Function at 0x40f9e4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ac
mov eax, dword [0x41f040]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x402260]
push ebx
movups xmmword [ebp - 0x56c], xmm0
xor ebx, ebx
mov dword [ebp - 0x54c], 0x55594b6a
movaps xmm0, xmmword [0x402530]
mov ecx, ebx
movups xmmword [ebp - 0x55c], xmm0
mov dword [ebp - 0x548], 0x797d7933
mov byte [ebp - 0x544], bl
movsx eax, byte [ebp - 0x56c]
and eax, 0x8000000f
jns 0x40fa45
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x56b], al
inc ecx
cmp ecx, 0x27
jb 0x40fa32
movaps xmm0, xmmword [0x402540]
mov ecx, ebx
movups xmmword [ebp - 0x58c], xmm0
mov byte [ebp - 0x544], bl
movaps xmm0, xmmword [0x401cc0]
movups xmmword [ebp - 0x57c], xmm0
movsx eax, byte [ebp - 0x58c]
and eax, 0x8000000f
jns 0x40fa89
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x58b], al
inc ecx
cmp ecx, 0x1e
jb 0x40fa76
lea eax, [ebp - 0x5a0]
mov byte [ebp - 0x56d], bl
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x58b]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ff1b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5a4]
mov dword [ebp - 0x5a8], ebx
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x5a4], 0x100
push eax
push ebx
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x40ff0f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40fecc
lea eax, [ebp - 0x59c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40fecc
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov cl, 0x37
mov dword [ebp - 0x510], 0x44587f37
mov word [ebp - 0x50c], 0x43
mov eax, edx
xor byte [ebp + eax - 0x50f], cl
inc eax
cmp eax, 4
jae 0x40fb6c
mov cl, byte [ebp - 0x510]
jmp 0x40fb57
lea eax, [ebp - 0x598]
mov byte [ebp - 0x50b], dl
push eax
lea eax, [ebp - 0x208]
push eax
push edx
push edx
lea eax, [ebp - 0x50f]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x40fbfa
mov al, 0x69
mov dword [ebp - 0x530], 0x7c785169
mov dword [ebp - 0x52c], 0x29437d
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40fbbc
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x52f], al
inc ecx
cmp ecx, 6
jae 0x40fbd1
mov al, byte [ebp - 0x530]
jmp 0x40fbad
lea edx, [ebp - 0x52f]
mov byte [ebp - 0x529], 0
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
lea edx, [ebp - 0x208]
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov cl, 0x3f
mov dword [ebp - 0x518], 0x5a4c6a3f
mov word [ebp - 0x514], 0x4d
mov eax, edx
xor byte [ebp + eax - 0x517], cl
inc eax
cmp eax, 4
jae 0x40fc32
mov cl, byte [ebp - 0x518]
jmp 0x40fc1d
lea eax, [ebp - 0x598]
mov byte [ebp - 0x513], dl
push eax
lea eax, [ebp - 0x308]
push eax
push edx
push edx
lea eax, [ebp - 0x517]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x40fcc0
mov al, 0x46
mov dword [ebp - 0x538], 0x6b795b46
mov dword [ebp - 0x534], 0x264078
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40fc82
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x537], al
inc ecx
cmp ecx, 6
jae 0x40fc97
mov al, byte [ebp - 0x538]
jmp 0x40fc73
lea edx, [ebp - 0x537]
mov byte [ebp - 0x531], 0
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
lea edx, [ebp - 0x308]
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov al, 0x2d
mov dword [ebp - 0x520], 0x7a6e5b2d
mov word [ebp - 0x51c], 0x72
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x40fcf2
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x51f], al
inc ecx
cmp ecx, 4
jae 0x40fd07
mov al, byte [ebp - 0x520]
jmp 0x40fce3
lea eax, [ebp - 0x598]
mov byte [ebp - 0x51b], dl
push eax
lea eax, [ebp - 0x408]
push eax
push edx
push edx
lea eax, [ebp - 0x51f]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x40fd95
mov al, 0xe
mov dword [ebp - 0x540], 0x7b6f5c0e
mov dword [ebp - 0x53c], 0x2e4873
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40fd57
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x53f], al
inc ecx
cmp ecx, 6
jae 0x40fd6c
mov al, byte [ebp - 0x540]
jmp 0x40fd48
lea edx, [ebp - 0x53f]
mov byte [ebp - 0x539], 0
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
lea edx, [ebp - 0x408]
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
xor edx, edx
mov dword [ebp - 0x598], 0x100
mov al, 0x3e
mov dword [ebp - 0x594], 0x655e3e
mov ecx, edx
movsx eax, al
and eax, 0x8000000f
jns 0x40fdbe
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x593], al
inc ecx
cmp ecx, 2
jae 0x40fdd3
mov al, byte [ebp - 0x594]
jmp 0x40fdaf
lea eax, [ebp - 0x598]
mov byte [ebp - 0x591], dl
push eax
lea eax, [ebp - 0x508]
push eax
push edx
push edx
lea eax, [ebp - 0x593]
push eax
push dword [ebp - 0x59c]
call ebx
test eax, eax
jne 0x40fe60
mov al, 0x67
mov dword [ebp - 0x528], 0x415e5767
mov word [ebp - 0x524], 0x27
xor ecx, ecx
movsx eax, al
and eax, 0x8000000f
jns 0x40fe22
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x527], al
inc ecx
cmp ecx, 4
jae 0x40fe37
mov al, byte [ebp - 0x528]
jmp 0x40fe13
lea edx, [ebp - 0x527]
mov byte [ebp - 0x523], 0
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
lea edx, [ebp - 0x508]
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
movaps xmm0, xmmword [0x401f40]
xor ecx, ecx
movups xmmword [ebp - 0x590], xmm0
mov dword [ebp - 0x570], 0x2f2f2f
movaps xmm0, xmmword [0x401f30]
movups xmmword [ebp - 0x580], xmm0
movsx eax, byte [ebp - 0x590]
and eax, 0x8000000f
jns 0x40fe9b
dec eax
or eax, 0xfffffff0
inc eax
sub byte [ebp + ecx - 0x58f], al
inc ecx
cmp ecx, 0x22
jb 0x40fe88
lea edx, [ebp - 0x58f]
mov byte [ebp - 0x56d], 0
lea ecx, [ebp - 0x56b]
call fcn.00413bbb
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5a8]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x5a4], 0x100
push ecx
lea ecx, [ebp - 0x108]
inc eax
push ecx
push eax
push dword [ebp - 0x5a0]
mov dword [ebp - 0x5a8], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40fb03
push dword [ebp - 0x5a0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00418755
leave
ret