Function at 0x4047b8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x42e068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, 0x21c
mov dword [ebp - 0x358], eax
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x320]
push ecx
push eax
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], ecx
call fcn.004122e7
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x318]
mov dword [ebp - 0x320], edi
push 0x80
push eax
mov dword [ebp - 0x31c], 0xf
call fcn.0041657c
add esp, 0x1c
mov dword [ebp - 0x32c], 4
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x425790
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404df6
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 4
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push str.DefaultDrive
push dword [ebp - 0x340]
call ebx
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404df6
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 4
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.Priority
push dword [ebp - 0x340]
call ebx
movzx esi, ax
mov ebx, 0x80070000
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404df6
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x338]
push dword [ebp - 0x34c]
call fcn.0040473a
mov esi, eax
test esi, esi
js 0x404df6
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push str.Properties
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
xor eax, eax
inc eax
cmp esi, 0x80070002
cmove esi, eax
test esi, esi
js 0x404df6
jne 0x404af7
mov ebx, 0x100
lea eax, [ebp - 0x33c]
push ebx
push eax
call fcn.0040e2e8
mov esi, eax
test esi, esi
js 0x404df6
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 0x200
push eax
push dword [ebp - 0x33c]
xor ecx, ecx
lea eax, [ebp - 0x328]
push ecx
push ecx
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x338], ecx
push eax
push ecx
jmp 0x404ac2
cmp eax, 0xea
jne 0x404a53
mov ecx, dword [ebp - 0x32c]
lea eax, [ecx + ecx]
cmp ebx, eax
jae 0x404b66
lea ebx, [ecx*2 + 0x32]
push ebx
lea eax, [ebp - 0x33c]
push eax
call fcn.0040e2e8
mov esi, eax
test esi, esi
js 0x404df6
lea eax, [ebx + ebx]
mov dword [ebp - 0x328], 0x80
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x338]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404df6
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x104]
push dword [ebp - 0x33c]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
js 0x404df6
mov esi, dword [ebp - 0x338]
lea eax, [ebx + ebx]
mov dword [ebp - 0x32c], eax
inc esi
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x338], esi
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4049d9
push dword [ebp - 0x324]
call edi
and dword [ebp - 0x324], 0
mov ebx, 0x80070000
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push str.Sources
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, ebx
test eax, eax
push 1
cmovle esi, eax
cmp esi, 0x80070002
pop eax
cmove esi, eax
test esi, esi
js 0x404df6
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x404c71
xor esi, esi
lea eax, [ebp - 0x354]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x328]
mov dword [ebp - 0x338], esi
push eax
lea eax, [ebp - 0x104]
push eax
push esi
jmp 0x404c27
mov esi, 0x8000ffff
jmp 0x404df6
lea eax, [ebp - 0x330]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404df6
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x348]
push edx
push dword [ebp - 0x34c]
lea edx, [ebp - 0x104]
push dword [ebp - 0x330]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x348]
test ecx, ecx
je 0x404bf1
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor esi, esi
mov dword [ebp - 0x348], esi
jmp 0x404bf3
xor esi, esi
push dword [ebp - 0x330]
call edi
mov eax, dword [ebp - 0x338]
lea ecx, [ebp - 0x354]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x330], esi
push ecx
lea ecx, [ebp - 0x104]
inc eax
push ecx
mov dword [ebp - 0x338], eax
push eax
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
test eax, eax
je 0x404b70
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
xor eax, eax
cmp esi, 0x80070103
cmove esi, eax
test esi, esi
js 0x404df6
push dword [ebp - 0x324]
call edi
and dword [ebp - 0x324], 0
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push str.Resources
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
push 1
cmovle esi, eax
cmp esi, 0x80070002
pop eax
cmove esi, eax
test esi, esi
js 0x404df6
jne 0x404dd3
xor esi, esi
lea eax, [ebp - 0x354]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x328]
mov ebx, esi
push eax
lea eax, [ebp - 0x104]
push eax
push esi
jmp 0x404d89
lea eax, [ebp - 0x330]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404df6
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x344]
push edx
push dword [ebp - 0x330]
lea edx, [ebp - 0x104]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
js 0x404df6
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404d5f
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor esi, esi
mov dword [ebp - 0x344], esi
jmp 0x404d61
xor esi, esi
push dword [ebp - 0x330]
call edi
lea eax, [ebp - 0x354]
mov dword [ebp - 0x330], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x328]
inc ebx
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x404cda
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
xor eax, eax
cmp esi, 0x80070103
cmove esi, eax
test esi, esi
js 0x404df6
push dword [ebp - 0x324]
call edi
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov ecx, dword [ebp - 0x358]
mov eax, dword [ebp - 0x334]
and dword [ebp - 0x334], 0
xor esi, esi
mov dword [ecx], eax
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404e11
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x348]
test ecx, ecx
je 0x404e2c
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x33c], 0
je 0x404e40
push dword [ebp - 0x33c]
call fcn.0040e6a6
cmp dword [ebp - 0x330], 0
je 0x404e51
push dword [ebp - 0x330]
call edi
cmp dword [ebp - 0x324], 0
je 0x404e62
push dword [ebp - 0x324]
call edi
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x404e8d
mov eax, dword [ecx]
push ecx
call dword [eax + 0x7c]
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x404e8d
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411738
mov esp, ebp
pop ebp
ret 0x14