Function at 0x40ed80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492751
mov eax, dword fs:[0]
push eax
mov eax, 0x1058
call fcn.0047f210
mov eax, dword [0x4b6798]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1060], edi
mov dword [ebp - 0x105c], edi
mov dword [ebp - 0x1058], edi
mov dword [ebp - 4], edi
xor ecx, ecx
mov word [ebp - 0x102c], cx
mov ecx, eax
mov dword [ebp - 0x1018], 7
mov dword [ebp - 0x101c], edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x40edf0
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [ebp - 0x102c]
call fcn.00409bc0
lea edx, [ebp - 0x104c]
push edx
push 0x2001f
push edi
push 0x49c3cc
mov byte [ebp - 4], 1
push SysReAllocString
mov dword [ebp - 0x104c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x40efcb
mov eax, dword [ebp - 0x104c]
mov edx, dword [ebp - 0x102c]
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x1018]
mov dword [ebp - 0x105c], edi
mov dword [ebp - 0x1050], edi
mov dword [ebp - 0x1054], 0x800
mov esi, edx
cmp eax, 8
jae 0x40f033
lea esi, [ebp - 0x102c]
mov ecx, esi
mov ebx, dword [ebp - 0x101c]
cmp eax, 8
lea ecx, [ecx + ebx*2]
mov eax, edx
jae 0x40ee91
lea eax, [ebp - 0x102c]
cmp eax, ecx
je 0x40eea6
push esi
push ecx
lea ecx, [ebp - 0x1064]
push ecx
call fcn.0046bf10
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
push edi
push edi
push edi
push edi
lea edx, [ebp - 0x1054]
push edx
lea eax, [ebp - 0x1010]
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40efd1
mov edi, edi
xor edx, edx
lea eax, [ebp - 0x1010]
mov word [ebp - 0x1048], dx
mov dword [ebp - 0x1034], 7
mov dword [ebp - 0x1038], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40eef2
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x1010]
lea esi, [ebp - 0x1048]
call fcn.00409bc0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1034]
mov edx, dword [ebp - 0x1048]
mov eax, edx
cmp ecx, 8
jae 0x40f03a
mov eax, esi
mov ebx, esi
mov edi, dword [ebp - 0x1038]
lea ebx, [ebx + edi*2]
mov esi, edx
cmp ecx, 8
jae 0x40ef48
lea esi, [ebp - 0x1048]
cmp esi, ebx
je 0x40ef79
mov edi, eax
sub edi, esi
movzx eax, word [esi]
push eax
call fcn.00477e53
mov word [edi + esi], ax
add esi, 2
add esp, 4
cmp esi, ebx
jne 0x40ef50
mov edi, dword [ebp - 0x1038]
mov ecx, dword [ebp - 0x1034]
mov edx, dword [ebp - 0x1048]
mov eax, edx
cmp ecx, 8
jae 0x40ef86
lea eax, [ebp - 0x1048]
mov esi, dword [ebp - 0x101c]
mov edx, esi
cmp esi, edi
jb 0x40ef94
mov edx, edi
cmp dword [ebp - 0x1018], 8
mov ecx, dword [ebp - 0x102c]
jae 0x40efa9
lea ecx, [ebp - 0x102c]
test edx, edx
je 0x40f049
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x40f041
add ecx, 2
add eax, 2
dec edx
jne 0x40efb1
jmp 0x40f049
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x1018], 8
jb 0x40efe9
mov edx, dword [ebp - 0x102c]
push edx
call fcn.004736d0
add esp, 4
xor eax, eax
mov word [ebp - 0x102c], ax
mov eax, dword [ebp - 0x1060]
mov dword [ebp - 0x1018], 7
mov dword [ebp - 0x101c], edi
cmp eax, edi
je 0x40f013
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004736db
mov esp, ebp
pop ebp
ret 4
mov ecx, edx
jmp 0x40ee7b
mov ebx, edx
jmp 0x40ef32
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x40f059
cmp esi, edi
jae 0x40f052
or eax, 0xffffffff
jmp 0x40f059
xor eax, eax
cmp esi, edi
setne al
test eax, eax
sete al
test al, al
jne 0x40f0c7
inc dword [ebp - 0x1050]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1034], 8
mov dword [ebp - 0x1054], 0x800
jb 0x40f08e
mov edx, dword [ebp - 0x1048]
push edx
call fcn.004736d0
add esp, 4
mov edx, dword [ebp - 0x1050]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1054]
push eax
mov eax, dword [ebp - 0x104c]
lea ecx, [ebp - 0x1010]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor edi, edi
test eax, eax
je 0x40eed0
jmp 0x40efd1
mov edi, 8
cmp dword [ebp - 0x1034], edi
jb 0x40f0e3
mov ecx, dword [ebp - 0x1048]
push ecx
call fcn.004736d0
add esp, 4
xor edx, edx
mov esi, 7
mov dword [ebp - 0x1034], esi
mov dword [ebp - 0x1038], 0
mov word [ebp - 0x1048], dx
cmp dword [ebp - 0x1018], edi
jb 0x40f118
mov eax, dword [ebp - 0x102c]
push eax
call fcn.004736d0
add esp, 4
mov eax, dword [ebp - 0x104c]
xor ecx, ecx
mov dword [ebp - 0x1018], esi
mov dword [ebp - 0x101c], 0
mov word [ebp - 0x102c], cx
test eax, eax
je 0x40f142
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x40f015