Function at 0x40df20
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47c410
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x4a67d0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a67d0]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
push 0x103
lea eax, [esp + 0x2d]
push 0
push eax
mov dword [esp + 0x144], 3
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0x104
mov byte [esp + 0x34], 0
call fcn.00461680
mov esi, dword [esp + 0x14c]
mov edi, dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
add esp, 0xc
test esi, esi
je 0x40dfcf
mov eax, dword [esi]
test eax, eax
je 0x40dfc9
push eax
call ebx
mov ecx, dword [esi]
push eax
push ecx
call edi
mov esi, eax
test esi, esi
jne 0x40dfcb
push 0x8007000e
call fcn.0047ab90
mov ebp, esi
jmp 0x40dfd1
xor esi, esi
mov ebp, esi
jmp 0x40dfd1
xor ebp, ebp
mov esi, dword [esp + 0x144]
test esi, esi
je 0x40e009
mov eax, dword [esi]
test eax, eax
je 0x40e001
push eax
call ebx
mov edx, dword [esi]
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0x40e003
push 0x8007000e
call fcn.0047ab90
mov dword [esp + 0x18], esi
jmp 0x40e011
xor esi, esi
mov dword [esp + 0x18], esi
jmp 0x40e011
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x148]
test esi, esi
je 0x40e049
mov eax, dword [esi]
test eax, eax
je 0x40e041
push eax
call ebx
push eax
mov eax, dword [esi]
push eax
call edi
mov esi, eax
test esi, esi
jne 0x40e043
push 0x8007000e
call fcn.0047ab90
mov dword [esp + 0x1c], esi
jmp 0x40e051
xor esi, esi
mov dword [esp + 0x1c], esi
jmp 0x40e051
mov dword [esp + 0x1c], 0
mov esi, dword [esp + 0x14c]
test esi, esi
je 0x40e079
mov eax, dword [esi]
test eax, eax
je 0x40e079
push eax
call ebx
mov ecx, dword [esi]
push eax
push ecx
call edi
test eax, eax
jne 0x40e079
push 0x8007000e
call fcn.0047ab90
mov ecx, str.HKEY_CLASSES_ROOT
mov eax, ebp
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e0a6
test dx, dx
je 0x40e0a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e0a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e080
xor eax, eax
jmp 0x40e0ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e0b9
mov eax, SysReAllocStringLen
jmp 0x40e138
mov ecx, str.HKEY_LOCAL_MACHINE
mov eax, ebp
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e0e6
test dx, dx
je 0x40e0e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e0e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e0c0
xor eax, eax
jmp 0x40e0eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40e0f6
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x40e138
mov ecx, str.HKEY_CURRENT_USER
mov eax, ebp
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e126
test dx, dx
je 0x40e122
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e126
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e100
xor eax, eax
jmp 0x40e12b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, SysReAllocStringLen
je 0x40e138
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x150], 0
je 0x40e165
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push 1
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e1ae
mov edx, dword [esp + 0x14]
push edx
jmp 0x40e1e7
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e1ae
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40e1e2
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x140]
call fcn.00401380
lea ecx, [esp + 0x144]
call fcn.00401380
lea ecx, [esp + 0x148]
call fcn.00401380
lea ecx, [esp + 0x14c]
call fcn.00401380
xor eax, eax
jmp 0x40e222
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x140]
call fcn.00401380
lea ecx, [esp + 0x144]
call fcn.00401380
lea ecx, [esp + 0x148]
call fcn.00401380
lea ecx, [esp + 0x14c]
call fcn.00401380
mov eax, 1
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.004611fb
add esp, 0x128
ret