Function at 0x4041a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415a69
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x40
mov eax, dword [0x4473c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x18]
call fcn.00406110
lea ecx, [ebp - 0x18]
call fcn.00402de0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x44], str.FtLro8jSTp1d7Ut7zzjzooQh2rth6P37YBgkSYI4Hwd9K0rMiG6Os7bnSUQU8nhr08adQJ31YlwhovTdu1XOT94IVIiNKbPc83LqpJqiXSDYo6jG64UnbHcLGdUyqyxilUiMTGFGUkGBPbjeyWNK4qU9FNgMpBkn4RMxXza95R7sD5GyOlqHyeeFo2hYHgiIhEdntJYTLPONpRk5nupoVkLnotgE7jEnsxrtBPQihz4OBuhWeekrIlOwfMWe9mM3CpcqMS4VTyuGmHKXQYCWJagvvJr59NccgH9iGcEAYkbwE74FiKDt32E1M9dybVyVqtNAhqdiSuxna8Gi65zX0veRGSaW5OD5EjzjMw1eXJqho0eLi8yUctM7NXxvtmnc0pMQFPXLAO2cyOsJtDzbubN2Nr3rHjPv4xD6HXCy9CX5FsgxHSy929p3krISVegXU3dnSS9n52gLwEEdCLgBeflO3b0W3wXdbPvtwSnfM5h8C0QwiJnNIH1eDWJHJouBXpmCaAMmHPOVhQ8UoQstt3tlN899qVqcWQzvAVubjr3UzqWx4HYKE8npfaRgjYzIfOLgUddh5awMlMVgWvhiJ93TIzRVngQFxywut0mutjcaaMNDf1B9rBsvXWA4kkjc2QefRfXQ2hqEp9qVDA5OMmd6I1NtGv99p6f10dGBewWOdnP6laIk1AwKMuGVH2H7ThMLYtQ9DBRauPbP5fr4DMiKWfObqSrmfVVSeXo8NaJ8RILu6U3WtL3A2baSCW1QFbHfrTUogSq9N239aPfhyIVWOi3GQSaiXJYawSEYDzfytCzBxfARe6LJcFfctcM2oRxpGMt8v4SGP95j0XyX3JY1YrSVyeVbKr3bqQTitkqOC7ruSpwfTMG85QupW8MunS4asD58bmkakQE0YwKRTGzxlcW4iTFu4e4tM1OthhtTcvQrDSmqpf2YHSBjYl3mc3lHGdxopf69f4k7HCpY6C4m4l8v97v0AxaSFKk9fwP0hkv1yrO3SekLmaDVIGO0DqEuywScvqJuQWWQ5DpAUQ5xxUzSnnQFf2NspIBdSndBgnm1D4R1GDgbylOzAhC2NivcyQr46R4iBUADcbObSYspqcC9yokKeFBwAL5ORswrIHCu90KpuGSa6kEJhtgiXfJLmFLKYMbTfEA8r71uKOmyCGWqt9RJXCuE13qmdz0txzKJyJUDbOoV0hUeFRJTH3loVLDjjDmUK3xgrAAxxr7Pibp8aSAkakDDMXAt5P3VNxtjC17kSKiXyzB4YjjePNDvt98Xn8cbnigd4VoAvalhQH9VV4UxJsszd8K4YzngSpJ0lQil0pkVhSYyBUxTpM9Or4ygMgwMzMQosNw7byUgWwwJkrtCSVBKSrjfCnWeocKQXtHPa0tNX6ydd29KJzFgw3rWocn56dEvX3lSjsXltadH9Xa23X0JC1YsX5VKbeXb1nO9gY0NDn4PJhdToXe1GPB4hr7EVterdNqUUVPlBq3fqS9wTYNmugEjeMM6m17xcjlWr2nmz7wsluXJb17w7r6RMHgniJrp6qErgjanJjd0sFN5nEqGQNxHTPdIim9Hyhh557mbjXdlsMVPa3Suh9eSwUFkGrlNIy6XRaMKw62TN4MWGUw1fx4LEM8lAkhKivPGPqUfCPB3JvT5DAiPRrySjkpQPeijt28guiQ3Rkb7f10BfX1VwASVvvJV5aWXWwv9zqkJxRtm7hTzctpKQ5RRgoLyI1RRXYli9NH7VLw1QNAMJd5eKlWOD5vHUsSTg2Y6sL28lsOiKVbGCKvHp7e8HNmhzYTD5NBm60Y17rciSQWt7l70grqkxP79qX2md3hoRsO8zhU85Ah2YJ8m1KVafyX8Syu2W6YVRsw54DAQUVIUxjLwDLKAUnuYdKCn4OAbrEEFYefqKAWsBY4FmxxKHPFronWKUIQLe1sTHQjPJ1OBthYpGsB0KxQaa67gkPpO5OMXDqAWIxf52hmOoeQTc8NN4nSHVsD7sg3mCe38kg7qBIhQarDmUAWV4BkVg0gBoEYhqnuPsmQVrXJIw979iaFeAApx7FmgBEr5Wt43oWChaDhKRzKSmSDxbSRGO34N584MAgNR5Ll440FQ2DF6aWhTo5Tc6DlMWCXWAU3L9G0XMjwIX2vUG1iFpWH35SRAuoPK76muPRyGqL9TK5s3LeDx2qxghe8p7oOUBbxMinE7UoiSbGXu45u43qizG7joI0k6jE5BNd9UuaAT9ORbfjuP3flCiGMKRNStJilmfS6ohRuKXXHP6XEDeqyOd06WE0APsUIJGnQaYMOlGjHwic6XyEUXVrytPh27IvyzvFxKqUTdhrmD7mYqnCcI761m4H7CnhiIxD3syXArytrRv0sGrWTzwLNgQQY0WDkbX92quieHgUYh3TGvTfjO5XMmEJ4byd6Yn0UDt3Gf1KhdXYSIh1uBRRmsMO1t0M4fKXSTTYnTlrUo6sgevKfT5oqVr0OsIoFarKSQhDc5CQHPWF12TUbv48oIIDE5Mgp1e2CUhezLbmJSEdobaSD2kqblBA0CSOL9grApHCqvaInd1PEOm1IUsgfT06CFnFh13w3rwuerFdgRrw4c1Bktgnx4ETw9gEr7yP0VO7VjFwh9YtTz0U6MCby6fbYjaOO26QdGNw2o1OAJl4umy8qMBMhQjywJnnXsnYfiRrwzrIBCSS70mrvfp2cIi8XkLNs6uDpavjUiBg28zH81rWiKksmHwrojVHROWaLznggz1YNT2yS3gItIRhinft7h3VOuCPaAg6546QaUxBILEKxqDr4RyFK6WyV6NTe87osTahzu0h2WN4ITmAeUsWa07OPH8zjV0nXSp8NgV9dqlx15X3ROQDuwEbbsF0yz7YGlVLRby3G9h6dGtRBtwy9yliDyRhRrPRfdHW3xFYQ60wPh4Nxk9XMiy0TiztUKDnKXBTTWLa9ngEce2jjqjykhlpE3YB8zbyQHplenW048hbmMRw4nqwYmnKCgKCJMebH5Jo74W83AAOaY8ktnSsdJYvwsRsF5GHYkaDTEblA69ecFAgHdUrKU7m7gJYF0ChRe69d3EHc1iXPA6AsdD0zKnbak90fUfL5dSpTw3poPMCdeGiWk57Xp13qrhjF2SKNfJn8EFUI6JGcWw3S39cqpTfHqHDVl0vNPKsjnuQHrEBuXScxsE9KyygOcnFRIf0k9Ww7T42VysNuheQDfgi21aNALF32OmU8RbRsOFwYfrEpH8LuCArxhvIQcilIagBuhfgz29zrmirbWjrQq6NT92arDp635XcdeNVUL1CVQ5syuC32496WMOngkxPSIGsAbrxdzrj5IiV2E6tRt0sNDBUczA0O6IRu8zevldvx5M2OAQkGfMvQwLr8KQXg1yDeFyy1hMgW6NRYibSlvyiKyhSYk37n7LEFXCyjVdP12YyizvacWejpcOmGQgK4R7wbMSJaadGodm7j3oR8SCw1eEadWX80AuyFrn1Ea9uO3nwlcxnxarm0KJPuj1tFpUJwQXM7t2602OKtkOOmejG6dB5xHGWghzMFuuS7VtCGHTFyxbY07FOhnuPk0BFLYJ7zqADyJMiCKe8dNMpopWvLlfdS7QJW9RQ9iSKwoSCzRLVOSSj2jo17xlyd5O8iczNRjNtrIjgkQTQvnTBSya14HVonXlS6qyuJhIrXSh8GApydKmTrujCEULsqWDTpTH8fzRK0pCiu2qKBfXxG1MrdBhGrhj41A1Fp8pYK5P3wev17WyxbEqvitwfvhlewdEJLvm9F53SFhBVXN6DVrViKBasJk7bfnTElMCIsR1vMn218wHiv3WMFozSeVpFjtcsIF1C8f8OJMwKlHCBYGWlryHg9EopzK7TXqgdVmtVqRbx7KfrWamPF9cyD7C1HhmqGSVknEG8L2uMHT7ltRqyiwgVQ1284XNbYsugeW8VGMmObcSydKnirpQKYbXiQvp0tblKzlK38I5Tixp3hmeezOszer920tlsjBJXGhbp2uiiFDBrkNX2m8iaOMHMcfSN9TPxbxE7nO6cB3B7wLrPN29uXe90V2qY9MEBSe3vaxVId8B8xyob5wvIUQm2pQ
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00402c80
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x404281
push 0x417f5c
mov ecx, dword [ebp + 8]
call fcn.00402d60
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402fb0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00402fb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00402fb0
mov eax, dword [ebp + 8]
jmp 0x404421
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00407090
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x40], str.DpEHf8xPV5V47Ij3Sd6zsN3cf6EsTchE4GnCfcf0mdPaE4Hmbj4a2cGXTBToNO0CV236YjtgzBcUrUbJpIFNGekmMb9YQ71PLyY4TdP1lluak1ePUuV36vEfaCopOnEhcIscjND9YsFWxGvn73OdIG50VF29NwrTVoFXl5S4oQ8AAXS5tcioOEIzwSUTg85FJQNyXfhF4jIHjuqHA9grymonXMpCWowAsIWXXAfq5wH9TvqY5txWRXzlQJgAYbQG33eXVyRh34R3RXlFFcWkwJwXm1GiKYrXvgC2lJ0GcooM
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404050
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00407090
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00405760
mov dword [ebp - 0x48], str.4D1Ff4me4InTD1plzK3oSqd7LaTA9mkQq3sG9iigEnp0wtyLE3oLgjAk6b1AGWrWmmkrpMtHCWt835xgLzLxPFl52vV9NHg5xfRm8rkRB5vj09DF
cmp dword [ebp - 0x38], 0
je 0x404345
push 0x41819c
mov ecx, dword [ebp + 8]
call fcn.00402d60
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402fb0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00402fb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00402fb0
mov eax, dword [ebp + 8]
jmp 0x404421
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402c80
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402fb0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00402fb0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00402fb0
mov eax, dword [ebp + 8]
jmp 0x404421
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a33b
mov esp, ebp
pop ebp
ret 0x10