Function at 0x40aae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b878
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x44
mov eax, dword [0x48a870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x48], str.bqFTn9lPLsG8uvRdEqLFEPVGKGziltpdoJMxghhGmoRgNekIX9k9ihwjc4z1uuRhYOmU5BRwq3J1bOz599El4O61IbXkJlM66ke8LOWlbtOO5r2hn9MnMAy8iQdn9prJpz8KATWiRLY4KafWmuEKB0qbWWahBSbW8nIO2e0LL6x2cOVth26wRNRSHt24JOxcXbuMPsPlaJa298TURgP6f7IbztsKV3aF80QB2BPMj1ViaBa3ldspDkocC4shngReop8EVY07xmiYwAOkswsNcc1hTrrzXXAsYzuK4g2vbg7gig9Xunf5oMjXvUcvpvoCFe3dgqdlzjCcjDwOdz5xTvD1xPURa4vIMHJKCMte38tQ9xvuVs8SI42l6EbsrDjr5SsAuYqX0sGdaCMfrYti4x88kRWYg2i9UhVntYiyO7Eduoa65D3nsjfIm6B7mU6X7TPct5UcTYdM1aCIHxGeE5iFm0SufLvE1oGBDVPiD2wLo5fwDl8mFSSJvlUGfTrKvYUCosatvhdY27iBNk0MP7cTYVgfnrYqWsPHoXIxVReb84aKyhOUHr7i0IPEsmkAgaFLB3TwnYV4DylvNCXE5U8kMEVm6sORQ3vbeDODlU8kh5x3YmKl7RnxyOgKCmWyDEkKK28ji1UAvSyi11mL70EHBmVaavlF551LUNe9LHRpB6jQnKRdIimPauqUAbMV7YlWJR61hvSjyEU41ielQ7y6xwBgyu9KgDYuuvlUm1kNalAWqVjlD6XQ1OJpsmvgtRt0Hgg6BSRiWLIdBwQNvhUJVQvvvz4ih6gAc4L0yQDbgkNh4xuNaVouB9VFBH7mGjFL2aphNL7N8iujP1LQxJ19njsYucaHf5Wzx5nKXwbrqKz7tx5TSF3RC3UrCgNh0ybplKuvF57nJB0f2jLoE2p6I7w2gYNGxtobjngKxwALsBOV650dCsDp3mTGni2iV7sgyuMYeYENIif8KdSEMTUB3J3hMTx9Mnbrv0NPpEKyq6EtCCpxsF5I7clCYmvYdIfYN5KaKQI7eexkOOq4amAXGRzwi5ffRbcAohD4XVMsAJwIYQHWIVyJgSUJMgc7Rmuqts9LMmzAHvnrgoTkcFIEhuVUhWXrStv8uNALTD6owf2UmFzLYauyd0zIo1iL7isKcPWJ5oJLMuxkqw8lDlRtBOcLtb4ofauOzoOy6hiw0B6xbiTy4tyCXpvAFWhft0BjREqiH6VqqL37QY7lp9PqNjFGRG71xkIED7EeHEgf61Rka9R84gGwHaawIzR4GfEJDB3RTScCMdb9mRbKI4FMcFVvFCXuFn4TWhJT9M8d50KgeSTxi93dTDf1UGY4K0zUSDyceqMCiTs41tPg1oG4oSNlpqFfJUD32tVR3WimvgmBxtD8k26MioFMQlSgUwBXfXWdsAcWAeDH8lRO0Cr2dalxLKBX8NKQExkJmEnPbMCOz50r13vEOhFNoOYXGjdhC1s8CxbpDKLbfilADwJHLWSGKwjytb2jOwkjcHg28NFE099ipzcsJoEiDF1JO78t9vAp0GK1zn6Rcow375BnoX0DBTEcCplHMKwHY66CFMU6JlvLPfk6t4lIWGWmiUlqcn5J7Ea4Paan2VXQTAnwGcutMjIkI6Ku5NNen9ewkt0o0CIaTXmILSENWTXTmX3gqOT6KoV66uIy4trYGyAWtOry3pPB87CttvftgkjSTPN0d9I3oQWHAHOxtByEwKJmJikGW0NThWOxRP0AqH3ERkaun7zXuBzBXUggOte7s7vG3lEfqi3H9Af7Empax29mfuOWXTMuwpIFf4V8j6NUdqe60BMzFVqbPnrGrz6ShMtqtUWNiVOBTSE2PVveoMe8lm9BmL99iXVzfsLiOWbg55suoixQLGiGAsE4MTk5TynrDMh4AEGzAcXYCo2TmheNG6hBSsoqeYe6dAi2COIqkuT0hPcucMxRYX1YL0wS9r6g19wz9zkXbloXS0stT0CJ99s9Aag6g3EmedBs6i6bpXumJH8LNmdW8Vza46nesRq9gP5ACCDLcFc0KyV5nbrrQQCA0WeeSB36uKmx2r2j7dAUnPXKa5QPQQOBe6vqxuTCUk87eDt8O9rskAd9QJKW2XkrObmWUtGHn4NCGXCShIN1qcCpTY76VbMA8u9VBW67wArUt3yqMNP1yu6oEMD8EjfQTYryjDKmOHQkcrQUMC9PlNj6uvbJuf2kt5eGqqRWa5BnjsKpEy5wrp2Vf2dMLXsPq8BFJv6E1KQAqUYvQQq10RxtxNewtDW1Hc67Oybsqm2on0UC5ng1uTkksDa0DUydaWRfE03nmiT5sKOfQ6mKY7iqqX8fpNcDubOOQ86IbAsV8EQIw8b050MVaTuk0GNcdQu5ya92wSTjRx94hIV0YXChLbLlGpezD1aNv9u8ovCweEN86jsytg5cC9InO8ifXUQh35S85ndVTESuPpnVV4QCsQiyQrLqcUej3Nvlf6sUAxlv9HWYgr9OlVDYiin67vFe161qPSoR6Jakw1c01lyhEF6OK4M3qkhQXAvebBcbk3fNgkLQfBaL52ffTvDLzbPxyPxVSMhgfFqCyI6REWwjHzPouJwySXRa0e8VUxgzRcwbkshXt1BeRwOumkWsuLy548IVxFWwlAjFpU7uxjQ4hJnIoaqimNNe8HeQoCnCReu2qC6ngf8EWISjBznFine0953UoqJkHRJ1Pfr3B5O6fASw4gdTT18kDeXCNPu7dFF4UA4qa3HLP9bzSki7DkxEG3hGebexO9QsNBAY2c2