Function at 0x413920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x38], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.004133c0
add esp, 4
cmp eax, 0xffffffff
jne 0x413955
xor eax, eax
jmp 0x413c67
mov edx, dword [ebp + 8]
cmp dword [edx + 0x1028], 0
je 0x41396d
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1040], 0
jne 0x413974
xor eax, eax
jmp 0x413c67
mov dword [ebp - 0x83c], 0x41d4ec
push 0x12
push 0
push 0
mov ecx, dword [ebp - 0x83c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x102c]
call eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x840], 0
jmp 0x4139b4
mov ecx, dword [ebp - 0x840]
add ecx, 1
mov dword [ebp - 0x840], ecx
cmp dword [ebp - 0x840], 0x100
jae 0x413b91
mov dword [ebp - 0x20], 0x1c
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x840]
push eax
mov ecx, dword [ebp - 0x83c]
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1030]
call ecx
test eax, eax
jne 0x413a17
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x103
jne 0x413a15
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1034]
call ecx
xor eax, eax
jmp 0x413c67
jmp 0x4139a5
push 0x20019
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1038]
call edx
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x850], 0xffffffff
jne 0x413a45
jmp 0x4139a5
mov dword [ebp - 0x84c], 4
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x848]
push edx
push 0
push 0x4214c4
mov eax, dword [ebp - 0x850]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0
je 0x413a96
mov ecx, dword [ebp - 0x850]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4139a5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
call fcn.004133c0
add esp, 4
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 0xffffffff
je 0x413b7f
mov ecx, dword [ebp - 0x844]
cmp ecx, dword [ebp - 0x34]
jne 0x413b7f
mov dword [ebp - 0x84c], 0x800
lea edx, [ebp - 0x84c]
push edx
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x848]
push ecx
push 0
push 0x4214d0
mov edx, dword [ebp - 0x850]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0
jne 0x413b18
mov eax, dword [ebp - 0x850]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413b91
mov dword [ebp - 0x84c], 0x800
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x838]
push edx
lea eax, [ebp - 0x848]
push eax
push 0
push 0x4214d8
mov ecx, dword [ebp - 0x850]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0
jne 0x413b7f
lea edx, [ebp - 0x838]
push edx
push 0x4214e4
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x413b7f
mov eax, dword [ebp - 0x850]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x413b91
mov ecx, dword [ebp - 0x850]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4139a5
cmp dword [ebp - 0x840], 0x100
jne 0x413bb3
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1034]
call ecx
xor eax, eax
jmp 0x413c67
lea edx, [ebp - 0x838]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [eax], 5
push 0
lea ecx, [ebp - 0x28]
push ecx
push 0x800
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x103c]
call eax
test eax, eax
jne 0x413bfe
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1034]
call eax
xor eax, eax
jmp 0x413c67
mov ecx, dword [ebp - 0x24]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x413c55
mov eax, dword [ebp - 0x24]
add eax, 4
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00401110
test eax, eax
je 0x413c55
cmp dword [ebp - 0x2c], 0
je 0x413c4e
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1034]
call eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401194
mov esp, ebp
pop ebp
ret