Function at 0x401170
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x378
mov dword [ebp - 0x358], eax
mov eax, 0xff
mov dword [ebp - 0x350], eax
xor eax, eax
mov dword [ebp - 0x35c], eax
jmp 0x401386
mov dword [esp], eax
lea ecx, [ebp - 0x34c]
xor edx, edx
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0xc], edx
mov edx, str.DisplayName
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call esi
sub esp, 0x18
test eax, eax
jne 0x401363
mov dword [esp + 0x14], edi
mov eax, 4
mov edx, str.WindowsInstaller
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x344]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x354]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x401220
cmp dword [ebp - 0x340], 4
je 0x4014a0
xor eax, eax
xor ecx, ecx
mov dword [esp + 8], eax
mov eax, str.UninstallString
xor edi, edi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x354]
lea ebx, [ebp - 0x348]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edi
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x401363
mov eax, dword [ebp - 0x348]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x360], eax
call eax
mov edx, str.UninstallString
mov dword [esp + 0x14], ebx
mov dword [esp + 4], edx
mov dword [esp + 0x10], eax
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
call esi
sub esp, 0x18
mov eax, dword [0x407004]
inc eax
mov dword [0x407004], eax
lea ebx, [eax + eax*4]
mov eax, dword [0x407008]
shl ebx, 2
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_realloc]
mov dword [0x407008], eax
lea ebx, [eax + ebx - 0x14]
mov eax, dword [ebp - 0x358]
mov dword [ebx], eax
lea eax, [ebp - 0x20c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov dword [ebx + 4], eax
mov eax, dword [0x407004]
lea edx, [eax + eax*4]
mov eax, dword [0x407008]
lea ebx, [eax + edx*4 - 0x14]
mov eax, dword [ebp - 0x34c]
mov dword [esp], eax
mov eax, dword [ebp - 0x360]
call eax
lea ecx, [ebp - 0x34c]
mov dword [ebx + 8], eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.DisplayName
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], ecx
mov dword [esp], eax
call esi
mov edx, dword [0x407004]
mov eax, dword [0x407008]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov dword [eax + 0xc], edi
sub esp, 0x18
test byte [section..data], 8
mov dword [eax + 0x10], 0
jne 0x4014f8
mov eax, dword [ebp - 0x354]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, 0xff
inc dword [ebp - 0x35c]
mov dword [ebp - 0x350], ecx
sub esp, 4
xor eax, eax
xor edx, edx
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x350]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x35c]
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x358]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
cmp eax, 0x103
je 0x401490
lea eax, [ebp - 0x354]
mov ecx, 0x20019
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x20c]
xor ebx, ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x358]
mov esi, 4
mov dword [esp + 0xc], ecx
lea edi, [ebp - 0x33c]
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x340]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x344]
mov dword [ebp - 0x33c], esi
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x14
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.SystemComponent
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x354]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x354]
jne 0x4011a0
cmp dword [ebp - 0x340], 4
jne 0x4011a0
cmp dword [ebp - 0x344], 1
jne 0x4011a0
jmp 0x401369
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [ebp - 0x344], 1
jne 0x401220
