Function at 0x401b50
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4081b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push str.GetVariableFromIni
lea ecx, [esp + 0x20]
call fcn.00401000
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
xor esi, esi
push 0x104
push esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call ebp
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x10], ebx
jne 0x401bb7
lea eax, [esp + 0x1c]
push str.LocalAlloc_returned_NULL
push eax
call fcn.00401120
add esp, 8
jmp 0x401d75
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
push edi
push 0x104
push ebx
push 0x40ce6c
push esi
push 0x40a4c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x401bf3
push esi
lea ecx, [esp + 0x20]
push str.Unable_to_read__s_in_section:_VAR
push ecx
call fcn.00401120
add esp, 0xc
jmp 0x401d75
push edi
push esi
call fcn.00401ea0
add esp, 8
test eax, eax
je 0x401e4e
push 0x40a10c
push ebx
call fcn.004022bc
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x401c31
push ebx
lea edx, [esp + 0x20]
push str.Invalid_Registry_Key_format:__s
push edx
call fcn.00401120
add esp, 0xc
jmp 0x401d75
mov edi, 0x40ce70
or ecx, 0xffffffff
xor eax, eax
push 0x40a10c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebp
rep movsb byte es:[edi], byte [esi]
push ebp
mov ebx, ebp
call fcn.004022bc
add esp, 8
test eax, eax
je 0x401c88
push 0x40a10c
push ebx
call fcn.004022bc
inc eax
push 0x40a10c
mov ebx, eax
push ebx
call fcn.004022bc
add esp, 0x10
test eax, eax
jne 0x401c68
mov edi, 0x40ce70
or ecx, 0xffffffff
xor eax, eax
dec ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.HKLM
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
push esi
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401cc9
mov eax, 0x80000002
jmp 0x401d48
push str.HKEY_LOCAL_MACHINE
push esi
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401ce2
mov eax, 0x80000002
jmp 0x401d48
push str.HKEY_CLASSES_ROOT
push esi
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401cfb
mov eax, 0x80000000
jmp 0x401d48
push str.HKEY_CURRENT_USER
push esi
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401d14
mov eax, 0x80000001
jmp 0x401d48
push str.HKEY_USERS
push esi
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401d2d
mov eax, 0x80000003
jmp 0x401d48
push str.HKEY_CURRENT_CONFIG
push esi
call fcn.00402cee
add esp, 8
test eax, eax
jne 0x401e36
mov eax, 0x80000005
lea ecx, [esp + 0x18]
push ecx
push 1
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401db7
push ebp
push esi
lea edx, [esp + 0x24]
push str.Error_opening_registry_key:__s_s
push edx
call fcn.00401120
add esp, 0x10
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401d84
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x401d8f
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004010a0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
push 0x104
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x401de0
lea eax, [esp + 0x1c]
push str.LocalAlloc_returned_NULL
push eax
call fcn.00401120
add esp, 8
jmp 0x401d71
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x38]
push ecx
push eax
push 0
push 0
push ebx
push edx
mov dword [esp + 0x50], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401d71
mov eax, dword [esp + 0x10]
push ebx
push ebp
push eax
lea ecx, [esp + 0x28]
push str.Error_reading_registry_value:__s_s_s
push ecx
call fcn.00401120
mov edx, dword [esp + 0x28]
push edx
call fcn.00402260
add esp, 0x18
mov dword [esp + 0x14], 0
jmp 0x401d71
push esi
lea eax, [esp + 0x20]
push str.Unknown_registry_key:__s
push eax
call fcn.00401120
add esp, 0xc
jmp 0x401d71
push 0x104
push 0
call ebp
mov edx, eax
test edx, edx
mov dword [esp + 0x14], edx
jne 0x401e78
lea ecx, [esp + 0x1c]
push str.LocalAlloc_returned_NULL
push ecx
call fcn.00401120
add esp, 8
jmp 0x401d75
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401d75