Function at 0x402040
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
push ebx
push ebp
mov ebp, dword [esp + 0x128]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
xor esi, esi
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4020bf
mov edx, dword [eax - 0xc]
lea ecx, [eax - 0xc]
test edx, edx
jl 0x40209e
mov edx, dword [0x43734c]
add eax, 0xfffffff4
cmp eax, edx
je 0x4020bf
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402093
mov eax, dword [ebp]
sub eax, 0xc
push eax
call fcn.004292c0
add esp, 4
mov ecx, dword [0x437348]
mov dword [ebp], ecx
jmp 0x4020bf
mov edx, 0x43babc
test edx, edx
jne 0x4020ab
xor eax, eax
jmp 0x4020b2
push 0x43babc
call ebx
push 0x43babc
push eax
mov ecx, ebp
call fcn.00402510
lea eax, [esp + 0x14]
push eax
push 1
push 0
push str.SOFTWARERisingRav
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022af
push edi
mov ecx, 0x41
lea edi, [esp + 0x25]
mov byte [esp + 0x24], al
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.installpath
push ecx
mov dword [esp + 0x34], 1
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402295
lea edx, [esp + 0x24]
test edx, edx
jne 0x402135
xor ebx, ebx
jmp 0x40213e
lea eax, [esp + 0x24]
push eax
call ebx
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00402440
test eax, eax
je 0x40216e
mov edi, dword [ebp]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov dword [eax - 8], ebx
mov ecx, dword [ebp]
mov byte [ecx + ebx], 0
mov eax, dword [ebp]
mov esi, 1
mov ecx, dword [eax - 8]
cmp ecx, esi
jge 0x40217f
mov esi, ecx
mov ecx, dword [0x437348]
mov dword [esp + 0x10], ecx
mov edi, dword [eax - 8]
sub edi, esi
test esi, esi
jne 0x402198
mov dword [esp + 0x10], ecx
jmp 0x4021bf
push esi
lea ecx, [esp + 0x14]
call fcn.004023a0
test eax, eax
je 0x4021bf
mov ecx, esi
mov esi, dword [ebp]
mov edx, ecx
add esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
call fcn.004022c0
lea ecx, [esp + 0x10]
call fcn.004024e0
mov ecx, dword [esp + 0x14]
push 0x437448
push ecx
call fcn.00429736
mov ecx, dword [0x43734c]
add esp, 8
test eax, eax
mov eax, dword [esp + 0x14]
sete bl
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x40221c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40221c
mov eax, dword [esp + 0x14]
add eax, 0xfffffff4
push eax
call fcn.004292c0
add esp, 4
test bl, bl
je 0x402290
mov eax, dword [ebp]
mov ecx, dword [eax - 0xc]
mov ebx, dword [eax - 8]
lea esi, [eax - 0xc]
cmp ecx, 1
jle 0x402288
mov ecx, dword [0x43734c]
add eax, 0xfffffff4
cmp eax, ecx
je 0x402261
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x402258
mov ecx, dword [ebp]
sub ecx, 0xc
push ecx
call fcn.004292c0
add esp, 4
mov edx, dword [0x437348]
mov dword [ebp], edx
mov eax, dword [esi + 4]
mov ecx, ebp
push eax
call fcn.004023a0
test eax, eax
je 0x402288
mov ecx, dword [esi + 4]
mov edi, dword [ebp]
inc ecx
add esi, 0xc
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov byte [eax + ebx - 1], 0
mov esi, 1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4