Function at 0x403e10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1924
call fcn.00415130
mov eax, dword [0x41d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
lea ecx, [ebp - 0x1504]
push ecx
mov dword [ebp - 0x1924], eax
mov dword [ebp - 0x191c], edi
mov dword [ebp - 0x1914], edi
mov dword [ebp - 0x1920], edi
mov dword [ebp - 0x1908], edi
call fcn.00403b50
add esp, 4
test eax, eax
je 0x403e74
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a151
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, 0x65
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + str.SOFTWAREMicrosoftWindowsCurrentVersionMMDevicesAudio]
mov word [ebp + eax - 0xd04], cx
add eax, 2
cmp cx, di
jne 0x403e80
lea edi, [ebp - 0xd04]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403ea0
mov edx, dword [0x419ba4]
mov dword [edi], edx
mov eax, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403eb6
lea edi, [ebp - 0xd04]
sub eax, esi
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x403ed0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1914]
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0
lea ecx, [ebp - 0xd04]
push ecx
push 0x80000002
mov dword [ebp - 0x1918], 0
call edi
test eax, eax
je 0x403f48
lea edx, [ebp - 0x1914]
push edx
push 0x20119
push 0
lea eax, [ebp - 0xd04]
push eax
push 0x80000002
mov dword [ebp - 0x1918], 1
call edi
test eax, eax
jne 0x404407
mov dword [ebp - 0x190c], 0x66
mov dword [ebp - 0x1910], 0
mov esi, dword [ebp - 0x1908]
mov edx, dword [ebp - 0x1914]
push 0x200
lea ecx, [ebp - 0x1104]
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4043a3
lea eax, [ebp - 0x1104]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403f90
sub eax, edx
sar eax, 1
cmp eax, 0xff
jge 0x404352
xor eax, eax
lea esp, [esp]
movzx ecx, word [ebp + eax - 0xd04]
mov word [ebp + eax - 0x904], cx
add eax, 2
test cx, cx
jne 0x403fb0
lea edi, [ebp - 0x904]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x403fd1
mov eax, dword [0x419ba4]
mov dword [edi], eax
lea eax, [ebp - 0x1104]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403ff0
lea edi, [ebp - 0x904]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x404006
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x904]
rep movsb byte es:[edi], byte [esi]
add eax, 0xfffffffe
jmp 0x404030
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x404030
mov ecx, dword [str.Properties]
mov edx, dword [0x41a0c0]
mov dword [eax], ecx
mov ecx, dword [0x41a0c4]
mov dword [eax + 4], edx
mov edx, dword [0x41a0c8]
mov dword [eax + 8], ecx
mov ecx, dword [0x41a0cc]
mov dword [eax + 0xc], edx
mov edx, dword [0x41a0d0]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x1908]
lea ecx, [ebp - 0x504]
add eax, 0x1770
push ecx
mov ebx, str.83da6326_97a6_4088_9453_a1923f573b29_3
lea ecx, [ebp - 0x904]
mov dword [ebp - 0x190c], eax
call fcn.00403810
add esp, 4
cmp eax, 1
jne 0x404352
mov edx, dword [ebp - 0x1908]
add edx, 0x1b58
lea eax, [ebp - 0x504]
mov dword [ebp - 0x190c], edx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4040c0
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x504]
lea ecx, [ebp - 0x504]
cmp eax, ecx
jbe 0x4040f8
sub eax, 2
cmp word [eax], 0x3a
je 0x4040f5
lea edx, [ebp - 0x504]
cmp eax, edx
ja 0x4040e0
jmp 0x4040f8
add eax, 2
mov edx, eax
call fcn.004037a0
test eax, eax
jne 0x404352
inc dword [ebp - 0x1910]
lea eax, [ebp - 0x1904]
push eax
mov ebx, str.233164c8_1b2c_4c7d_bc68_b671687a2567_1
lea ecx, [ebp - 0x904]
call fcn.00403810
add esp, 4
cmp eax, 1
jne 0x404141
lea esi, [ebp - 0x1904]
call fcn.00403740
test eax, eax
jle 0x404141
mov dword [ebp - 0x1910], eax
