Function at 0x405080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416029
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x44
mov eax, dword [0x47e010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 4
lea ecx, [ebp - 0x18]
call fcn.00406ce0
lea ecx, [ebp - 0x18]
call fcn.00403790
mov byte [ebp - 4], 3
mov dword [ebp - 0x48], str.1uiJxukTfXCFubHWyWbF8gGkm8iyF9UGOSYOsPy3Bk7Uv09NOAeqe8VmRD206eMSv6e4rCGFUI7rieMkKSBHk3YPpzUnJ26qeAJXm8EdN9XJFT6EnG7l49HUh58iX70Rm9Rg7KJ3Ep80YAooWdbo7AmLraV3ABxixVEOCXDyDac94tUx10R97CzqJCKD1dCcHmILPjs3ETWKkiNBlVU3NzoXG6aJ7f5x0fnrGoELoSe7Do3v1bFLQQelB3QMhyCKUFwkaU7Wjh5hpFyDni9a0XTwBMHSpAPG96KacE6KC1GU8Q95SVJwdGXDStTTOGwwIlQoE0FfMA5HJB58z1skfMEnXINrPfG9QamO2CXN4LPI9KC7Bcx3rjIBd39kwcQSdekS8ih7IMb6f1au6qvFu8pOLuUVNrp6mwDjsPxh4sdItXBXuf59atSbAbPe9Mcm6HmRAsE9dML3Q9fvxSbvj2fIssjBBTwwD3LiaJsj7Ul1YSQmmcVISNA9YLs3Qm8JutlmSEKbx5a53tF3mFFQSgW0CG505EenuyMQzBiR7I8dN4mliqVVobhyDWIt67t6MtWy6mNjfmTUzJ5gffr1zOwP8rBWgYXPT5Wjq3UbeHMcioo9Cx9bGKzG19DrxqhMCQ3VzfhV8ANzqTmy9mcv4XhE4etutsqo8ULhFRqKSXH54XsjToU65Rp6RXr89YRnS3NcTgSCeYThQcDxg0R6fdI7OOAWfOwIHE2Aw99iJQyf16iBX8OD5bVA9lC04GNGHKAkTCCfPYvyl6h83pHQgkF9Wf2Sq9uLm4KlsbGMIUikerT1S6GUtzyc7pUHJHSMsS3xGJGVujaaDkUrc681wh9UlMa62IJL8dbRbzTt005b7NxPYVBlhbWeeyjcRrd2NC5iAky1YVF4KQrSDLR8GmqP7XBFo3X9goRLE6RQYdkWgjIzPtTALm1edr2Fmz5XBpPjckX7m35wUUX6BsRYD43BzxeT4X7BhbxT6RWDkQIYyjcXgP9ytLTX4Wzyp13r1SHzkWR5U8G2C0SWvnkBx9N6nw8mQtm7VmglXbJOXxbU7oW4lqboah1w1fFxsUWwq2kg7Bv1bS4mCNNB51HgMCIwkeFQORbQe0gqYB5C46TDjpf7oO6vS23bwIjyaHPxrYBSQ0kjXgXvUjBrg8Iu2J5iz9uqgGeirn5K6X4x3AhfLtBDYScyToRtk1KMu124XcF9a64xituGJLq6eGk5b1q5r3pqKJs845ubxl4jyn09kVKpWL6rI0Fep3sFAM6W8kU1Q4HAtYTrACEsrXI36UTqxqSlWjJ5kxOsRJSo21Ts6IwpKIInd7jV2CxSyHQIzlC0I3n7JyRgzbRmRGMAnymqrvMArXDkVRIxMzgbFtOLATOElKPNjYA3D3RjfHfQLP04c5Rd1lE8cJbT9tRnynTpjCcMU4RR9sQOzTTKJT28yA8itWy1CcwnAIWlXXQ1zwE7R5PsqXIsYDGGG9FjAAXHiTLEzJH9b5zdfTRHR0OQ1Y8SDNymKiXtHYE17H0u5XCxA6NMmGIGnHP5alnm5BOFA4UmcfnHjKDBt1YQA1aX2VeP018Gglsa8tciCHzMROg7dqlYKdbn8LP8TMEQGOkHXQs1oup9GhYRLGp7sMbb2ngjxqAtsQvUd51qH0JCG19QQDg6MuQlhUa9wsqnlOCnqjt0XDyoIHS9
