Function at 0x40e100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4332e6
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [0x45da50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x328], 0
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
mov dword [ebp - 4], 1
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.SOFTWAREATI_TechnologiesInstaller
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e21a
mov word [ebp - 0x2e4], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x2e8], 0x208
lea ecx, [ebp - 0x2e8]
push ecx
lea edx, [ebp - 0x2e4]
push edx
lea eax, [ebp - 0xd8]
push eax
push 0
push str.BaseLocation
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e210
lea edx, [ebp - 0x2e4]
push edx
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_unsigned_short_int_const__]
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call fcn.00409e10
movzx ecx, al
test ecx, ecx
je 0x40e210
lea edx, [ebp - 0x4c]
push edx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov eax, dword [ebp - 0x328]
or eax, 1
mov dword [ebp - 0x328], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov eax, dword [ebp + 8]
jmp 0x40e3e1
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_void_]
mov byte [ebp - 4], 2
lea edx, [ebp - 0x2c]
push edx
push 0x26
call fcn.0040deb0
push 1
push 3
lea ecx, [ebp - 0xd4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_stringstream_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_int_]
mov byte [ebp - 4], 3
lea eax, [ebp - 0xd4]
test eax, eax
je 0x40e25e
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x32c], ecx
jmp 0x40e268
mov dword [ebp - 0x32c], 0
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.MSVCP80.dll_class_std::basic_ostream_unsigned_short_int__struct_std::char_traits_unsigned_short_int______cdecl_std::operator___unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___class_std::basic_ostream_unsigned_short_int__struct_std::char_traits_unsigned_short_int_____class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
add esp, 8
lea ecx, [ebp - 0xd4]
test ecx, ecx
je 0x40e294
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x330], edx
jmp 0x40e29e
mov dword [ebp - 0x330], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call fcn.0040b780
push eax
mov eax, dword [ebp - 0x330]
push eax
call fcn.00404550
add esp, 8
lea ecx, [ebp - 0xd4]
test ecx, ecx
je 0x40e2d5
lea edx, [ebp - 0xcc]
mov dword [ebp - 0x334], edx
jmp 0x40e2df
mov dword [ebp - 0x334], 0
push str.ATI_CIM
mov eax, dword [ebp - 0x334]
push eax
call fcn.00404550
add esp, 8
lea ecx, [ebp - 0x308]
push ecx
lea ecx, [ebp - 0xd4]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____thiscall_std::basic_stringstream_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::str_void_]
mov dword [ebp - 0x338], eax
mov edx, dword [ebp - 0x338]
mov dword [ebp - 0x33c], edx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x33c]
call dword [sym.imp.MSVCP80.dll_public:_unsigned_short_int_const____thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::c_str_void_const]
push eax
call fcn.00409e10
mov byte [ebp - 0x2e9], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x308]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
movzx eax, byte [ebp - 0x2e9]
test eax, eax
je 0x40e398
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0xd4]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int_____thiscall_std::basic_stringstream_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::str_void_]
mov dword [ebp - 0x340], eax
mov edx, dword [ebp - 0x340]
mov dword [ebp - 0x344], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x344]
push eax
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int______thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::operator_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x324]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::constructor_class_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int___const__]
mov edx, dword [ebp - 0x328]
or edx, 1
mov dword [ebp - 0x328], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_stringstream_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::vbase_dtor_void_]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::destructor_void_]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00430f9c
mov esp, ebp
pop ebp
ret 4