Function at 0x40ff40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d209c
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.004c7c20
mov eax, dword [0x51501c]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
push ebp
push esi
mov eax, dword [0x51501c]
xor eax, esp
push eax
lea eax, [esp + 0x1064]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1074]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
push 0x20019
push ebx
push 0x4e61f4
push 0x80000001
mov dword [esp + 0x38], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], 0x800
call esi
test eax, eax
jne 0x410125
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebx
push 0x4e6428
push eax
call esi
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x41011e
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
push 0x4e6448
push edx
call esi
test eax, eax
jne 0x410117
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push 0x4e6450
push edx
call esi
test eax, eax
jne 0x410068
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x28]
push edx
push ebx
push 0x4e6450
push eax
call esi
test eax, eax
jne 0x410068
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x60]
push ecx
shr edx, 1
push edx
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push ebx
push 0x4e6470
push edx
call esi
test eax, eax
jne 0x41010a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x64]
push ecx
push ebx
push ebx
push 0x4e6470
push edx
call esi
test eax, eax
jne 0x41010a
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x60]
push eax
shr ecx, 1
push ecx
push edi
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
add esp, 0xc
push edi
lea ecx, [esp + 0x48]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0x4e6494
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1078], ebx
call dword [sym.imp.MSVCP80.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
lea eax, [esp + 0x28]
call fcn.00413460
lea ecx, [esp + 0x28]
mov bl, al
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x44]
mov dword [esp + 0x106c], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call ebp
mov eax, dword [esp + 0x1c]
push eax
call ebp
mov al, bl
mov ecx, dword [esp + 0x1064]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1050]
xor ecx, esp
call fcn.00459ea4
add esp, 0x1060
ret