Function at 0x401ab0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
push ebp
push esi
mov esi, dword [esp + 0x238]
test esi, esi
je 0x401d06
mov edx, dword [esp + 0x23c]
test edx, edx
je 0x401d06
mov ecx, dword [esp + 0x240]
test ecx, ecx
je 0x401d06
mov ebp, dword [esp + 0x244]
test ebp, ebp
je 0x401d06
mov dword [edx], 0
mov edx, dword [esp + 0x234]
mov dword [ecx], 0
lea ecx, [esp + 8]
push ecx
or eax, 0x20019
push eax
push 0
push esi
push edx
mov dword [ebp], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401cf8
lea eax, [esp + 0x24]
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x1c]
push 0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x401b7b
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, 0xfffffffc
pop ebp
add esp, 0x228
ret
cmp dword [esp + 0x10], 0x200
jb 0x401bc8
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x38]
push str.ERROR:_enumerateRegSubkeys___found_name_length__d_that_is_greater_than_MAX_REG_NAME_LEN_in_regkey__s._n
push ecx
call fcn.00458ee7
lea edx, [esp + 0x3c]
push edx
mov dword [esp + 0x40], 1
call fcn.0043e010
add esp, 0x14
pop esi
mov eax, 0xfffffffb
pop ebp
add esp, 0x228
ret
mov eax, dword [esp + 0xc]
test eax, eax
push ebx
push edi
jbe 0x401cbf
imul eax, eax, 0x208
mov esi, eax
push esi
call fcn.00459619
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x401c08
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
mov eax, 0xfffffffe
pop ebp
add esp, 0x228
ret
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x401cc7
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, ebx
mov edx, dword [esp + 0x10]
lea eax, [edi + 0x200]
push eax
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x40], 0x200
call ebp
test eax, eax
jne 0x401c71
mov eax, dword [esp + 0x14]
inc esi
add edi, 0x208
cmp esi, eax
jl 0x401c32
mov ebp, dword [esp + 0x24c]
jmp 0x401cc7
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0045932f
mov ecx, dword [esp + 0x244]
push esi
push ecx
lea edx, [esp + 0x44]
push str.ERROR:_enumerateRegSubkeys___RegEnumKeyEx_call_failed_for__s____d._n
push edx
call fcn.00458ee7
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x4c], 1
call fcn.0043e010
add esp, 0x18
pop edi
pop ebx
pop esi
mov eax, 0xfffffffa
pop ebp
add esp, 0x228
ret
xor eax, eax
mov dword [esp + 0x14], eax
xor ebx, ebx
mov ecx, dword [esp + 0x244]
mov edx, dword [esp + 0x1c]
mov dword [ecx], eax
mov eax, dword [esp + 0x248]
mov ecx, dword [esp + 0x10]
mov dword [eax], edx
push ecx
mov dword [ebp], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0x228
ret
pop esi
mov eax, 0xfffffffd
pop ebp
add esp, 0x228
ret
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x228
ret