Function at 0x407f30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x53c
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x544]
push ebp
mov ebp, dword [esp + 0x54c]
push 0x2ee0
push ebp
push eax
push 0x52c
push ecx
push ebx
call fcn.00408b30
add esp, 0x18
test al, al
jne 0x407f71
pop ebp
pop ebx
add esp, 0x53c
ret
lea edx, [esp + 0x18]
push edx
call fcn.00407de0
add esp, 4
test eax, eax
jne 0x407f8d
pop ebp
xor al, al
pop ebx
add esp, 0x53c
ret
lea ecx, [esp + 0xc]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x407fad
pop ebp
xor al, al
pop ebx
add esp, 0x53c
ret
push esi
push edi
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x240]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x344]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push 0x432ae0
push eax
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408042
mov edi, 0x42e5b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x344]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42e5b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x544], ecx
mov dword [esp + 0x240], 1
jmp 0x40804d
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x544], ecx
mov edi, 0x42e5b0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x244]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2ee0
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
push 0x52c
push edx
push ebx
call fcn.00408aa0
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x38]
add esp, 0x18
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x344]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
lea edx, [esp + 0x244]
xor esi, esi
push ecx
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push esi
lea ecx, [esp + 0x254]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x30], 0x200
call ebx
cmp eax, 0x103
je 0x408194
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x244]
mov dword [esp + 0x544], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40813f
mov eax, dword [esp + 0x550]
push 0x2ee0
lea ecx, [esp + 0x20]
push ebp
push ecx
lea edx, [esp + 0x2c]
push 0x52c
push edx
push eax
call fcn.00408aa0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xf5555555
je 0x408194
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x344]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x240]
push ecx
push edx
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x254]
inc esi
push ecx
push edx
push esi
push eax
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x30], 0x200
call ebx
cmp eax, 0x103
jne 0x4080ef
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x53c
ret