Function at 0x4039e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4138e0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x439198]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004023d0
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [ebp - 0x40], str.xM0cbY6Dwupy9YUzLx8LaAv2tR9G26hUpbb2IeTNdlMnInrouRYvoREmJvWvWjP53Q9hq0GBE2OIgnLlktDoVx4nrGPPaU2b18wk7MLYvamkk9GHm6Cosmltt9nIO4FCoBecP6xhl694coxA6IL5P49rEnVmMu9JEcwzNrueIXFXOkh1wAgJ9sfsKDF5DpqJL2YKsm8Y9FjbRFoT5fAdGkv6wXEoDx3J8uxGpp824Rf0IGX3DtA3WtOjCaHSL89JBirYx9ahUYtSs6F9wlroAIbsILukHXpBwlfRQ9233dRpQcJLyaA4xUFin8xDPj98CQQdB2A0Lv4hoL0pWwRuRUrV8lbPeYb08jvwfoMfmBAof8PqphqLSzJUvfz7GgYKJqJYqQDd20JHk6f35yIC6NP8WsGNH0xPxesm05fNYUHoeYKszIypdt9UPnnlsxsA9WQ61JLfkpqJdEwFWq4a7x7WxagmQJTgzathKsub8gJ9kufBGCGuWTiknJOAuWDXiDcCEYHDs1hceme6MrdH0wjwBLmVF6YIgsdtp0Q3iYvBlFjQDmKINoRorJ1oozOpQW3PQdoezgIcLjWt65J85rHd2OI9oiFPVGym5oUnbG3XkKbqwBX8KHICw2iu3HAHMyTkng46YSq3wTA7E8uyVbPFY6kTvKcyaFCDdCxmKfDHAfmMJdKVYS3LryhWyUIShrxRfeaxhTimqJfDrBvmpRsKRFpmJaW2LuOdpTNqgKOwFTAGTlPCWdeQdtO1h0hfLMWwJrq9lvvVEIiSIK98zWAClNrT6rDFOuLhyH3g9AponHQ4UoaWndT67e2cP2zkV3pBmvNIfdtSBVlXY6WKK5xEk4acONc9BdlgPJQP9lqvKVpbSYUSdF03Hsfj5kbUJWpESgullIRxYLhd0pLlw8OtXfw7nGNmHvIPCY4leRbl73Ktc1xHECEsK65k8rS3lpJulN0ke3AtGRegLHDfKhcWFoNOvKRtVrfWyELcCibAYPDItCLSakgiikoylcK1dEnaYt0fJpPwU5xUweV7tVIe7NqHdV7UnlzJwdj8NXgeah3PAcv9sluRByhwlD6l27BWkQtUYi0M5yQkMvbM4KDHc1aqIsrljNAFGnh4svqrIBd6GoXvtqfDer6XY5sPKwVr9NCpjrKARD1Njjeo4CuY4PXRvI2ElDqpq8vbBK0IXmEW84CcqCEoXWsVn6EwxN8qsoV2jO1wbYaX6E9hkH3X9i6bkqm3fUsToE5XqOvLpf78yn8HLc88OcdHRuKHQbbVxY7nPFXpdqFEoNf6VpmL6H0Law3S80litsk4q4JwSizCQItLdGk75EsL6j3Tm5mjUb7fYt0lo890Gf7FdoFMOBqgga5ShpW2OfRsi7JdqJhD7IPoHS9PjWyVVT6T2eb6kM9H6XMEnrsjLMz9JywEtNlA6OBUg1qMNXwl2NNjk5JEKiEOtOI3g27csMIK2zo5OVG6L8gV60KdCpGSl4Heuj0Roa5aTS9v6Qo8Qftua4GonxDwWKuMY4YQ2NWKPi2jDVsXPdz1JFmxuoNv7jdFusQwb7a2glKmAnNxdOxJHH8PRSKgPe4hKsfpj08p5Sl8kpp9qF9YHzVpSfsQnXlmpLDbESObEX8LpglvQ63g2eiemWa171n36TiD7HMxL0O3CbJHQfEbG7kazKu4HTCTo4lJjTcxEAppXsQeJYhvpaG0eDl2YazQOiIyzsKa2CfTAmWWJV0aCREpwTYvWjOcRnclTQJg4hYeSbp95xLdqe4U64YMSV2GWPms254AmXDIrgItUXmNEKjY2XfMcAXotYFppF9LXmuo4UoXm9liQroVQD23wRqNLUlQ8E2kprePJv24uO9aeQS0ysRLKnkP8suz4ykHEqNkFnlBjq11J3WiB0FMSJEJOe1vIrec8MxLeU6ONe2A1zhOS9EzcAsb0ADImUt0Hh5H4w8iSd6MoxcsK2nf9zReQFXrT3rdIVmlWBn3raVEVxA114Hznn6jupm21t2NW1FtTzPsjC6lnFT9USPVLFsgWr4W3hKFC6EB9TAjhS0caBcrbrjnnajlfe8R38FxqXfN61NM41QEts4mXVYzty58mWqxLbr6vIIQmoGrnQFj8THeTN4QvzkFcAETG6jRsGF8LwBeQ0mTJ7Ui3O2acYEkCRnYV45ikv3ElVTu6OBjwN1GVVL7nxIUtiW1pNaHC267j75YFrWzsaWrwqrV91iBx7xjEvujhppO7BGN3KINeVesgPwwMdfYwndmWVDdI4THnYltIr8ldlUw1USoNUrY8QMLhjHpNDNnWLKV5TcCsaHm9KEHQYUYY8VkjqqNO6H4QAHrulJdLFOwqFjhPeIHFwbUqx39zDvEm14GgJqQCC5v6fHwRv2iK7QAHsr8fIqDTELMFMLncmSERjWyeH3hIL6vXu4ix71b7aQaXY5NoHefR2w6rH6y17V1EtU7yMa5SanHhBwhNWDpHKdvbpzs3x9z0KzUT06MfkyFLE66HYfbr9aMnIUEacpLRbeUzklltjBFvUzE7bMuA8OB9BGgGYbnS7Cg5xKv1PTLwWCxInx96RXeMXuJRCLflt6XmGyBxAOmO5GrV1mSoOHzPO2VVxiqgEwUM9gDViQhln4eR0GhkGufY6692XI5kzqTdsJhfGzIXHTRkKzOfs5rcPx0iRQwXFQCWw8LLxBhyE8vPdATSnz0y1ixN1hciTqEJsY3XBIVTDwoAQVLvWopqGlcATsF7JnrLE6FxFF5KLHVwEmBLWhOkSOMCNDIY9vnHLGPnxlsP06Hh6csOqk01EQxOMWa5EcFFIdpx1HfNXWn8bmhfGVmo5H37Ej3nfntdGuPkWN0h9oLaslR4iQVDgHiiXsvttAPlaGhgbICNIjS5VeYM57s4igEc50PIoVDyPit0zEtTGtOjcDema9egjOWx6ks9x7IKH5Qt1Sg4LrP2iN6bUDeVqXi2TGXu0oKj1dqLnL5ItCj2NxY6WF55NkgsPQakivfhO600DNMbNvpfpSyBpohBhDKHkyll98IKQWquSBcvvD8YmT7mG5lic70emE38TAWmODNORe5QBmSvu5H6mKNgpjRUK9vdQUlpeHLYzEqMSlHPBcW8jFSiq5ev8ny33tK8N7mXiMGacHK1gIVdguiWKASHO7iNM2AYjy2cgSyqHtEwwtc4uVvN9eAhyo8yGA6elVKew9mXUWkJLeUDd5gudHkadoyxpaX2hYyjGkiGAMjgnOIRrQsl1l0GUHGdyUfyhhFmOLrSHVNUMcBDWW8pa0oF4bgfQ4nVdet2xpMnAGBHplXLhVrrL9cnk2GuVTccL2qGXJdmKFcPFmA4IeIStOXuDM11wMVmoKanKPtx2OHI3nEgl1qUpE9cciU6laeoghuQ3ld5vpQ00EG2Ym8mgO76sLHc6z3emjjzww0xw33u2uG3f8BNc66haIkYyBPIpoFHn9eYGFicDjXRu0HuUQdghYpksXlGTRM6iEgTRwinkyi5PxroCYu16JblBoLU8WYlvXjgedlrEMKbd50c22QY8txhLJG96EKHJEssaCp29CSCgOEhq452a3YDMU34BPGaeQIll230pMBOoKQGwJSvgAF7rUdhd9AnMeYgI0xmY4c7PJcdBjPcJArABOUpf8kJD61WtpIntjlQwrnltAplbSHa8MjYN5WlCjvD6v7uvs8ibmhgqYXEsAy8R2TvIcEX2h00kQTmIw2EjOSRisLfFbJ1JRCpErK6H3V9ajPOJCT8bXmJozXKdtAuBGK8XDHVYdFGR7oWdU0OLMYazsAeJz8upV0YPr7nHUqCXMC0QFXPT6aaePyaaW174bsj9jJ1hUlrhcfqkdOc7wtrdXGwEmvFy1BmCzrazyp6QyDUkW0TJxCnWKHIFWzHNailGkhO0JyY1oMjCmjRPrs5kBcDU8KTPoNrzypHtVxUnxkHT1W1glXoNyDAoGgdByLKf27drd5dNbynWzwcEchNierkjHWK9AeosnRtQeJCoPnMwJ1bnNEwhMQ7cCjRuuClK2gjbaXmyklCqjNKzJwuIX2BPau4EmLBmh0epQ93WQGLqbDB9rpk893Wgqe6JnS
lea eax, [ebp - 0x20]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea edx, [ebp + 0x10]
push edx
call fcn.004022b0
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x403aa9
push 0x41445c
mov ecx, dword [ebp + 8]
call fcn.00402350
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004026f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004026f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004026f0
mov eax, dword [ebp + 8]
jmp 0x403c98
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x1c]
push edx
push 0
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00401e30
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403850
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
lea eax, [ebp - 0x28]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00401e30
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], edx
jmp 0x403b50
mov dword [ebp - 4], 3
jmp 0x403b8b
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004049f0
cmp dword [ebp - 0x2c], 0
je 0x403bea
push 0x418428
mov ecx, dword [ebp + 8]
call fcn.00402350
mov edx, dword [ebp - 0x14]
or edx, 1
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004026f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004026f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004026f0
mov eax, dword [ebp + 8]
jmp 0x403c98
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.004022b0
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.004026f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.004026f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.004026f0
mov eax, dword [ebp + 8]
jmp 0x403c98
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10