lea eax, [ebp - 0x20c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0x16]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x360], eax
call eax
mov edi, eax
mov dword [esp], edi
lea eax, [ebp - 0x20c]
mov dword [esp + 8], eax
mov eax, str.msiexec__x_s
mov dword [esp + 4], eax
call dword [0x40829c]
jmp 0x40129e
test edi, edi
je 0x401ba0
mov eax, edi
shr eax, 0x10
je 0x401600
mov dword [esp], edi
mov esi, 0xffffffff
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x401b60
cmp word [edi], 0
je 0x401aea
lea esi, [esi]
lea esi, [esi]
mov edx, eax
cmp word [edi + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x401540
mov ecx, 0x224c
mov word [ebp - 0x338], cx
lea ecx, [ebp - 0x336]
jmp 0x401595
cmp eax, 9
je 0x401760
cmp eax, 0xa
jne 0x40177a
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [ebp - 0x216]
lea eax, [edx - 1]
cmp ecx, esi
ja 0x4015d0
test edx, edx
jle 0x4015d0
mov edx, eax
movzx eax, word [edi]
add edi, 2
cmp eax, 0xd
je 0x4017d8
jbe 0x401568
cmp eax, 0x22
je 0x4017c8
cmp eax, 0x5c
jne 0x40176d
mov word [ecx], 0x5c5c
lea esi, [ebp - 0x216]
add ecx, 2
lea eax, [edx - 1]
cmp ecx, esi
jbe 0x40158f
lea esi, [esi]
mov byte [ecx], 0x22
test eax, eax
jle 0x401b03
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x338]
mov dword [esp], eax
call sym.___wine_dbg_strdup
jmp 0x401613
mov dword [esp], str._04x
movzx edi, di
mov dword [esp + 4], edi
call sym._wine_dbg_sprintf.constprop.0
mov dword [ebp - 0x364], eax
mov edx, dword [0x407004]
mov eax, dword [0x407008]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x401b90
mov eax, ebx
shr eax, 0x10
je 0x401850
mov dword [esp], ebx
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x401b10
cmp word [ebx], 0
je 0x401aa8
lea esi, [esi]
nop
mov edx, eax
cmp word [ebx + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x401670
mov dword [ebp - 0x360], ebx
lea ecx, [ebp - 0x336]
mov esi, 0x224c
mov word [ebp - 0x338], si
jmp 0x4016d3
cmp eax, 9
je 0x401750
cmp eax, 0xa
jne 0x4017f2
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea eax, [edx - 1]
test edx, edx
jle 0x401710
lea edi, [ebp - 0x216]
cmp ecx, edi
ja 0x401710
mov edx, eax
add dword [ebp - 0x360], 2
mov eax, dword [ebp - 0x360]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x401740
jbe 0x4016a0
cmp eax, 0x22
je 0x401840
cmp eax, 0x5c
jne 0x4017e5
mov word [ecx], 0x5c5c
lea eax, [edx - 1]
add ecx, 2
test edx, edx
jg 0x4016c7
lea esi, [esi]
mov byte [ecx], 0x22
test eax, eax
jle 0x401ac1
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x338]
mov dword [esp], eax
call sym.___wine_dbg_strdup
jmp 0x401863
mov word [ecx], 0x725c
add ecx, 2
jmp 0x4016c0
mov word [ecx], 0x745c
add ecx, 2
jmp 0x4016c0
mov word [ecx], 0x745c
add ecx, 2
jmp 0x401582
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x401a90
mov byte [ecx], 0x5c
mov ebx, eax
add ecx, 5
shr ebx, 0xc
movzx ebx, byte [ebx + str.0123456789abcdefwmain]
mov byte [ecx - 4], bl
mov ebx, eax
shr ebx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefwmain]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + str.0123456789abcdefwmain]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefwmain]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x401582
mov word [ecx], 0x225c
add ecx, 2
jmp 0x401582
mov word [ecx], 0x725c
add ecx, 2
jmp 0x401582
lea esi, [eax - 0x20]
cmp si, 0x5e
jbe 0x401aa0
mov byte [ecx], 0x5c
mov esi, eax
add ecx, 5
shr esi, 0xc
movzx ebx, byte [esi + str.0123456789abcdefwmain]
mov esi, eax
shr esi, 8
and esi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [esi + str.0123456789abcdefwmain]
mov esi, eax
shr esi, 4
and eax, 0xf
and esi, 0xf
movzx eax, byte [eax + str.0123456789abcdefwmain]