mov byte [ebp - 4], 4
mov dword [ebp - 0x50], str.f3zHBGdznpveJFtoIg8QJLwnjSRQuNv9iKqTzzmp91SXC0RxP1eLyt1pJL6NJ8P3hGXUMkgFBcxoh2znLvvKgq2q3qyVBrNUOdM84sdioymfiWoaAuvKwnbM8ANgeUdbWVOBrrBD8q2pUrF0NW3nd56jOKc2ugt9aJkY7PUqmX5S7IjVp9kRpjAbRaUxXHx2qJTzy9HNz4SPywPQPBO6pRuW1SYiTWWX9mrmoUAffnBzD4lzW7nBGyHBWGgTihRVaicTrKhHLlhwq8tM7I8wUcdtk8q8NqWONsJrKcysw9Ih370lXFc6NyVerMk6uWV0Q6NTWoqJ4d1U5Bu3JmltLUeHT5LYtacJ4SykrrPHQs1Bix3qgVhcnjHRuNc8xLorbKgKA26yudEI86VAtMficq418vHXehy04OLoMUn8DupCHEoHDedCUCu3FaFfFpGoX8HgwzpSMN3WLLJ3ryYToWHqOfL3H8OEtGsdubpNl3BJFgdVWY3CzcXbaERNMx1VDrcWtA8tDCljt6aNDIJ9COYXeKagY0lrPkRXqoO4QmPjNsTalR5EL24Xnm6t42RqSb9BpRfj3yTJYKLxjxV8qGXWUJmPmoGiYPu3E1IyeVCTWz8DcLRr8nYjYAU6V2VsG37ivt1FfInqjIka0yeeyoVWE62jo6JrXx2avGu8QwKjgcLU9QbYxH9pSTbQ5VdPc10igHV0GuEQFdRMqyy232sLv49rS7xk85wbzlJUj9eE491K4w4vbLfHf8W6qoTFSjS9m6K67vSFzEEPCz6ob0msJ4UdSItH1g9jGbmir2id0wfb5sPtqxdRukzu9htjrq8DLttUuErRKLfXOSfpsTHkTMLUHr7vtdqVWAtSmHvAUD8tBx2DVhgPgNBSGLDkO3mOHQkI32XCcwo4y3FrEzNWLaq4S2jWyg4KFgsxqTAAW4yaeXrXArMMt8RrIeozbaqYCyP0g3noa69iyOk7Nac6noPofw9vz14Es8VndDAisEG2R77FyMvak7syajU700qFe8JvQjLR7YL3Qfmgb1HQ3UcUOaYS7iEO8mKMB9J23uW6DDmhdilDbQHPdTGkX1IFum1eNHz0OQO0GCcYiJpwhqWUVuo3YejFLn4nFWAmBSXDUtHsect9JCabharK1WV2BkWplmoYfF31AsuDVcBFSQOS8hedg9MQJQf2MNR7erFblLWfu0mRT0GI3s9hlLT23i2yVD9hEEughycP6vQ5SpKBdwAQfE3jAHTQxGCmiXcuNU9P8pFfOOkPrtYXoFKewPYoicWzxfr9MVtrJIG42lL14hajWS92tkjxQUxgSSfHWwC4PKSdCvGW3CJUKOGsUk3qJ1RAM6aatRuNWVcQ5XXFAW6EmniVqTYRgrKdiHM6Vz2mmYb5iF018hWJWsOSADqq5mEE9voy7MnfcntOmJXAUTc4DIgAb9QlS2lUtpOYVjtAU6Cedtwqh7jSGW4dbpFFE6YMaTJpObCQ5O52cmuHh8yonjCA1tCWtQn8Vlc8w8UjxvaCEX8tIVltsAbXoL6VqDHKfRr8mvkHnuNCUX4NdmbIgbW5i05yDUxrivQ57bJeVpANn4jG64MoAYW6WfgXecQU54Sn7DRxPeLcp4j4wxXuKwaDQRUvk41Pode7bVoJXfbXqSQQm7GIBSqMMAYL8dLQHpD5HHPnu5kyPs8SgV4swLr4
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00403630
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x405168
push 0x42d4cc
mov ecx, dword [ebp + 8]
call fcn.00403710
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ad0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ad0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ad0
