Function at 0x4136a0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x567680]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x220], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x413788
mov ecx, dword [0x568ad4]
mov esi, 0xc
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
cmp edx, 7
jne 0x413781
test ecx, ecx
je 0x413781
mov eax, ecx
and eax, 0x80000001
jns 0x413732
dec eax
or eax, 0xfffffffe
inc eax
jne 0x41373f
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x413746
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x568ad4], ecx
sub edx, 0
je 0x413770
sub edx, 2
je 0x413773
dec edx
je 0x413774
jmp 0x41377d
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x568ad4], ecx
test ecx, ecx
jne 0x413724
xor al, al
jmp 0x413b4a
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
mov dword [ebp - 0x23c], 0
call fcn.004eaaf0
mov ecx, dword [0x568ad4]
mov eax, ecx
imul eax, ecx
cdq
mov esi, 0x18
idiv esi
add esp, 0xc
mov dword [ebp - 0x22c], 0x104
cmp edx, 0xf
jne 0x4137d9
dec ecx
mov dword [0x568ad4], ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x413b2e
mov edi, str.Volatile_Environment
shr edi, 0x10
lea ebx, [ebp - 0x218]
mov dword [ebp - 0x244], edi
shr ebx, 0x10
mov esi, str.Volatile_Environment
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
test ebx, ebx
jne 0x4138ba
lea eax, [ebp - 0x218]
movzx esi, ax
push ebx
push esi
call fcn.00403090
add esp, 8
test eax, eax
je 0x413866
push esi
push eax
lea ecx, [ebp - 0x21c]
call fcn.004082e0
mov esi, str.Volatile_Environment
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
mov dword [ebp - 4], 1
mov dword [ebp - 0x230], 0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 2
test edi, edi
jne 0x4138e7
movzx esi, si
push edi
push esi
call fcn.00403090
add esp, 8
test eax, eax
je 0x4138f9
push esi
push eax
lea ecx, [ebp - 0x224]
call fcn.004082e0
jmp 0x4138f9
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4138c3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040b9d0
jmp 0x41386b
push 0x15
push str.Volatile_Environment
lea ecx, [ebp - 0x224]
call fcn.0040b9d0
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
mov byte [ebp - 4], 3
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x248]
push eax
mov byte [ebp - 4], 4
call fcn.00467f20
lea ecx, [ebp - 0x224]
push ecx
push eax
lea eax, [ebp - 0x240]
push eax
mov byte [ebp - 4], 5
call fcn.00467f20
add esp, 0x18
lea ecx, [ebp - 0x230]
push ecx
push 0x20019
push 0
push dword [eax]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x240]
add esi, 0xfffffff0
mov edi, eax
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413989
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x248]
add edx, 0xfffffff0
mov byte [ebp - 4], 4
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4139ad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x238]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4139d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4139f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x413ab2
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x5671f0]
mov ecx, 0x5671f0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 6
test ebx, ebx
jne 0x413a4d
lea eax, [ebp - 0x218]
movzx esi, ax
push ebx
push esi
call fcn.00403090
add esp, 8
test eax, eax
je 0x413a78
push esi
push eax
lea ecx, [ebp - 0x228]
call fcn.004082e0
jmp 0x413a78
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x413a56
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
call fcn.0040b9d0
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x228]
push eax
mov byte [ebp - 4], 7
call fcn.00414870
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x413ab2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x23c]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x218]
inc eax
push ecx
push eax
push dword [ebp - 0x220]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x22c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [ebp - 0x21c]
add esi, 0xfffffff0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413b15
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
mov edi, dword [ebp - 0x244]
mov esi, str.Volatile_Environment
je 0x413821
mov ebx, dword [ebp - 0x234]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
xor ecx, ecx
sar eax, 2
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e9514
mov esp, ebp
pop ebp
ret