Function at 0x409b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bd716
mov eax, dword fs:[0]
push eax
sub esp, 0x970
mov eax, dword [0x515e20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x978], eax
mov eax, dword [0x5159f8]
xor ebx, ebx
cmp byte [0x517420], bl
mov ecx, 0x5159f8
sete bl
mov dword [ebp - 4], 0
add ebx, 0x80000001
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x960], eax
mov byte [ebp - 4], 1
call fcn.0040ba10
mov ecx, dword [0x5174d0]
test al, al
mov edx, 0xcbb1e89f
cmove ecx, edx
or edi, 0xffffffff
cmp byte [ebp + 0x10], 0
mov dword [0x5174d0], ecx
je 0x409c29
cmp byte [0x51102c], 0
jne 0x409c29
mov eax, dword [0x517570]
cmp dword [eax - 0xc], 0
jne 0x409bd8
mov ebx, SysReAllocStringLen
jmp 0x409c29
push 0x4d3314
lea eax, [ebp - 0x958]
push 0x517570
push eax
mov ebx, VariantInit
call fcn.00402ae0
add esp, 0xc
push eax
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 2
call fcn.00402610
mov edx, dword [ebp - 0x958]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409c29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x970], 0
mov dword [ebp - 0x96c], 0
mov dword [ebp - 0x968], 0
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
mov byte [ebp - 4], 3
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x954], eax
mov eax, 0x4d337c
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x409c92
movzx esi, ax
push 0
push esi
call fcn.00403010
add esp, 8
test eax, eax
je 0x409ca2
push esi
push eax
lea ecx, [ebp - 0x954]
call fcn.00406b10
jmp 0x409ca2
push 0x4d337c
lea ecx, [ebp - 0x954]
call fcn.00402750
lea eax, [ebp - 0x954]
push eax
lea eax, [ebp - 0x960]
push eax
lea eax, [ebp - 0x97c]
push eax
mov byte [ebp - 4], 5
call fcn.00402a20
push 0x517574
push eax
lea eax, [ebp - 0x974]
push eax
mov byte [ebp - 4], 6
call fcn.00402a20
push 0x4d3314
push eax
lea eax, [ebp - 0x95c]
push eax
mov byte [ebp - 4], 7
call fcn.00402ae0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x958]
push eax
mov byte [ebp - 4], 8
call fcn.00402a20
add esp, 0x30
lea ecx, [ebp - 0x970]
push 1
push dword [eax]
push ebx
call fcn.0040ab40
mov edx, dword [ebp - 0x958]
test eax, eax
setne bl
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409d38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x95c]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409d5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x974]
add edx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409d7e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x97c]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409da1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x954]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x409dc4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x409dd5
mov esi, dword [ebp - 0x970]
xor bl, bl
jmp 0x40a02b
mov dword [ebp - 0x964], 0x400
call fcn.0040b980
test al, al
jne 0x409e4c
mov esi, dword [0x517280]
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
lea ecx, [eax + eax*2]
shl ecx, 3
mov eax, esi
sub eax, ecx
cmp eax, 0x46
je 0x409e43
mov eax, esi
or eax, 0xffffff32
add esi, eax
mov eax, esi
imul eax, esi
inc edi
cmp edi, eax
jg 0x409e43
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
shl ecx, 3
mov eax, esi
sub eax, ecx
cmp eax, 0x46
jne 0x409e10
mov dword [0x517280], edi
or edi, 0xffffffff
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
call fcn.0049f660
mov esi, dword [ebp - 0x970]
add esp, 0xc
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc ebx
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x958], ebx
test eax, eax
je 0x409eac
cmp eax, 0x103
jne 0x40a014
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x954], eax
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 9
test eax, 0xffff0000
jne 0x409ef4
movzx esi, ax
push 0
push esi
call fcn.00403010
add esp, 8
test eax, eax
je 0x409f19
push esi
push eax
lea ecx, [ebp - 0x954]
call fcn.00406b10
jmp 0x409f19
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409ef7
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x954]
call fcn.00408ed0
mov eax, dword [ebp - 0x954]
mov byte [ebp - 4], 0xa
cmp dword [eax - 0xc], 0
je 0x409f69
mov ecx, dword [ebp - 0x978]
lea eax, [ebp - 0x954]
push eax
call fcn.00424e60
mov ebx, dword [0x517280]
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0xf
idiv ecx
cmp edx, 0xe
jne 0x409f6f
xor esi, esi
mov edi, ebx
mov edi, edi
inc esi
dec edi
cmp esi, 0x50
jb 0x409f60
jmp 0x409f6f
mov ebx, dword [0x517280]
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 0x964], 0x400
call fcn.0049f660
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0xd
idiv ecx
add esp, 0xc
cmp edx, 1
jne 0x409fdc
push 0x28
call fcn.0049d210
add esp, 4
mov edi, eax
xor esi, esi
call fcn.0049ed34
add eax, dword [0x517280]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x409fb6
mov eax, dword [edi + 0x24]
push edi
mov dword [0x517280], eax
call fcn.0049ee63
add esp, 4
mov edx, dword [ebp - 0x954]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a002
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x958]
mov esi, dword [ebp - 0x970]
mov eax, dword [ebp - 0x95c]
test eax, eax
je 0x409e72
test esi, esi
je 0x40a029
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov bl, 1
test esi, esi
je 0x40a036
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x960]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a059
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x40a07a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret