebp + ecx - 0x88], al
inc ecx
cmp byte [ecx + str.kernel7.img], 0
jne 0x4130b1
mov byte [ebp + ecx - 0x88], 0
jmp 0x413115
mov byte [ebp - 0x49], 0
jmp 0x413115
cmp eax, 2
jne 0x413115
cmp edx, 1
jne 0x4130f8
push str.Client_System_Architecture_Type_is_UEFI__bootfilename_is_http.efi
call fcn.0040ae40
mov edx, str.http.efi
jmp 0x413107
push str.Client_System_Architecture_Type_is_UEFI__bootfilename_is_bootx64.efi
call fcn.0040ae40
mov edx, str.bootx64.efi
add esp, 4
lea ecx, [ebp - 0x88]
call fcn.00414d10
push ecx
lea ecx, [ebp - 0x48]
call fcn.00414d60
add esp, 4
xor edx, edx
cmp byte [ebp + edx - 0x48], 0
je 0x413154
cmp byte [ebp + edx - 0x47], 0
je 0x413153
cmp byte [ebp + edx - 0x46], 0
je 0x41314e
cmp byte [ebp + edx - 0x45], 0
je 0x413149
add edx, 4
cmp edx, 0x40
jb 0x413123
jmp 0x413154
add edx, 3
jmp 0x413154
add edx, 2
jmp 0x413154
inc edx
xor esi, esi
cmp byte [ebp - 0x88], 0
je 0x413198
mov edi, edx
lea eax, [ebp - 0x88]
sub edi, eax
lea esp, [esp]
lea eax, [edi + esi]
lea eax, [ebp + eax - 0x88]
cmp eax, 0x3f
jae 0x413198
mov al, byte [ebp + esi - 0x88]
lea ecx, [edx + esi]
inc esi
mov byte [ebp + ecx - 0x48], al
cmp byte [ebp + esi - 0x88], 0
jne 0x413170
lea eax, [edx + esi]
cmp eax, 0x3f
jbe 0x4131a6
mov byte [ebp - 9], 0
jmp 0x4131ab
mov byte [ebp + eax - 0x48], 0
lea edi, [ebx + 0x6c]
test edi, edi
je 0x4131dc
xor edx, edx
cmp byte [ebp - 0x48], dl
je 0x4131d8
mov esi, edi
lea eax, [ebp - 0x48]
sub esi, eax
cmp edx, 0x7f
je 0x4131ed
mov al, byte [ebp + edx - 0x48]
lea ecx, [esi + edx]
inc edx
mov byte [ebp + ecx - 0x48], al
cmp byte [ebp + edx - 0x48], 0
jne 0x4131c0
mov byte [edx + edi], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00426c47
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov byte [edi + 0x7f], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00426c47
mov esp, ebp
pop ebp
ret