mov eax, dword [ebp + 8]
jmp 0x405308
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x44], str.waEkWMPcc93PfBK8WnL6f5QnVb2fcTIDaweYb4dhwznBSAgQIL1Emlqvo6KCPeVg8JleFLfYNTkChVijFberbcaeO3gA67nCqHMS51Mugj4tKa18aqM9C2mWBP4ki8oikE013Y6UWMQtbqrlRBHGAjH1V6JJjtfkl74ThSNmE78BUqvsHcCb2BjJGk2qwR2ciVGYr6WPUXrzQs3sOYOVSuDnyNOGNEKPfleVg0Wl3LvMnnJKH3fs7Gya0FawzIlEvPHDr6CP9QblpDcc2QruHYjffTcEKAztGiJ9JXbc4kr3lSSIASJUKja1TI2JY6HJrjD4ANxIhLi2BYQGi1IVnKIba6hNnseeoy4qEhXoPWd8d4EwmmuSd2i14YleTNuCqM8xp99ShdGYkapYxXeYcc2nMSBhE2YMDOLxu5jTVxDwwAtuLUcNd2PhhO25dlucjt3YxvzgOuyBPVC6bhHn68rSak8EyccXWB2O7DQWH5vWK1Uu8b95EOttMq1VcjzQf5WmJsS5YR9aeWJ2aJ0FCejubHnI2Fpi7L4jRHgTOUHJF6ME24QjGedu5dtIrxRjDAIOWSmN3PX5U591GmjAwrfdAz6kwVwoVE5mnTab3tg4CSazye1Id18WbDK4YWoG2ElVhSsV9vhPE2fjN1olyoNt7eYcdJtpEqHgs2Ow4kSqH5UFMJr4TyrNPomwCf2CDdMnbHsWYLzmNafQTctkUNQKMgRPphrapQ7F2zfl7Kh8NepL4LH3zJrlr1SPxtevPJ44OHG6Ggkag4L1FnfB5jhNgVabHi5TnQWTFqTLVloSxkOUDy4OSL6yLoQuo1LeVLXXUqGa6bBBJrburp3WLIeesMtmRKg70CavdIsdtWqELHCq2BYJI5FDQFYj8rERv9wfzCAohNybFJQVHkqDvAoqCsXdczg6uED5rp2jvnwtFGN64yC6pK9ECCUlXhQYL3jMumrDHwcDhexmSD5erpY1c7OCPCRmfIPkm0h12yXTz9VwX4hPuxzjcyDkSA9R9f3fKeWTwST1dalDu2UJzuy6iI3dP42r4R08smNs17MgsPx2VjTMLYwH0uryYPgjSsVAl4aFaX6r7EMh6njPdc1eEUSa9z5VQxidkpjfui2PAXJf9hrJ9BwvoabkNO94ufJErTsFj6thP3A3xMNoS9vbeAOTX3zFIo6xMnMdMw16r2U4v1ojfnUxkwPjtjdP5Tp3kiBauCWiSSNKSdTwfUg2j1e81H21NjHvLteFEF53Cg3QKJsLQUljW8tUzCMhBS1jvzu324kqL5nhaHVvLRV584Ve7PA22jUmDYLQKhsbqIg3FMbDYypgG6kvoTIpaMW5xo0OVRE0tsfUlgRzL8PVyzJbTewhA8ukQSPVItrxyl4kNYB7B2TpCTGEU3AboIOosOujjONq4hyq8lRyj5VcNA4eupxlcw83xTTmSF3baXI4Ym2CUnT24e8dpeeJ84tuwbABBUUlNYGMsBlwJmoNmtAPv4RmYfWk4BBSNJthx2xplRqO8XcFbvjSaYcMLkoOW3GiNncc5yzkJ4THPWxGQUxb9RUdlH4xAVj10e3YYY7S0Bo15WKI7eLNGjR0bbQm316nUcpUx5Uj2nakIF9IEasxDLfH6aR7vqytRloOCwd42SDhHbYoXAOHnBMdfLoGaFd91PKXFRGRAius2VtfmuH6S6BB5IVWmHv2mYYeFyqKzpyyOPOx12K5HnljpmdNsNPwIgiUfW3WcDUcf58iSuduXt1VmI7bUEyKIhzUyhz104N5xmvhNi7Goj9qorK1in0Fu7mqJ7Y7OHns79JI19FLlsetLir2t9O0qKt2iKwBA59tz2mmlNr8IDzJ1d1k4z3vw