Function at 0x40fe90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x543a2e
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x5960c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
mov eax, 0x5722cf
lea esi, [ebp - 0x240]
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x22c], 0xf
mov dword [ebp - 0x230], ebx
mov byte [ebp - 0x240], bl
call fcn.00405480
push 0x207
lea eax, [ebp - 0x223]
push ebx
mov byte [ebp - 4], 1
push eax
mov byte [ebp - 0x224], 0
call fcn.00521f30
add esp, 0xc
lea edi, [ebx + 0x16]
mov eax, str.SOFTWAREClassesCLSID
mov dword [ebp - 0x268], 0x208
mov dword [ebp - 0x270], ebx
call fcn.00405480
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 0x260], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x40ff64
lea ecx, [ebp - 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov ebx, dword [ebp - 0x260]
neg ebx
sbb ebx, ebx
and ebx, 0x200
add ebx, 0x20019
mov dword [ebp - 0x248], 0xf
mov dword [ebp - 0x24c], 0
mov byte [ebp - 0x25c], 0
mov edi, 2
mov eax, 0x5732fc
lea esi, [ebp - 0x25c]
mov byte [ebp - 4], 2
call fcn.00405480
push 0
lea edx, [ebp + 8]
push edx
or eax, 0xffffffff
mov edi, esi
call fcn.0040d000
push 0x10
mov eax, str.InprocServer32
mov ecx, esi
call fcn.0040cf20
push 0
mov eax, esi
push eax
or eax, 0xffffffff
lea edi, [ebp - 0x240]
call fcn.0040d000
mov byte [ebp - 4], 3
cmp dword [ebp - 0x22c], 0x10
mov eax, dword [ebp - 0x240]
jae 0x40fff4
mov eax, edi
lea ecx, [ebp - 0x264]
push ecx
push ebx
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x260], eax
test eax, eax
je 0x41002b
push 0x58a844
lea edx, [ebp - 0x274]
push edx
mov dword [ebp - 0x274], eax
call fcn.005222e2
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x264]
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp - 0x270]
push edx
push 0
push 0x5722cf
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov dword [ebp - 0x260], edi
test edi, edi
je 0x410077
push 0x58a844
lea ecx, [ebp - 0x26c]
push ecx
mov dword [ebp - 0x26c], edi
call fcn.005222e2
lea eax, [ebp - 0x224]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410080
sub eax, edx
cmp eax, 3
jb 0x4100cc
cmp dword [ebp - 0x268], 1
jb 0x4100cc
lea edx, [ebp - 0x224]
push edx
call fcn.00411ad0
mov ecx, 2
add esp, 4
cmp eax, ecx
je 0x4100fa
push 0x58a844
lea eax, [ebp - 0x27c]
push eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x27c], ecx
call fcn.005222e2
mov eax, 0xd
push 0x58a844
lea ecx, [ebp - 0x278]
push ecx
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x278], eax
call fcn.005222e2
mov eax, 0x4100f4
ret
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x41010b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea esi, [ebp - 0x25c]
call fcn.00405090
lea esi, [ebp - 0x240]
call fcn.00405090
lea esi, [ebp + 8]
call fcn.00405090
test edi, edi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0051ac68
mov esp, ebp
pop ebp
ret