Function at 0x40f598
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0x10
call dword [sym.imp.COMCTL32.dll_DPA_CreateEx]
mov dword [ebp - 8], eax
test eax, eax
je 0x40f970
mov esi, dword [section..data]
push 1
call fcn.0040e46f
push 0
push 0
push 0xb
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 9
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x3c], 1
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x164]
push 0
mov dword [ebp - 0x28], 0x100
mov dword [ebp - 0x64], 0x48
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x2c], eax
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0x110c
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x164]
push ecx
push dword [ebp - 0x60]
push esi
call fcn.0040fa48
test byte [ebp - 0x5c], 0x20
mov edi, eax
je 0x40f8bd
test edi, edi
je 0x40f8b3
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x164]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40f8b3
push dword [ebp - 0x60]
push 0
push 0x1113
mov ebx, 0xff
push esi
xor edi, edi
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub ebx, eax
lea eax, [ebp - 0x164]
push ebx
push eax
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x40f6f0
lea eax, [ebp - 0x164]
lea ecx, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_Ordinal_234]
push dword [ebp - 4]
push edi
push dword [ebp - 8]
mov eax, edi
inc edi
call dword [sym.imp.COMCTL32.dll_DPA_InsertPtr]
push ebx
lea ecx, [ebp - 0x164]
push ecx
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x40f6b2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x40f979
push dword [ebp - 8]
call dword [sym.imp.COMCTL32.dll_DPA_Sort]
test edi, edi
jne 0x40f736
push dword [ebp - 8]
call dword [sym.imp.COMCTL32.dll_DPA_DeleteAllPtrs]
push dword [ebp - 0x60]
push 0x8001
push 0x1102
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x44], 0
jmp 0x40f8e5
dec edi
mov eax, dword [ebp - 8]
push dword [ebp - 0x60]
push 4
mov ecx, dword [eax + 4]
push 0x110a
push esi
lea ebx, [ebp - 0x3c]
mov edx, dword [ecx + edi*4]
mov dword [ebp - 4], edx
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov dword [ebp - 0x38], eax
push 0
push 0x110c
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
jl 0x40f879
cmp dword [ebp - 0x38], 0
je 0x40f834
push dword [ebp - 4]
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40f7b4
push dword [ebp - 0x38]
push 1
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
mov dword [ebp - 0x38], eax
push 0
push 0x110c
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40f7d5
jle 0x40f7f2
push 0
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.0040fc3e
push eax
push dword [ebp - 4]
push 0xffff0003
push dword [ebp - 0x60]
push esi
call fcn.0040fb0a
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_234]
dec edi
js 0x40f82c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + edi*4]
mov dword [ebp - 4], edx
jmp 0x40f82c
push dword [ebp - 0x38]
push 1
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x38]
push 0
push 0x1101
mov dword [ebp - 0x10], eax
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x10]
push ebx
push 0
mov dword [ebp - 0x38], ecx
push 0x110c
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test edi, edi
jge 0x40f771
test edi, edi
jl 0x40f879
shl edi, 2
push 0
push dword [ebp - 4]
push dword [ebp - 0xc]
call fcn.0040fc3e
push eax
push dword [ebp - 4]
push 0xffff0003
push dword [ebp - 0x60]
push esi
call fcn.0040fb0a
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.COMCTL32.dll_Ordinal_234]
sub edi, 4
js 0x40f8aa
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + edi]
mov dword [ebp - 4], edx
jmp 0x40f83b
cmp dword [ebp - 0x38], 0
je 0x40f8aa
push dword [ebp - 0x38]
push 1
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x38]
push 0
mov edi, eax
push 0x1101
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x38], edi
test edi, edi
jne 0x40f87f
push dword [ebp - 8]
call dword [sym.imp.COMCTL32.dll_DPA_DeleteAllPtrs]
push dword [ebp - 0x60]
push 4
jmp 0x40f614
test edi, edi
je 0x40f8f7
push dword [ebp - 0x60]
push 0x8001
push 0x1102
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x164]
push ecx
push edi
call fcn.0040fc3e
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0x110d
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
push dword [ebp - 0x60]
push 1
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x40f620
push dword [ebp - 0x60]
push 3
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x60], eax
cmp eax, edi
jne 0x40f8f9
push dword [ebp - 8]
call dword [sym.imp.COMCTL32.dll_DPA_Destroy]
push 0
push 1
push 0xb
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 9
push 0x110a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, dword [ebp - 0x14]
je 0x40f961
push 0
push dword [ebp + 8]
call fcn.0040ed06
jmp 0x40f969
push dword [ebp + 8]
call fcn.004104c4
push 0
call fcn.0040e46f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4