Function at 0x403086
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov dword [ebp - 0xdc], 0
lea eax, [ebp - 0xdc]
push eax
push 0x20019
push 0
push 0x412e58
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x403178
mov dword [ebp - 0x68], 4
cmp dword [ebp - 0x6c], 0
je 0x403107
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0xd8]
push edx
push 0
push 0
push 0x412e7c
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403107
mov dword [ebp - 0xe0], 1
jmp 0x403111
mov dword [ebp - 0xe0], 0
mov ecx, dword [ebp - 0xe0]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], 4
cmp dword [ebp - 0x6c], 0
je 0x403158
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0xd4]
push eax
push 0
push 0
push 0x412e90
mov ecx, dword [ebp - 0xdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403158
mov dword [ebp - 0xe4], 1
jmp 0x403162
mov dword [ebp - 0xe4], 0
mov edx, dword [ebp - 0xe4]
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6c], 0
je 0x4031ac
lea ecx, [ebp - 0xdc]
push ecx
push 0x20019
push 0
push 0x412ea0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4031ac
mov dword [ebp - 0xe8], 1
jmp 0x4031b6
mov dword [ebp - 0xe8], 0
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0
je 0x403220
mov dword [ebp - 0x68], 0x64
cmp dword [ebp - 0x6c], 0
je 0x403200
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x64]
push ecx
push 0
push 0
push 0x412ebc
mov edx, dword [ebp - 0xdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403200
mov dword [ebp - 0xec], 1
jmp 0x40320a
mov dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0xdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6c], 0
je 0x403254
lea edx, [ebp - 0xdc]
push edx
push 0x20019
push 0
push 0x412ec8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403254
mov dword [ebp - 0xf0], 1
jmp 0x40325e
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x4032cb
mov dword [ebp - 0x68], 0x64
cmp dword [ebp - 0x6c], 0
je 0x4032ab
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0xd0]
push edx
push 0
push 0
push 0x412eec
mov eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4032ab
mov dword [ebp - 0xf4], 1
jmp 0x4032b5
mov dword [ebp - 0xf4], 0
mov ecx, dword [ebp - 0xf4]
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0xdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6c], 0
je 0x4032f2
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4032f2
mov dword [ebp - 0xf8], 1
jmp 0x4032fc
mov dword [ebp - 0xf8], 0
mov edx, dword [ebp - 0xf8]
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 0
jne 0x403312
mov eax, 0x80000000
jmp 0x40334a
cmp dword [ebp - 0xd4], 0
je 0x403322
mov eax, 2
jmp 0x40334a
cmp dword [ebp + 8], 0
je 0x403338
cmp dword [ebp - 0xd8], 0
je 0x403338
mov eax, 1
jmp 0x40334a
call fcn.00402ffd
test eax, eax
je 0x403345
xor eax, eax
jmp 0x40334a
mov eax, 0x80000001
mov esp, ebp
pop ebp
ret