Function at 0x404230
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x448
mov ecx, 7
xor eax, eax
push ebx
push ebp
push esi
push edi
mov esi, str.SOFTWARESONIXPCCAMSNP2STD
lea edi, [esp + 0x154]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x39
lea edi, [esp + 0x171]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404690
cmp eax, 1
jne 0x404282
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push 0x20319
lea ecx, [esp + 0x15c]
push ebx
push ecx
jmp 0x404297
lea edx, [esp + 0x10]
xor ebx, ebx
push edx
push 0x20019
lea eax, [esp + 0x15c]
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0x4042b7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x448
ret
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push ebx
push ebx
push str.InstanceIndex
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 4
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 1
jb 0x40449f
mov edi, 1
mov dword [esp + 0x20], edi
push edi
lea eax, [esp + 0x2c]
push str.ii_04d
push eax
call fcn.0040cf76
add esp, 0xc
lea ecx, [esp + 0x18]
lea edx, [esp + 0x50]
lea eax, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ebx
push ebx
push eax
push ecx
mov byte [esp + 0x68], bl
mov dword [esp + 0x30], 0x104
call ebp
cmp byte [esp + 0x50], bl
je 0x40446c
mov edx, dword [str.RegistryMACHINE_]
mov eax, dword [0x4302c4]
mov ecx, dword [0x4302c8]
mov dword [esp + 0x30], edx
mov edx, dword [0x4302cc]
mov dword [esp + 0x34], eax
mov ax, word [0x4302d0]
mov dword [esp + 0x3c], edx
mov edx, dword [str.Settings]
mov word [esp + 0x40], ax
mov eax, dword [0x4302b8]
mov dword [esp + 0x38], ecx
mov cl, byte [0x4302d2]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
lea edx, [esp + 0x30]
mov byte [esp + 0x42], cl
mov cx, word [0x4302bc]
lea eax, [esp + 0x50]
push edx
push eax
mov word [esp + 0x54], cx
lea esi, [esp + 0x58]
call fcn.0040d110
mov edx, eax
add esp, 8
cmp edx, ebx
je 0x4043d5
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [esp + 0x44]
add esi, edx
push ecx
push esi
call fcn.0040d110
add esp, 8
cmp eax, ebx
je 0x4043d1
mov byte [eax], bl
mov edi, dword [esp + 0x20]
cmp esi, ebx
je 0x40446c
push 0x100
lea edx, [esp + 0x25c]
push esi
push edx
call fcn.0040d010
add esp, 0xc
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x258]
push eax
push 0x20019
push ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4042aa
lea edx, [esp + 0x24]
lea ecx, [esp + 0x358]
push edx
push ecx
push ebx
push ebx
push 0x4302a8
push eax
mov dword [esp + 0x3c], 0x100
call ebp
mov eax, dword [esp + 0x45c]
lea edx, [esp + 0x358]
push 0x100
push edx
push eax
call fcn.0040d010
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, ebx
je 0x40446c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebx
cmp edi, dword [esp + 0x14]
jae 0x40448e
lea ecx, [esp + 0x18]
lea edx, [esp + 0x50]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
push ecx
call ebp
test eax, eax
je 0x40449f
mov eax, dword [esp + 0x14]
inc edi
cmp edi, eax
mov dword [esp + 0x20], edi
jbe 0x4042f3
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4044ae
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x448
ret