0oEPvMMdJ97qPjFl4dtvDiY8Pc1soakeUMuAtMDYWfxHzfN3QUgpMyNH3OfSBF2CJjLdLkXkJNrkM4d5fu2wohIttiMrIoupWGPIpWqMMG78qXEKASpkI90lpuXbEmRWdC6yoXt6vkpMUnhXo36FYCMlQPFXNVJgpN3vEtp60CNV73uioXQPmU3BvdpC2HUWz0fO5klK5Yi3lU5XtExsX0ytN6dNBwAk1Wk3w7fehouskvp6kbGv8KrFmKy2RfLdasgfuTOjzEph3xLreshdL55WWDpFcEtLRyqW3QbBvbcQK8sEAeeR62rYCiy8lLqpn5FKuDcT9C4T4zYEMJReSOsFDjQ5BAgOcON76OFDzSbyvXFuUO1XmTlvrifBgOwTt5fpwhLT5MLmAcIkJK8Ec2FEGSKcxXuC7GWSW6Vpbg8eJP5vLoeIwciUeItGAgm8IXuFXHXyyaFrnjztb4TwTFrI6tAlyJ4JALYPDH1j9rOIRLRPSDjinYE8ANlNxbsPHu9hs3wl42a8u8qmutdarVMtdkxfP4GjSUBK0fCWoVumBQL3XUL4pOgXi2wmAMbRa4O9nGGRiaLENUOnJVBvT49igkxO5egtlOji2P46fpEvG5TdA3B9HVni8Ctp6EcPPxQikSA4nUbbAlLEOckku51zGsTqYfGWmhngGp00H2YvnyB25WApXw3sDw7FH3V20E2lDo2T3huNxt5XkxoNXFq6sC6uK2yA6XbENbnw5hMT9KhmRQVRlk2nsJxId1CnobnnOxEofOE8NUKlloC46HKVNXQIMJFsVQnGsBqMSPAoKowmGh5Nfmocrz8mHPG64c9rqtwB4gg1jiAjdhrW6vudj5zvaoyTPEEOA6gu4IQuP0qviXJcHn6I2TvjzMs3PbPC14lDbEH7GHDQPOWRwYBprRAQguMAsp7XhpXtpBp5L7LgoWC59AbBYBL4RbK5riavs7NH8IJA0nhrlD2wIntSsm8W8UyRkVkqh1Yh2QDSpYASTj8mYmz6W12uS9m2tyGnYQ4r7rjd8P3M6wzggu3mS6XG0Ies6yXyrg5FKB7Oje0aNXJrqzR22MGytSfLdrFG5KuJA4DYePIMHuGCWmvLuS79lfolGRX0UJeFEcE1eIr
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00405040
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404f00
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00405040
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00406270
cmp dword [ebp - 0x38], 0
je 0x405225
push 0x42e0ac
mov ecx, dword [ebp + 8]
call fcn.00403710
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ad0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ad0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ad0
mov eax, dword [ebp + 8]
jmp 0x405308
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403630
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ad0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ad0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ad0
mov eax, dword [ebp + 8]
jmp 0x405308
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a59e
mov esp, ebp
pop ebp
ret 0x10