Function at 0x40b323
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x445060]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x80c], ax
mov esi, edx
lea eax, [ebp - 0x80a]
mov dword [ebp - 0x870], edi
push eax
call fcn.00413ea0
add esp, 0xc
cmp dword [esi + 0x14], 0x10
jb 0x40b36a
mov esi, dword [esi]
lea edx, [ebp - 0x80c]
mov ecx, esi
call fcn.0040a52c
lea eax, [ebp - 0x858]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x80c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40b3a2
xor al, al
jmp 0x40b696
mov eax, dword [edi]
xor ebx, ebx
mov ecx, edi
inc ebx
push dword [eax + 4]
call fcn.00406eb7
mov eax, dword [edi]
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
and dword [edi + 4], 0
xor esi, esi
mov dword [ebp - 0x85c], esi
push 0x100
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00413ea0
xor eax, eax
mov dword [ebp - 0x860], 0x100
push 0x1fe
push eax
mov word [ebp - 0x40c], ax
lea eax, [ebp - 0x40a]
push eax
call fcn.00413ea0
add esp, 0x18
lea edx, [ebp - 0x40c]
lea ecx, [ebp - 0x20c]
call fcn.0040a52c
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
push dword [ebp - 0x858]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x868], eax
lea ecx, [ebp - 0x40c]
call fcn.0040a501
mov eax, dword [ebp - 0x868]
test eax, eax
jne 0x40b66b
and dword [ebp - 0x844], eax
lea ecx, [ebp - 0x854]
push dword [ebp - 0x860]
mov byte [ebp - 0x854], al
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x840], 0xf
call fcn.00401ea9
xor eax, eax
mov dword [ebp - 0x810], 0xf
push 0x100
push eax
mov dword [ebp - 0x814], eax
mov byte [ebp - 0x824], al
lea eax, [ebp - 0x10c]
push eax
call fcn.00413ea0
xor eax, eax
mov dword [ebp - 0x86c], 0x100
push 0x1fe
push eax
mov word [ebp - 0x60c], ax
lea eax, [ebp - 0x60a]
push eax
call fcn.00413ea0
add esp, 0x18
lea edx, [ebp - 0x60c]
lea ecx, [ebp - 0x20c]
call fcn.0040a52c
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x864]
push eax
push 0
lea eax, [ebp - 0x60c]
push eax
push dword [ebp - 0x858]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b647
push 4
pop eax
cmp dword [ebp - 0x864], eax
jne 0x40b5b4
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x864]
push eax
push 0
lea eax, [ebp - 0x60c]
push eax
push dword [ebp - 0x858]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b623
push 0x100
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00413ea0
push dword [ebp - 0x878]
lea eax, [ebp - 0x10c]
push 0x4271a4
push eax
call fcn.0040dc3c
lea eax, [ebp - 0x10c]
push eax
call fcn.00401f22
add esp, 0x1c
lea ecx, [ebp - 0x824]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00401ea9
jmp 0x40b623
mov eax, dword [ebp - 0x86c]
xor esi, esi
and dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0xf
mov byte [ebp - 0x83c], 0
test eax, eax
je 0x40b5fd
mov edi, eax
mov al, byte [ebp + esi - 0x10c]
test al, al
je 0x40b5f2
push eax
push ebx
lea ecx, [ebp - 0x83c]
call fcn.00404c29
inc esi
cmp esi, edi
jb 0x40b5da
mov edi, dword [ebp - 0x870]
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x824]
call fcn.00401b7b
push 0
push ebx
lea ecx, [ebp - 0x83c]
call fcn.00402153
mov esi, dword [ebp - 0x85c]
lea eax, [ebp - 0x854]
mov ecx, edi
push eax
call fcn.00406aba
lea ecx, [ebp - 0x824]
cmp eax, ecx
je 0x40b647
push 0xffffffffffffffff
push 0
push ecx
mov ecx, eax
call fcn.004021fa
push 0
push ebx
lea ecx, [ebp - 0x824]
call fcn.00402153
push 0
push ebx
lea ecx, [ebp - 0x854]
call fcn.00402153
mov eax, dword [ebp - 0x868]
jmp 0x40b672
cmp eax, 0x103
jne 0x40b686
inc esi
mov dword [ebp - 0x85c], esi
cmp eax, 0x103
jne 0x40b3cb
jmp 0x40b688
xor bl, bl
push dword [ebp - 0x858]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c1f3
mov esp, ebp
pop ebp
ret