Function at 0x402c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x54c
lea esi, [ebp - 0x418]
mov dword [esp + 0xc], 9
mov dword [esp + 8], str.softwaremicrosoftwindows_ntcurrentversionperflib
mov dword [esp + 4], str._s_03x
mov dword [esp], esi
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x528]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x402d20
mov eax, dword [ebp - 0x528]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp], 0x80000004
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x520]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x524]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x528]
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Counters
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x402cf3
mov ebx, dword [ebp - 0x520]
mov dword [esp], ebx
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x402cf3
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x520]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x524]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x528]
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0
mov dword [esp + 4], str.Counters
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x402ee8
cmp byte [edi], 0
je 0x4031ab
mov dword [ebp - 0x52c], edi
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x530], edi
lea esi, [esi]
mov ebx, dword [ebp - 0x52c]
mov dword [esp + 4], str.process
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcmpiA
sub esp, 8
test eax, eax
jne 0x402ef5
lea edi, [ebx - 2]
mov ebx, dword [sym.imp.msvcrt.dll___mb_cur_max]
jmp 0x402e37
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll__isctype
test eax, eax
je 0x402e55
sub edi, 1
cmp dword [ebx], 1
movsx eax, byte [edi]
jne 0x402e20
mov ecx, dword [sym.imp.msvcrt.dll__pctype]
mov edx, dword [ecx]
movzx eax, word [edx + eax*2]
and eax, 4
movzx eax, ax
test eax, eax
jne 0x402e34
lea edx, [edi + 1]
mov dword [esp + 4], edx
mov dword [esp], esi
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov ebx, dword [ebp - 0x52c]
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenA
lea eax, [ebx + eax + 1]
sub esp, 4
cmp byte [eax], 0
mov dword [ebp - 0x52c], eax
je 0x402f76
mov eax, dword [ebp - 0x52c]
cmp dword [ebp - 0x530], eax
mov ebx, dword [sym.imp.msvcrt.dll___mb_cur_max]
lea edi, [eax - 2]
jb 0x402ec2
jmp 0x402df0
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll__isctype
test eax, eax
je 0x402df0
sub edi, 1
cmp dword [ebx], 1
movsx eax, byte [edi]
jne 0x402ea7
mov ecx, dword [sym.imp.msvcrt.dll__pctype]
mov edx, dword [ecx]
movzx eax, word [edx + eax*2]
and eax, 4
movzx eax, ax
jmp 0x402eb7
test edi, edi
je 0x402cf3
mov dword [esp], edi
call sub.msvcrt.dll_free
jmp 0x402cf3
mov eax, dword [ebp - 0x52c]
mov dword [esp + 4], str.id_process
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpiA
sub esp, 8
test eax, eax
jne 0x402e67
mov eax, dword [ebp - 0x52c]
lea ebx, [eax - 2]
jmp 0x402f38
mov dword [esp + 4], 4
mov dword [esp], eax
call sub.msvcrt.dll__isctype
test eax, eax
je 0x402f60
sub ebx, 1
mov ecx, dword [sym.imp.msvcrt.dll___mb_cur_max]
movsx eax, byte [ebx]
cmp dword [ecx], 1
jne 0x402f21
mov ecx, dword [sym.imp.msvcrt.dll__pctype]
mov edx, dword [ecx]
movzx eax, word [edx + eax*2]
and eax, 4
movzx eax, ax
jmp 0x402f31
add ebx, 1
mov dword [esp], ebx
call sub.msvcrt.dll_atol
mov dword [ebp - 0x534], eax
jmp 0x402e67
mov edi, dword [ebp - 0x530]
mov dword [esp], edi
call sub.msvcrt.dll_free
mov dword [esp], 0xc800
mov dword [ebp - 0x520], 0xc800
call sub.msvcrt.dll_malloc
test eax, eax
mov edi, eax
je 0x402cf3
mov dword [esp + 8], 0xc800
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea esi, [esi]
lea eax, [ebp - 0x520]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x524]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], 0x80000004
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x403162
mov eax, dword [ebp - 0x520]
test eax, eax
je 0x402ee0
cmp dword [edi], 0x450050
jne 0x402ee8
cmp dword [edi + 4], 0x460052
jne 0x402ee8
mov ebx, dword [edi + 0x18]
add ebx, edi
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0x20]
add eax, ebx
test ecx, ecx
je 0x40305f
mov esi, dword [ebp - 0x534]
cmp dword [eax + 4], esi
je 0x4031ba
xor edx, edx
mov esi, dword [ebp - 0x534]
jmp 0x403055
cmp dword [eax + 4], esi
je 0x4031ba
add edx, 1
add eax, 0x28
cmp edx, ecx
jne 0x40304c
xor edi, edi
mov eax, dword [ebx + 0x28]
xor esi, esi
add ebx, dword [ebx + 4]
test eax, eax
mov dword [ebp - 0x52c], eax
jne 0x4030e6
jmp 0x4031c2
lea eax, [ebp - 0x51c]
mov dword [esp], edx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_lstrcpyA
mov ecx, dword [ebp + 8]
add ebx, dword [ebx]
mov eax, dword [ebx + edi]
add ebx, dword [ebx]
sub esp, 8
mov dword [ecx], eax
call sub.KERNEL32.dll_GetProcessHeap
mov dword [esp + 8], 0x10c
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_HeapAlloc
mov ecx, dword [ebp + 8]
sub esp, 0xc
test eax, eax
mov dword [ecx + 0x108], eax
je 0x4031c9
add esi, 1
cmp dword [ebp - 0x52c], esi
mov dword [eax + 0x108], 0
je 0x4031c2
mov dword [ebp + 8], eax
lea eax, [ebp - 0x51c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, dword [ebx + 0x10]
mov dword [esp + 4], 0
mov dword [esp], 0
add eax, ebx
mov dword [esp + 8], eax
call sub.KERNEL32.dll_WideCharToMultiByte
sub esp, 0x20
test eax, eax
mov eax, dword [ebp + 8]
lea edx, [eax + 4]
jne 0x403078
mov dword [esp], edx
mov dword [esp + 4], str.Unknown
mov dword [ebp - 0x530], edx
call sub.KERNEL32.dll_lstrcpyA
mov edx, dword [ebp - 0x530]
sub esp, 8
jmp 0x403078
cmp eax, 0xea
jne 0x402ee0
mov eax, dword [ebp - 0x520]
mov dword [esp], edi
add eax, 0x6400
mov dword [esp + 4], eax
mov dword [ebp - 0x520], eax
call sub.msvcrt.dll_realloc
mov dword [esp + 4], 0
mov edi, eax
mov eax, dword [ebp - 0x520]
mov dword [esp], edi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
jmp 0x402fc0
mov dword [ebp - 0x534], 0
jmp 0x402f7c
mov edi, dword [eax + 0x24]
jmp 0x403061
xor eax, eax
jmp 0x402d18
mov eax, 1
jmp 0x402d18