mov byte [ecx - 3], bl
movzx ebx, byte [esi + str.0123456789abcdefwmain]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x4016c0
mov word [ecx], 0x225c
add ecx, 2
jmp 0x4016c0
mov dword [esp], str._04x
movzx ebx, bx
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
mov edx, dword [0x407004]
mov edi, eax
mov eax, dword [0x407008]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x401b40
mov eax, ebx
shr eax, 0x10
je 0x401a20
mov dword [esp], ebx
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x401b50
cmp word [ebx], 0
je 0x401ac9
lea esi, [esi]
lea esi, [esi]
nop
mov edx, eax
cmp word [ebx + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x4018c0
mov dword [ebp - 0x360], ebx
lea ecx, [ebp - 0x336]
mov eax, 0x224c
mov word [ebp - 0x338], ax
jmp 0x401923
cmp eax, 9
je 0x4019a8
cmp eax, 0xa
jne 0x4019c2
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea eax, [edx - 1]
test edx, edx
jle 0x401960
lea esi, [ebp - 0x216]
cmp ecx, esi
ja 0x401960
mov edx, eax
add dword [ebp - 0x360], 2
mov eax, dword [ebp - 0x360]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x401998
jbe 0x4018f0
cmp eax, 0x22
je 0x401a10
cmp eax, 0x5c
jne 0x4019b5
mov word [ecx], 0x5c5c
lea eax, [edx - 1]
add ecx, 2
test edx, edx
jg 0x401917
lea esi, [esi]
nop
mov byte [ecx], 0x22
test eax, eax
jle 0x401ae2
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x338]
mov dword [esp], eax
call sym.___wine_dbg_strdup
mov edx, dword [0x407004]
jmp 0x401a39
mov word [ecx], 0x725c
add ecx, 2
jmp 0x401910
mov word [ecx], 0x745c
add ecx, 2
jmp 0x401910
lea esi, [eax - 0x20]
cmp si, 0x5e
jbe 0x401a80
mov byte [ecx], 0x5c
mov esi, eax
add ecx, 5
shr esi, 0xc
movzx ebx, byte [esi + str.0123456789abcdefwmain]
mov esi, eax
shr esi, 8
and esi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [esi + str.0123456789abcdefwmain]
mov esi, eax
shr esi, 4
and eax, 0xf
and esi, 0xf
movzx eax, byte [eax + str.0123456789abcdefwmain]
mov byte [ecx - 3], bl
movzx ebx, byte [esi + str.0123456789abcdefwmain]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x401910
mov word [ecx], 0x225c
add ecx, 2
jmp 0x401910
mov dword [esp], str._04x
movzx ebx, bx
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
mov edx, dword [0x407004]
mov dword [esp + 0x18], edi
mov esi, dword [ebp - 0x364]
mov ebx, str.allocated_entry__d:__s___s____s_n
mov dword [esp + 0x14], eax
mov edi, section..data
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], esi
mov esi, str.FetchFromRootKey
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401363
mov byte [ecx], al
inc ecx
jmp 0x401910
mov byte [ecx], al
inc ecx
jmp 0x401582
mov byte [ecx], al
inc ecx
jmp 0x4016c0
mov byte [ebp - 0x336], 0x22
lea ecx, [ebp - 0x336]
mov ebx, 0x224c
mov word [ebp - 0x338], bx
lea eax, [ecx + 1]
jmp 0x401728
mov byte [ebp - 0x336], 0x22
lea ecx, [ebp - 0x336]
mov eax, 0x224c
mov word [ebp - 0x338], ax
lea eax, [ecx + 1]
jmp 0x401978
mov byte [ebp - 0x336], 0x22
lea ecx, [ebp - 0x336]
mov eax, 0x224c
mov word [ebp - 0x338], ax
lea eax, [ecx + 1]
jmp 0x4015e8
mov edx, dword [0x407004]
mov edi, str._invalid_
mov eax, dword [0x407008]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ebx, dword [eax + 4]
test ebx, ebx
jne 0x401882
lea esi, [esi]
lea esi, [esi]
mov eax, str._null_
jmp 0x401a39
mov edx, dword [0x407004]
mov eax, str._invalid_
jmp 0x401a39
mov edx, dword [0x407004]
mov ebx, str._invalid_
mov dword [ebp - 0x364], ebx
mov eax, dword [0x407008]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x401636
lea esi, [esi]
nop
mov edi, str._null_
jmp 0x401877
mov ecx, str._null_
mov dword [ebp - 0x364], ecx
jmp 0x40162b