Function at 0x40ec94
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0xbc], 0
mov byte [ebp - 0x78], 0
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x77]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xb4], 0
mov eax, dword [0x45ae60]
mov dword [ebp - 0xb0], eax
mov ecx, dword [0x45ae64]
mov dword [ebp - 0xac], ecx
mov dx, word [0x45ae68]
mov word [ebp - 0xa8], dx
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0xa6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x48], 0
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x7c], 0
push 0x45ae6c
lea eax, [ebp - 0xb0]
push eax
call fcn.00422890
add esp, 8
lea ecx, [ebp - 0xc4]
push ecx
push 3
push 0
lea edx, [ebp - 0xb0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40ed7a
xor eax, eax
jmp 0x40f049
mov dword [ebp - 0x4c], 0x48
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40edb8
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40f049
lea ecx, [ebp - 0xb4]
push ecx
push 3
push 0
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40edec
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40f049
mov dword [ebp - 0xbc], 6
lea edx, [ebp - 0xbc]
push edx
push 0x45ff74
lea eax, [ebp - 0xc0]
push eax
push 0
push 0x45ae74
mov ecx, dword [ebp - 0xb4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40ee42
mov edx, dword [ebp - 0xb4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40f049
push 0x45ae80
call fcn.00422ce0
add esp, 4
movsx ecx, byte [eax + 0x45ff74]
sub ecx, 0x30
and ecx, 0xff
mov edx, dword [ebp - 0xcc]
mov dword [edx + 0x1bc], ecx
mov eax, dword [ebp - 0xb4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x45ae84
push 0x45ff74
call fcn.00422d60
add esp, 8
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x40ef1a
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x45ae8c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffff
je 0x40ef07
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov ecx, dword [ebp - 0xcc]
add ecx, 0x140
call fcn.00434ddb
push 1
mov ecx, dword [ebp - 0xcc]
add ecx, 0x140
call fcn.0040fce0
jmp 0x40ef1a
push 0
mov ecx, dword [ebp - 0xcc]
add ecx, 0x140
call fcn.0040fce0
push 0x45ae94
push 0x45ff74
call fcn.00422d60
add esp, 8
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x40efaf
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x45ae9c
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffff
je 0x40ef9c
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov ecx, dword [ebp - 0xcc]
add ecx, 0x104
call fcn.00434ddb
push 1
mov ecx, dword [ebp - 0xcc]
add ecx, 0x104
call fcn.0040fce0
jmp 0x40efaf
push 0
mov ecx, dword [ebp - 0xcc]
add ecx, 0x104
call fcn.0040fce0
push 0x45aea4
push 0x45ff74
call fcn.00422d60
add esp, 8
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x40f044
push 0
push 0x40000080
push 3
push 0
push 0
push 0xc0000000
push 0x45aeac
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffff
je 0x40f031
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov ecx, dword [ebp - 0xcc]
add ecx, 0xc8
call fcn.00434ddb
push 1
mov ecx, dword [ebp - 0xcc]
add ecx, 0xc8
call fcn.0040fce0
jmp 0x40f044
push 0
mov ecx, dword [ebp - 0xcc]
add ecx, 0xc8
call fcn.0040fce0
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret