Function at 0x4010c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ef48
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x493224]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401c00
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], str.IsKlor0GXgWtsXigYjnst9Dnrz4fszh7QHQjIc81bLAgHFH6vUtXMOtwe5QfHbARoOgbRAIVwdJRxSo1tKCQLvAV4nq67oBrpuasdLghc81Kc3tOH9dsSP0bFoiPKTG2V9DLMlQOTlm24D6ET9sdhXlIblk8UsjiTYzTmt9eMU3sM6u7MAoJOyMTfFIj4KXdfXDLpQm2reFqbWX8X5TJ3M8XU8YlQxicPQpq4DjFUQbVfFW340G8gmH3IGXNbBW2u6f5cyosHGPGfMSCDsgTotr9DBOW7HHT01j3oPzCLRcYAPkXbl0e7QRb6q5EVDon6AEPUbphvNcLVnUA9l5pOK2XYV0TCd91GOGBH8baNx9LsV6wlP7PrSUgU4u2mgFqG6ePyouP4oiRizVjP5DYpDfi1JqLDtJB542iujeJVgodEPAfilc8W3eDMbekU5IoqpROSCyuO4rAHmQ5Q9NnU69zWTUwxIhWU0yfv2nwgqVkvjJShdxTvH3bo9YGLwmLoWTzvdm7YFQlYfz5XwsVkLKq7OrOJ28FmxINqLWlLOJ8YfUo0bGNm7O1gyNqsh3NUgS4dhm8CDDJdKCS4xiU1yBz8G9BSIPEPOfycfzdEw6OiKMWtapK2Pcuah14Nht2w6Gw5ajb6DbCJDKjfMbQBDu1U3u4Tle32d6k1r6rnOtVVfc1WnKRhD8d7rarMIBc3tposscd0C59bS0rR6iv0quYBB9CWIoeSovejyDyDhCdCkjiTiYz7yK2no4BK4DiwFmoS1fm8JfFmLAAzx1VkyQVAl4YrVEPyfVzO4ympEzDlRwH5BDwLRv4vJNRcX2CgdbvbUV4ApLNpL5lds2oXWaCxwq33gAKuT5YrHsST3xrj1tushuCM83DgmEMVntENPFUqx00Ik3qFEdvUrfpwLc0lBF0Fj26mLVgorcqzJ2a0924jvz0S7koElcaYvUbXAV6Vrr36pHEIq0a2iMKUp0j9ltjtR3i5tIw6uTx8gNv9Sm86Lb46Qu90cilGzFk2Nwxq2djK5xYQwjHKYQJxtl8TH0NluE8OD9Ro4x4P521ASkvpQD4y9uNiEe4kuO2agf4w0HdJxnl2FqSFeAQj4uYLDnUhuaVU1SqI9QiASe8g0KpJ2PqTypBsrSlbmtA9WFQKlnd8OgAH1ctWVYIjquYe69ipVgx1OIMiPW8La9YdKrjPh8dqSjKxNCSM0RaQ3FhVkuBx0AH1eVW07W1YCFOt0KhrikH5OFV60dv8AjdHqQiebzKDMDuOh2FXvuckYnXatz0Qp31keb3rXGEWXAmVsUqihVuj5Y8mMiCE9wIfxDJHCtzke7lRBWUNe4jUpaLNvmcaEv1haJJc0Sz9IyEkTT0jGsTEugMQV0Dwpq3GlzUSN5PBO6jvHYCSbaOJ7R9q5h6y9DzzFd5rLgVh2hLDr5S4xSp5yYQrQX4OKBmNWyl3SNL4KpvH0XjHGHXxVtmu7KXSVlcEmPDSSEQLM7plrkqYytC63NG3bBzWCOVM22Mf9ee4teEQ4WTuWOjSpTqvONYSW3ud1ToyOuwxxTJ7jAsdG7PbfeK9gOBbe5SmmVSrHTYDcvuJT2SxxuLmtLr6csdW0Vd53qxCksoK5H7SH53ecSz1H0OrKJRY0FDy0psWUE76lr4qNyWr
mov byte [ebp - 4], 3
mov dword [ebp - 0x2c], str.gLvLGplIUgcTLEUXeG9uQpvBJksNiLcCfSO28gHIFBUJDQ9cTDdQ4bqMHHiFfb9dL3TDvW3EJPnSnY8VkEKAzCczwxrcX12CQ8mtzbclCjKcEqdFo0tVUdxvkmUmFdTOJhrA7FjyBeogJ9BmffFjDvA61wSM5hDgW12iVjX3GAMkkHqqikjni7ROedDTrh3Oh9E5PY7uFgxoGeEHdsXWqKh3qrCJwTPNMQrBCH8w9Uq7zpbwVfT4Cd7bL3p6zmA3NBfNawKJo4lShwMDFzW0ul4veIJspvLLTesJiB6Ex2jMAr9hSFEaD7ekyVr0jHJEWQdIScHNqYxBOAO7k69fGv3Oc2xD7XKS3WcfPAtCFTlPN0fhYJg4iDodq9cV9OW1BjN23aJvGCbGSfMk7MoH7FvAhhEbgpo9f62YroaOBLE1UvDjhNDpPS34wenpPrYLTIvdVOQRlPwshxWIgDID7A3EIDTiJcyPKYy2t3iUB7FiQEJt7wY4HcTmcXVfnyNLf05W3NkaPJ7y3LSXcVrzhcs71wlnEXkr6dEHCQeNfE1UNnb35LIdC9TO2p7v0qCagmudb2DWNFGOwvl1Db7gsHPkRAl7nz4I1zrALiBEinAncPUBYHweyAepTQlsexVkQg0cnEyYcejogzo3w9wKIBtRiMury8mFxahx4ckSOvyoJu6YUGkKKBkmVPlGODrS9m4mT56jbidB5Yiw5OKirAXAvfAv215yWhMBWyu96wiXl18ecmiFDxU9r84XJJ9HwEtpiVvdaWW625C8Jt5obC7BYpJKXQkQJwO83EvlHaskckGFpCRaWYTt5OJlg3fVEjbjk9ifOzhHqq8MdB4QOU0ftViRHvqlFHwHg11CppWXLDFQnAIAELvkGaN9R5fVpMrg2Rda5JdzONRHr1wEpWU6XJNJR701LTe8LpQqgsUDHlfCbEMAYY9UnHYTkzQlULKHGth17j323h8kDFu6jrt3GX8zm1S8iqzwXScpzPJiXaO18tf5nXyIufepCx32AeQnPCJ5kphH9askfQhF8ks975mLhQcbKRpcvHprRf5cJ15lOTvczjEsEPKJ1e383mIcff7SpnHsr1CDX4sbHPXLXIN21ugVV2RJio8IWFQPr4Ud46hkwQD7IK1a06l2cABpWs8fhOlptDFuL5NB6rivgN4hb3HnP1jYuJdESlaVMLuoXqt8tGWTMxJfjVElaD0reFP95ArT65ShPSofGP1cduYEETnLI7mYuKPSVJruGNfXPxhtQ9ihf0RMXHWVlrE1BysUhNyzkFOIDLvA40WWjdCCyEmB7UQ7WIlkFAkIl6Ngej7wpOAYEaBPdEtXocx4SYw5vMrgvXfLReIq38b6hDkPgc1ELfVUMao8SSI9bO6P1TEF6x4YUkqHxjFNamUP48LpHb75bKdzs1PMKI1g7GGepDWUIaXf9QPJBOKtTrjvfEPx9p9v823UHni3PCgKrndV2NRqb70BEaSTvs1g2uxXPl0Dc1zaqOPL9UQIqBOkffP31Lx0D4phHSjCLWjwyo6WUMdRxk9xRUbkTk1cxvXtHWhkJmA2jmK93SC6WgjBBx5jpcbd4tJRM3VBBw57b4WY2tUizXskOMiNNv5qlojrnj8J71apFXf37H06TBFW9GgKkwf7fytWsnEqgMNIkywPju0NRQWasx1mhvxxr48MtxaQk4D7GraQnB7sY278V3i1WQdUkQl5rCcFQrWOihPwSEJLe2Ut0cphG0Vo4FiFR2dWDPEgKNDf94nb7g0ekhlXMvK5C8i5LLxfLsh6CQ6ld5FNGNSWRYK4BY64HEQxGpowzS3awj57WOqtud1zRgSLv7OmMtyYF5SgE1Mv4cROW9yKAIFxMrCtSE7U6Fa3jv3kS3XoTw7DBP9Ry45Io9xN8sBGD9z5E1J6pyHhFsSJ2rpKtBiqHkOyCthycCO9ltLmBoKN3cBd8mH3Yglt0hhJPFykjG4WtlNoaMwPH298BNv9bw34OVVDeCyPLD0EpbWBUSfOIhvsC7MbMArhe4Osidxpfa4zQUfRp3O6SDbqRBEjDmpot6Ao8d9j1MP5lWYtGK9miIP7qaJWiajBvDDudMIi28PEOFAiz2IYcwNXRzmFcXehyC3W0e210FIvF5mGadGyN6Lmwt1Nghaf5kxd1Te6qFkzQJssP0NPmBQFxikmWd0LPlrTKdQ6a61MrjQ1bAvUqcHLQM5MFBwDRvxMXfsFWUUi0uKAmr6DhrEDTeccylRl2dMrkK0vqHWdO5J7Pz8VdRQlb1LUcw0J3LOHREnhr21yOWaFTRVWKAKxObW6anRShh0AxbnmVV06J93Qr7j5Mn1T4bRDPf7pDH5oC71dSLJm8PaMUYyYvCu7aQxerC6rEViELWvfom1DnlV6m3lArmgRwq1h2aSCmImcTMhUCQz2G8yWpKQ7thARzve0uCc6rJn6hnWIMN6m8LQ0ftG1MFWRQ77mxUwx7uXHx7j8ebedy1ppCqW0Sw0AWDy5G718dsaCB1qDklAXGKsTVK85CqDOzSmGkpxA7VuIIKvNy0GK2Y0F4sewbBUks1jpC9F8L8R9uEY7sh4sWRGrytEP2YaSrB8iCNFtKbIkNEuaFHbKDISstAjO33OktDw89YvTb4UUVlSuTcp46XHuuuwwlXAsvq7uTtS8KGKQrYbFV29AbcSNPM5hqyn8EKtGnaauKM0ldpDkDTGgx8VblUeF7fhc3JbOU5qK25SSvaH4VTkPGC2VphFyx8AwUSHJFqte154aPo2uQtgNWG3R06x2bVN1z9v5CwMKKhGe8TshvvGossBlFwrwO1CxpM0dBOzFO0jkz6452eJDee0czCrDBoX3RxwjgVHPntXYH66yIjtk3pcNoh3kXHXsvtoh4CNCbO91pA1pTKV2yzU2qlcJHfSIX4RNjJaUz3MtSVvmWY82erzixvllVWiOTb9l8kN9r4iGC9p6nPYrmPhubmjQ5mSG85r7uypdgFugwQOoKun63KN4npsfUIAmtqP6bIpz8yF3Jl00IycChkHXI3xKxQwQSfp2NiU9EhBbLwrEY1doOObDovMSmg3anXdrMQKr5iu3tXOanebygDa4aXRq95Em1pcBr6rpa0Xj1S1kJ0P13kgJluVqY47t0NkzQWbykBaTS68X3sNsrBNER0ybfEmCyJs9UnVUugDYT6qTl9IkxgPmdlNfGSvQ1drSqyk1c0p2d1rYI19Ogj4Ssf8uosWiLB6aWLFSxJWLiBP5noAVlPWLfiu0IHc3jF85Ts26ehabWhw5A0xon6B7N2j9pB1hcCguwb8Jwkrvl5CQHVqHKuTtVPpyvLm73X83SEpnftBgTHqk8IB8IxnX1Y79nsoJAFn9QJ29PcVfqsqqoerJjVgc2Ea4JytjB5wXcqPEiSbv2kn54KbiqtwjuVMLCCa4YU5rrQn4cLvlbUafMW6oN8OWwKDVoOebFiyhXiU1H2zlDtUUkTnlW0uhPYQwIYEUFIjU0aoGxHsmuRW4u49hgjCYFmXLCxAv76LCx2vK0HJucFNGagv2VrWfTv3atDrebHenvAAq1Tn8v1cPkJwg0UXMWVwtUYLk6fXWxFIq1XPTvJ4v18ckinOPP4mIXXm7gLdQcgGY5w3IBhxLnqtqxEp88dVcXBdT2J9pNtVQN5lLyIXGB5htdEhU0y5sxzv0W2VExzFip0ytqORl0QsaGtJ0ba5jHbCKyRDqqXK6EAVyBV1OUVQW7lKC03FRKlbxwRjjibLxV0dXP5lgLUd4tC1Dm25tkFYHz6WGMU2s9hyWaU0L7KhuCNUkJSUKpn0CwVuDpYvaPpA1YKlvxPH0dwxxagjzjlsJfdR5tlSv5coU0uVCIS85HAGDiGO6C3LrH7TF87zQypuGgJwio383pURtkBqJjEwaXdqOlxG4vDSD8H5IoRgWuyfr4jBaGXzm7vcHV00xLp0kifK6Eg0BTJLqR2hmkoTvnlUiv02bK7IANQWE9xMzqM2QFPNub0K41vgixf0pp4owYFdCVo0fGckE0K05vvwxo8QbjwNalqPtwukgaW1H9BGgXD9PVhRrVLhdVM3TFih4rIgP3F8Q5LPE
lea eax, [ebp - 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x34], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00401c20
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x401197
mov dword [ebp - 0x30], str.wU7UUM3f0QusWrfmH5rYGvca94zPJoeH71mxjeP3JGyiXat2eNLtIxjgds2GVOazpar3EspAcPTDxrXOnxUBiInUR5n9KrUhDlxfuXNXqwTk0Hp1V7jvoPAVwI12GJ4wEHQ3JgQaEDqFyTJfjwpnnATVHRQKazqlVCDtHN8YeNVEimcpz0G
push 0x47b684
mov ecx, dword [ebp + 8]
call fcn.00401c40
mov ecx, dword [ebp - 0x38]
or ecx, 1
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00401d40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
jmp 0x401338
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
push edx
push 0
lea eax, [ebp - 0x20]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.0040c0e0
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401dd0
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.0040c0e0
push eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00401e10
cmp dword [ebp - 0x24], 0
je 0x401256
push 0x47e09c
mov ecx, dword [ebp + 8]
call fcn.00401c40
mov edx, dword [ebp - 0x38]
or edx, 1
mov dword [ebp - 0x38], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00401d40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
jmp 0x401338
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401c20
mov ecx, dword [ebp - 0x38]
or ecx, 1
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00401d40
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00401d40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00401d40
mov eax, dword [ebp + 8]
jmp 0x401338
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10