Function at 0x40ca00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a2a8c
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x62e15c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x470]
mov dword [ebp - 0x4a0], edi
push eax
mov dword [ebp - 0x490], 0
call fcn.0043240c
add esp, 8
cmp dword [eax + 0x14], 8
jb 0x40ca62
mov eax, dword [eax]
lea ecx, [ebp - 0x490]
push ecx
push 0x109
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x45c]
mov esi, eax
cmp ecx, 8
jb 0x40ca98
inc ecx
push ecx
push dword [ebp - 0x470]
lea ecx, [ebp - 0x470]
call fcn.00402250
test esi, esi
je 0x40caa3
xor eax, eax
jmp 0x40cf2e
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x49c], esi
call fcn.0042e53d
test eax, eax
je 0x40cf1d
nop word [eax + eax]
push esi
mov ecx, edi
call fcn.0042d78e
mov esi, eax
mov ecx, esi
call fcn.0042e2c2
test al, al
jne 0x40cf1d
mov ecx, esi
call fcn.0042e2ca
test al, al
je 0x40cf1d
push 0x5a8f64
mov ecx, esi
call fcn.0042d7de
push str.type
mov ecx, esi
mov dword [ebp - 0x494], eax
call fcn.0042d7de
push 0x5a8f70
mov ecx, esi
mov edi, eax
call fcn.0042d7de
mov ecx, dword [ebp - 0x494]
mov esi, eax
call fcn.0042e2c2
test al, al
jne 0x40cf1d
mov ecx, dword [ebp - 0x494]
call fcn.0042e2dc
test al, al
je 0x40cf1d
mov ecx, edi
call fcn.0042e2c2
test al, al
jne 0x40cb52
mov ecx, edi
call fcn.0042e2dc
test al, al
jne 0x40cb6c
mov ecx, esi
call fcn.0042e2c2
test al, al
jne 0x40cb6c
mov ecx, esi
call fcn.0042e2dc
test al, al
jne 0x40cf1d
mov ecx, dword [ebp - 0x494]
lea eax, [ebp - 0x470]
push eax
call fcn.0042dcdd
push eax
lea eax, [ebp - 0x440]
mov dword [ebp - 4], 0
push eax
call fcn.0043240c
add esp, 8
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 2
call fcn.00403720
mov ecx, edi
call fcn.0042e2c2
test al, al
jne 0x40cbd0
mov ecx, edi
call fcn.0042e2dc
test al, al
je 0x40cbd0
mov ecx, esi
call fcn.0042e2c2
test al, al
jne 0x40cbd0
mov ecx, esi
call fcn.0042e2dc
test al, al
jne 0x40cc03
cmp dword [ebp - 0x42c], 8
lea eax, [ebp - 0x440]
push 0
cmovae eax, dword [ebp - 0x440]
push 0
push 0
push 0
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cf12
inc dword [ebx]
lea eax, [ebp - 0x428]
mov dword [ebp - 0x48c], 0
push eax
mov ecx, edi
call fcn.0042dcdd
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 3
push str.REG_SZ
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cc46
mov dword [ebp - 0x48c], 1
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_EXPAND_SZ
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cc6d
mov dword [ebp - 0x48c], 2
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_BINARY
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cc94
mov dword [ebp - 0x48c], 3
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_DWORD
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40ccbb
mov dword [ebp - 0x48c], 4
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_DWORD_LITTLE_ENDIAN
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cce2
mov dword [ebp - 0x48c], 4
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_DWORD_BIG_ENDIAN
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cd09
mov dword [ebp - 0x48c], 5
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_LINK
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cd30
mov dword [ebp - 0x48c], 6
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_MULTI_SZ
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cd57
mov dword [ebp - 0x48c], 7
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_RESOURCE_LIST
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cd7e
mov dword [ebp - 0x48c], 8
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_FULL_RESOURCE_DESCRIPTOR
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cda2
mov dword [ebp - 0x48c], 9
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_RESOURCE_REQUIREMENTS_LIST
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cdc6
mov dword [ebp - 0x48c], 0xa
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_QWORD
push eax
call fcn.0040bdc0
add esp, 8
test al, al
je 0x40cdea
mov dword [ebp - 0x48c], 0xb
jmp 0x40ce14
lea eax, [ebp - 0x428]
push str.REG_QWORD_LITTLE_ENDIAN
push eax
call fcn.0040bdc0
mov ecx, dword [ebp - 0x48c]
add esp, 8
test al, al
mov eax, 0xb
cmovne ecx, eax
mov dword [ebp - 0x48c], ecx
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.004463a0
add esp, 0xc
mov dword [ebp - 0x498], 0x200
lea eax, [ebp - 0x488]
mov ecx, esi
push eax
call fcn.0042dcdd
push eax
lea eax, [ebp - 0x458]
mov byte [ebp - 4], 4
push eax
call fcn.0043240c
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x488]
call fcn.00403720
mov eax, dword [ebp - 0x48c]
cmp eax, 2
je 0x40cf4c
cmp eax, 1
je 0x40cf4c
cmp eax, 7
je 0x40cf4c
cmp eax, 4
je 0x40ce90
cmp eax, 3
jne 0x40cefc
cmp dword [ebp - 0x42c], 8
lea ecx, [ebp - 0x498]
push ecx
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x48c]
push ecx
lea eax, [ebp - 0x440]
cmovae eax, dword [ebp - 0x440]
push 0
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cfb6
cmp dword [ebp - 0x444], 8
lea eax, [ebp - 0x458]
movsx esi, word [ebp - 0x410]
cmovae eax, dword [ebp - 0x458]
push eax
call fcn.00449bce
add esp, 4
cmp eax, esi
je 0x40cfb4
lea ecx, [ebp - 0x458]
call fcn.00402ca0
lea ecx, [ebp - 0x428]
call fcn.00403720
lea ecx, [ebp - 0x440]
call fcn.00402ca0
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043ae55
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 0x42c], 8
lea ecx, [ebp - 0x498]
push ecx
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x48c]
push ecx
lea eax, [ebp - 0x440]
cmovae eax, dword [ebp - 0x440]
push 0
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40cfb6
cmp dword [ebp - 0x444], 8
lea eax, [ebp - 0x458]
cmovae eax, dword [ebp - 0x458]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004465ad
add esp, 8
test eax, eax
je 0x40cefc
inc dword [ebx]
lea ecx, [ebp - 0x458]
call fcn.00402ca0
lea ecx, [ebp - 0x428]
call fcn.00403720
lea ecx, [ebp - 0x440]
mov dword [ebp - 4], 0xffffffff
call fcn.00402ca0
mov esi, dword [ebp - 0x49c]
mov edi, dword [ebp - 0x4a0]
inc esi
mov ecx, edi
mov dword [ebp - 0x49c], esi
call fcn.0042e53d
cmp esi, eax
jb 0x40cac0
jmp 0x40cf1d