mov ecx, dword [ebp - 0x1908]
mov eax, dword [ebp - 0x1924]
mov esi, dword [ebp + 0x10]
add ecx, 0x1f40
mov dword [ebp - 0x190c], ecx
test eax, eax
je 0x40421f
test esi, esi
jne 0x40419d
mov edx, dword [ebp - 0x1910]
push edx
push eax
lea eax, [ebp - 0x504]
push str._s__i
push eax
call fcn.0040a57a
lea eax, [ebp - 0x504]
add esp, 0x10
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404190
jmp 0x4041db
cmp esi, dword [ebp - 0x1910]
jne 0x40420d
lea edx, [ebp - 0x504]
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4041b0
lea eax, [ebp - 0x504]
lea edx, [eax + 2]
jmp 0x4041d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4041d0
sub eax, edx
sar eax, 1
inc eax
test eax, eax
jle 0x40420d
mov eax, dword [ebp - 0x1918]
push 0x41e360
lea ebx, [ebp - 0x504]
lea edi, [ebp - 0x904]
call fcn.00403930
add esp, 4
test eax, eax
jne 0x40420d
inc dword [ebp - 0x191c]
mov ecx, dword [ebp - 0x1908]
add ecx, 0x2328
mov dword [ebp - 0x190c], ecx
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x404352
test esi, esi
je 0x404363
cmp esi, dword [ebp - 0x1910]
jne 0x404352
cmp esi, dword [ebp - 0x1910]
jne 0x40433b
push eax
lea eax, [ebp - 0x104]
push 0x41a0e0
push eax
call fcn.0040a57a
lea eax, [ebp - 0x104]
add esp, 0xc
lea edx, [eax + 2]
jmp 0x404270
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404270
sub eax, edx
sar eax, 1
inc eax
test eax, eax
jle 0x40433b
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [ebp + eax - 0x1504]
mov word [ebp + eax - 0x504], cx
add eax, 2
test cx, cx
jne 0x404290
lea eax, [ebp - 0x504]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4042b1
mov ecx, dword [0x41a0e8]
mov dx, word [0x41a0ec]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [ebp - 0x104]
mov edx, eax
jmp 0x4042e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4042e0
lea edi, [ebp - 0x504]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4042f6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x1918]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x41e3b8
lea ebx, [ebp - 0x504]
lea edi, [ebp - 0x904]
call fcn.00403930
add esp, 4
test eax, eax
jne 0x40433b
inc dword [ebp - 0x191c]
mov eax, dword [ebp - 0x1908]
add eax, 0x2710
inc dword [ebp - 0x1920]
mov dword [ebp - 0x190c], eax
inc dword [ebp - 0x1908]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x403f5c
lea edx, [ebp - 0x104]
cmp eax, 0xc8
jge 0x404373
push eax
jmp 0x40437c
mov ecx, dword [ebp - 0x1910]
add ecx, eax
push ecx
push 0x41a0e0
push edx
call fcn.0040a57a
lea eax, [ebp - 0x104]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404393
jmp 0x40427b
mov eax, dword [ebp - 0x1914]
test eax, eax
je 0x4043b4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1914], 0
test esi, esi
jne 0x40441a
cmp dword [ebp - 0x1918], esi
jne 0x40441a
lea ecx, [ebp - 0x1914]
push ecx
push 0x20119
push esi
lea edx, [ebp - 0xd04]
push edx
push 0x80000002
mov dword [ebp - 0x1918], 1
mov dword [ebp - 0x190c], 0x67
call edi
test eax, eax
je 0x403f62
mov ebx, dword [ebp - 0x190c]
mov eax, dword [ebp - 0x1914]
test eax, eax
je 0x404420
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x404420
mov ebx, dword [ebp - 0x190c]
mov eax, dword [ebp - 0x191c]
test eax, eax
jle 0x40443d
pop ebx
pop edi
neg eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a151
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
jle 0x404462
xor eax, eax
cmp ebx, 0x2328
setge al
dec eax
and eax, ebx
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a151
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1920]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.0040a151
mov esp, ebp
pop ebp
ret