gJMJLkfSdN6aWYiG7BrO63gPbpnjEXtvuhBKmESgNtdpFMCpd9gglui52w8hXgMhC9iBFhxDkAJqPVB3vtUNON02yKfdSLPX3jbR1CQbWVR2VPFHMtkT8Js43vfwVXgDu7glHfRXC5UJYt9U9o2bP6axB4KlaQCMTca27K163rmNxqhFUMdtyO1J3tzw64kptw88AP9zHiO9EQ9qHxJRURgT0FDBOMFUIp62wgsnOG3pTsM3nS3AxiAePo2NSLQbnuAliRAqqwVVly5V4mi66e2SFcW5omYwtJNRjBvCgyvMB2OQaQd3eT4XquK5Xu2JhrxC1rCLSkWGMlF5mycjDBuxMuV9HER4mcjOPuIFBez6xxdky1iW2HzB9g8lhUgbwXcRfTX3tuOa1dTKY5be6DT9KF8qPXReP2VoHUUCk8jKQz5X4VaCAWu4xqPP20dMFYWdGPx1L3Mreo04y7eMfeKeg5jK4PJVBLfnJ4aOaU6tR1LxssWDObttoYK2ESMaxCu5k5xBDihNYnpp09Ad6xPAdjugY6ypC91L1pNR5wt8g0Q3JE2OSaohK81GO2a6fgL5mHr5bL1OYVTorOLWXX7fNfWinNA55ckQUFmCl5jVRReKbO0hbWm7Um2Ls7JE4wW7h5TRMhWhe2pUg8uHlaRuqXcukgnCqat81NHaq3FiQgW8iyIklLLTqpsxM5baCkrlLLRJ1Qjd0Vc57gKr31BQLP1H81HYnz1oa1RO33TTx3pWQGkyjchM5fcsd5pcHMX9OCyCLMyWM8IiRDNm4G57Ksr2mSCmSbJDqMced3zEAladQgbMeYIcV7mirzAxqipaEJpK9Cn2jnHbGY6UIAikxGIPPUpc90H9bOed8axKQv7azCS6u9gLgto0pe7h5tYiIr6Bu9KfBD7AWfqOwmvKyCoKAqBaBher05OSjQRBtbjjxkjOLYhrD4TPi0FIhf5GKjAUqpRETbcFiCK1fSeWtCeDWY0eXxPhJM1zsLTSOe9qudAxW1plPSNhw3arOGpIId4DMHdyHvqNCxkIVmeFdiezunCycxmGto8RzOexvLcusm56d1vUT8f4NNKfMfT3OeXYHytuKlvB3ICoQ9tYVuHX0FMBuiQUzDKDSbFIqakKG4oyV0JM9jCc4XQdvvIzxF1sxLDg3HrXY7pJxTg95k9oyb04i3BvAsGYSgkRG2CJIVogMgsS68zTur8DzoiqAa7KSoSVROr13TEHMy5Hj8lJss3Rjlaep41eiJxDEgrbjKcMGkjlzz1Ewsu7M2i0WwuQBHGNFbY7axCuBeGrxxj7hi0cv
push 1
lea ecx, [ebp - 0x18]
call fcn.00409610
lea ecx, [ebp - 0x18]
call fcn.0040b8b0
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp + 0x10]
push edx
call fcn.0040b8d0
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40abb6
push 0x44c48c
mov ecx, dword [ebp + 8]
call fcn.0040b8f0
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b890
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b890
mov eax, dword [ebp + 8]
jmp 0x40ad71
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x40], str.tghyJRTjIBtzO5dPg44vfiIF2thuUGSuYwei1E8CDUfD6HiPWxb1xclq3kOBIU2JfRlFBmDLM1Qb5WNk8bYKE0kmJozYSsfDuliYfyFKE6xhFdWmkCb1wfNTAexvgpoq6Ji4AgGUjwy7bMLNfeWGYV7MMxI95P66zv3m8WuWwRdXgX0kJ61
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.004034e0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.0040ba60
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.004034e0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040bab0
cmp dword [ebp - 0x38], 0
je 0x40ac7c
push 0x44cb04
mov ecx, dword [ebp + 8]
call fcn.0040b8f0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b890
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b890
mov eax, dword [ebp + 8]
jmp 0x40ad71
mov dword [ebp - 0x44], str.ivhvdoLP4pzXloSgd6kwsC4RN2FnpQYnxgVpBcLd1R67M8XTw0xQqatGrUHrByvBeCT5xFIHSy9vzffJ3R2zPlU0EHK4ohzG576NVghiYYxaaSIF
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b8d0
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b890
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b890
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b890
mov eax, dword [ebp + 8]
jmp 0x40ad71
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00413725
mov esp, ebp
pop ebp
ret 0x10