Function at 0x405010
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 8
call fcn.0040a1df
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPolicies_system
push Ordinal_2
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], 8
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPolicies_system
push Ordinal_2
call esi
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push ebx
push eax
push 0
push str.disableregistrytools
push ecx
call ebp
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
jne 0x4050cc
mov al, byte [ebx]
push 0
test al, al
je 0x4050b5
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x3e8
push edx
jmp 0x4050c7
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x3e8
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.nodevmgrpage
push eax
call ebp
test eax, eax
jne 0x40511e
mov al, byte [ebx]
push 0
test al, al
je 0x405106
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x3f0
push ecx
jmp 0x405119
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x3f0
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.noconfigpage
push edx
call ebp
test eax, eax
jne 0x40516f
mov al, byte [ebx]
push 0
test al, al
je 0x405157
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x3f1
push eax
jmp 0x40516a
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x3f1
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.nofilesyspage
push ecx
call ebp
test eax, eax
jne 0x4051c0
mov al, byte [ebx]
push 0
test al, al
je 0x4051a9
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x3f2
push edx
jmp 0x4051bb
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x3f2
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.novirtmempage
push eax
call ebp
test eax, eax
jne 0x405212
mov al, byte [ebx]
push 0
test al, al
je 0x4051fa
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x3f3
push ecx
jmp 0x40520d
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x3f3
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.nodispcpl
push edx
call ebp
test eax, eax
jne 0x405263
mov al, byte [ebx]
push 0
test al, al
je 0x40524b
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x3f4
push eax
jmp 0x40525e
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x3f4
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.nodispbackgroundpage
push ecx
call ebp
test eax, eax
jne 0x4052b4
mov al, byte [ebx]
push 0
test al, al
je 0x40529d
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x3f5
push edx
jmp 0x4052af
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x3f5
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.NoDispSettingsPage
push eax
call ebp
test eax, eax
jne 0x405306
mov al, byte [ebx]
push 0
test al, al
je 0x4052ee
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x457
push ecx
jmp 0x405301
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x457
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.nodispscrsavpage
push edx
call ebp
test eax, eax
jne 0x405357
mov al, byte [ebx]
push 0
test al, al
je 0x40533f
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x3f6
push eax
jmp 0x405352
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x3f6
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.nodispappearancepage
push ecx
call ebp
test eax, eax
jne 0x4053a8
mov al, byte [ebx]
push 0
test al, al
je 0x405391
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x3f7
push edx
jmp 0x4053a3
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x3f7
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.DisableTaskMgr
push eax
call ebp
test eax, eax
jne 0x4053fa
mov al, byte [ebx]
push 0
test al, al
je 0x4053e2
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x436
push ecx
jmp 0x4053f5
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x436
push edx
call edi
push eax
call esi
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.noclose
push eax
call ebp
test eax, eax
jne 0x405468
mov al, byte [ebx]
push 0
test al, al
je 0x405450
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x3e9
push ecx
jmp 0x405463
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x3e9
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.norun
push edx
call ebp
test eax, eax
jne 0x4054b9
mov al, byte [ebx]
push 0
test al, al
je 0x4054a1
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x3ea
push eax
jmp 0x4054b4
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x3ea
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.nofind
push ecx
call ebp
test eax, eax
jne 0x40550a
mov al, byte [ebx]
push 0
test al, al
je 0x4054f3
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x3eb
push edx
jmp 0x405505
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x3eb
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.nodesktop
push eax
call ebp
test eax, eax
jne 0x40555c
mov al, byte [ebx]
push 0
test al, al
je 0x405544
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x3ec
push ecx
jmp 0x405557
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x3ec
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.nosetfolders
push edx
call ebp
test eax, eax
jne 0x4055ad
mov al, byte [ebx]
push 0
test al, al
je 0x405595
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x3ed
push eax
jmp 0x4055a8
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x3ed
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.nologoff
push ecx
call ebp
test eax, eax
jne 0x4055fe
mov al, byte [ebx]
push 0
test al, al
je 0x4055e7
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x3ee
push edx
jmp 0x4055f9
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x3ee
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.nofavoritesMenu
push eax
call ebp
test eax, eax
jne 0x405650
mov al, byte [ebx]
push 0
test al, al
je 0x405638
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x3ef
push ecx
jmp 0x40564b
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x3ef
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.NoTrayContextMenu
push edx
call ebp
test eax, eax
jne 0x4056a1
mov al, byte [ebx]
push 0
test al, al
je 0x405689
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x456
push eax
jmp 0x40569c
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x456
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.RestrictRun
push ecx
call ebp
test eax, eax
jne 0x4056f2
mov al, byte [ebx]
push 0
test al, al
je 0x4056db
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x405
push edx
jmp 0x4056ed
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x405
push eax
call edi
push eax
call esi
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push str.NoNetHood
push eax
call ebp
test eax, eax
jne 0x405744
mov al, byte [ebx]
push 0
test al, al
je 0x40572c
mov ecx, dword [0x418ec0]
push 1
push 0xf1
push 0x435
push ecx
jmp 0x40573f
mov edx, dword [0x418ec0]
push 0
push 0xf1
push 0x435
push edx
call edi
push eax
call esi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.NoViewContextMenu
push edx
mov dword [esp + 0x2c], 3
call ebp
test eax, eax
jne 0x40579d
mov al, byte [ebx]
push 0
test al, al
je 0x405785
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x407
push eax
jmp 0x405798
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x407
push ecx
call edi
push eax
call esi
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesWinOldApp
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push str.disabled
push edx
call ebp
test eax, eax
jne 0x40580a
mov al, byte [ebx]
push 0
test al, al
je 0x4057f2
mov eax, dword [0x418ec0]
push 1
push 0xf1
push 0x406
push eax
jmp 0x405805
mov ecx, dword [0x418ec0]
push 0
push 0xf1
push 0x406
push ecx
call edi
push eax
call esi
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push ebx
push eax
push 0
push str.NoRealMode
push ecx
call ebp
test eax, eax
jne 0x405866
mov al, byte [ebx]
push 0
test al, al
je 0x40584f
mov edx, dword [0x418ec0]
push 1
push 0xf1
push 0x434
push edx
call edi
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [0x418ec0]
push 0
push 0xf1
push 0x434
push eax
call edi
push eax
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret