Function at 0x404580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414e59
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x44a1d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x18]
call fcn.00406620
lea ecx, [ebp - 0x18]
call fcn.00402eb0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x48], str.FgWf0SG5SeYEir1CflfI9OnCqFrNxnrJQbV74DvjWs40PcgK2lIWYEHu3Mi05LutbDKNpvyieBliYiYJL9gLmdj5bxTElj2Ns2fPs2vSRSIsdz8NmDdodrMQOqsb4YFebgNC73pBfvdOYBwiqfxUTx6QeSgjSuRqzLqqHEBAVIP3FJLGhSJkg1uMNrFdrkUdxsEr3cLCHLLgE6jCU1WwxAz2aB6pjHVwGNEKmkT6xVeWcxqR4BOfuggyaS5O1FQsmL7loUn7CvwXzKfl96BahkO0PPbN20rfxPm2g8OlkL0B07G4iwaPwkODo143Mdkf00fAAof9g29vBNvfjmTIl4aniYvDHETX8NeDroXucEuIxMjdKDN7hB5Lbmi75nr55flIk5D19WCGQKvrOUrghia1SImkef1mFScfeGfXhkgfybmxudXhPIhWtHFxoPyKsMYwyG5h27bADjVgm86aOLD2cWisLxMjFwsLcQMtYKcl197vNK9NAzOpu6l6wuhggbW3sbjJXBfwztFiQEY1XwGO2O4VKAqXQopn9XXUW9lv9O8NfY6rbirEGNILwwsTOhkAuJmsbLy4vtTmsluFXOCXvJGROIqIdsLsakrt4X4npwbpCUN9ti5qLlrPDmcbM6oEjOtJec51xM2yBldeka0lVltFSrve0RrIxy5BtWVVwSkxYNv9BbUHGvoMrFRS0XJ4T8b7QJ1t0aKd0022NkE5TzUX7yDnF6D2Rr1WA4NntKQCC8IUVRpIEkLoGm32zs8PpCdp6tQJuzXVwV5HpkFwezNCT75kYNLzV5Es1wL7tfip5Ebb7ug085VDrCBSRnFgjvBGcKgoRfPwn3H4nqmj1IaMUqhtUWwLPNBjFM9R1IrPboSV0rqfNjyNWRDYuMDShdBdHbffeFM5Ysxfe8ihzHgO510sHGPhQbMUHzwzLMl7Wz4nJl6tDLwnMKv5kYAufsIAmz0mTztV0wrzHdjzupEnwGbbQtTYz2jYvQLrLiiHHGeYH6IVQw18HeOdtxm7qcJzc304vWOGnSyENFsyB05kFv5M5186OryqHPWScmPjYv7vvQY5SOo4JrqDigX3fCDfuVWVR20agpemMN5O0SANbJbFodd0DKbpd1pCwkLUB1JT3YQGsclqcOrToeKPobHTJOOM6jqr6d5Ka6JgYIrcXVbu1g5llv4n95JBuO7HAsjos8vJvrKKA3cKEJgfNAq7IyOFxuKQzG1dGkgY9oc8aT69qBV5wyk1V1L04Ha9gmmt5cqtgALLI1jealikGNAEtfpVMAV0zr7klvJll5AteF8LnValXYned3Bgs4tX9rBQzjhnaUNuBUDBjRUns1bAeej8HN5IjmKXoTsXCbFoLzLKRbvyK6OdQCy69hP65I3vNR1bUWubybioFnrVPFtex4t5mEE4byzcl21IlkHfJ7KL6wQoctzp1sfrQViK5qWFUvQTtsKl4sBm9bqLKuX89D8R7QjpSpqpVDeI4seEg64HzppJRWLs5wuuyU8qs5MNg6dL4uJJWFcxPOEUnpr562JMyoXjkxqacLbkDI0wLATH3wAMzCLkH4oFsjSMKpjEtOOh8kPmf1Uc58dGbDSaDz1qyuMCGOXllFba7v5XTRMauM5UnLfbMvhH4umNMqwbs2CanuHtdRRRwaoCOCADiRUAbDbqpoE1UQO6QuInAupJ9pPPB13rsBJx44BHBoEBjnMqKKeAoWqj1eKug426OKEmMAO39BmzE5TeqyroYfLjuO1pOakM7jClrRSVuMdqqKNhtaAsA8ayET7kGV0kgjH4YiD4O7dzyouWES2Sta63hH4POis9oP1yp3Ld0lVlqikgY0b6OCWSOYvqyptnRULfB1MkBKzTR1WQDQvYKzRkt0EvGJ6IdEfUsU2uV6Plbol41LCKmPSM7whlwXKya8OJKdFVWG3E7vOOH8a4H0OOlSJ6K48UGtUki8HYli8FPG2IuhRVLrk4qQWQyijqUO4CLDYbKMx3vyk75KCdMFD2vmea4Id4rU9ocdfGMWOJGhKIbTJ9sS4hsiBgqgYs7Q4DiyvOOmO3oY6G0sxos9rlx17rGGVWqDEwDmyeBDWTlepaKdtXqmOgfV5jfJVN4C4zdsXPStX64lS27ySncNQf5wfpdT1YeIjKg2YHrC6oMzRQjsXAW3RIAkJgtzjaFtiukAu75URyxSQT1iV4UWWRonligfUWxrWpIj3xn3lQssUDGPvxAFAFitI54SIN5LGphfiFMAWbCukFEcIzJs8TRmVIAsLzPEEGoVR2dOM3o3LlM84WioSrfVqNHFtOx6EvgBJLnClgBI6fcm6TakWfcCdPJwCJ65xwYeFcFtFuylvF7Ds1aRjrhoTcsfjcEBfKEziLeiqj14ty2ITg9pIkFGF86lWFxJKDh835QzNcagSsDpb2O6MhkthPkBijgtc1QccQ5iCvECQyPvd5UPWRQg4ki4rSzUH4iOQW9VfsC3UIFPVz6jtLy4Vzy1LMq6xqvMVoVxDeCIRqtcn4XWsOvonob426W923lGck8CjOE7RMHtEt6XN0qhsvE1iuu9zmyQd31fnadVoz6vY90mgpIiPyUYWjBdE6Upq0FWx3cbfcwbBMaPqizuK1nlHw2uNs8e2IOO3dY5yH7nRw0VG5MtYhRIBKJ8HYPV9XTsKdpbNL92dPSSggVkUEI13gSj2BEWCy5Y4xLgLI948DaKexfGvkFpIWOcAF8pdvbY0zLmzxOocc8luIFFkkVjFk80fUMisVLD7yCMEO506c0dILTVsCbrfByVWs5gJ96AAFW8NO5QxGXHvLfCB5wJ8z5eKNqOgw9Y8WRe7q6Vm8cTcXMr2rxsmIT8IPda5Exy5jTc0aGfrnLG0IiACjf4h8mS4RJk2eFtjB4qfdzNKDJGVzeKLe8lxy3N2zj3O4BshwNwVnFEmz7iRbLauA7iamK9W18QXa7L4G1rt68QnbQEtlLznHzeszsehEp3PDF8gA5kBvis1QQJiYOeALmH6RmotmhHAJrO5COCpiGxzp0cDccURRKw4xQX7mNCdTkBj4s2iQ5do36vFcSVxXuNGwwiRi4qACTNi4KwXdozUjUTqlz3uVMRAqaKrb2qkCsdYHRmt0MLFdamHaEBdwhmJsNKFrEMWGYbTVq0fwBWf4yCahcrJn48ruCFqRQoLOav7AufWHqfkEGfht1UI2Hnj12UGGtRV6pAjoB7E90QE79tnGCRlVctkdFWsskFoMNjJYKTH4iW5YtpzXbHqm28KPjdTaaXYfb1dQobOitKuaaPQwCjky5hdk1acbIGj10EapnL0mTuSYEl0Hy7XBK8DLXhCgEAPLvDyX5MCn9ok8lhE1h2TuQahQB3wxz8RjCSWGizm80HXIyLf3Ovd6D9KVy1lA5zuzURuEfLd4qI1eCG3BSvAcQ3Y0FFBkFUFFKxUPFfxdBHMxMFczSvhsFbdGWAS3QVaO8ou5IcYiWXDUgaB1Xv7pJ42hDiPv3cAnLr69Y0xE1O30ci27W1ww8wkFboeLE0lR8bdFwoxgBAxQH35cm2t7nBlqesSm0pHWjEPbSiDJICIUQ8bKq7zpuEEJC6G8nhJp9oA41VMmyii1FYyn5jVwTi9qpVCo2enbctEGlNk2vY2m8RiOYdjswn3YPBLLbBljGtNcKERib5Kz9Ni0sRY7G2SwmKelWye3yunIyvnlo0qECxiUyTPheFxOE4fyt0oJt7idwC9Y8910mCQL1rlBnWfeyd6fMz5RLu4zVANHCYCmamlRj6xHQOuO9S9DUKm5ufJxqbhBiXoWLN1Fz130OsagHORlPI59qx0LbvRrKyAjRNSKFS2PTksRFILnqqXY035OLT9BOfvp6WOSbRjuaaRBKms8BDxEoWM8eX47wxxz4BxVkEc38Xg5NtBpaOclsXu06BRD5XaxjUzT7tCyL0NwTR0oSf6pLibEiVauW3VrmLgWc27VwKYOljsDwXhjCFpdfmQDKltNEONoWAKWi4EuCCU7IKAGWnhENzbFkpuvBvdFrScknWWHpClaaaHit8vShvINHPLSz1jmtdGCALmgB9Pypx81xfnEqnnU9daASjNb
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00402d50
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x404668
mov dword [ebp - 0x44], str.q2fKktVLFjQxQID6FchDg0YIut7wGL5NGtckCtdYOV3QOku0myqyG0uCUWsNQyBzKmLT4bepDKctvmMEVyBHjAwM91dInNduAW25F9sMygO9zx5m
push 0x426c6c
mov ecx, dword [ebp + 8]
call fcn.00402e30
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004031d0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004031d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004031d0
mov eax, dword [ebp + 8]
jmp 0x4047fa
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x4c], str.UfaK10uwWwbEqPBr15tNzLgoUOOY8sIq3GgJ0k23N9ldFJdGwCwDzjyDA32i3ioCXyX9hS6ST7GT0MpR8hDPXD6r91kViJTI9yJKzxRoLoWRQxOCLacJjSkBmO7iUlVxuHoXMbCgSJHkl4GrPETjkaPgTlBYEeJKoe5P1GHCFDmGkXNIbnObYEgYqeTHVWbWGEf2yYxXvnaumkyK8dkAsviHyRRiVCEDCKFTWYCcIY9pFLTIpn8r5UJMPrfLtTabXAvpRCyzBhdgeqoFgfghr4sUMRAf7SjOTta9gRYNoN5YGV8Aky4gicqgRRh28geJ3YroeHDThUiGouOiKgffCvDivTvvsbEXwWr076lnpHdCqJIx4zOEAgdU4bkgLlTqRvzwp402S239wSHXk07BzIlrRJAXqWRW42C7SBy7JxPLaEb40iPPaahxck1tvH1hA9EBrM6g0Bpbwg9h1vWJ8Rmghs5KLRoYlM7rdDJtBptasreTKSOjsa06irbVGbBAG6HIyeEatRxEzty6415fmmGSoksisSSsrwwa1Eb8tGWJ86SYdIIOdN1REXVcXN0SPNY9j0DzqjRD7DwwX430BQDF8UrdLcj2DQLGqmu35XiHdSozvqImmRglNyD0aSJWYWYrtTgxbE2tO9VTtpH7seIhD11p9dOCwAXHOJwpo7Lx1he90Ui96mRix9Sop1DQjwtp23XolSYJABTPB58XIFHAlEp3lDRoTMv9R0lEBfXW42apkj8HUAfIRUxD4YKQhHt7hMuHKfRhDUMaBjC9uzCHT86wmp8KQN2crBjueHDTcaalm1bJu53T7gHfJQpuxWeQIHNivd6ambe0YEKy7BL2c1OspIxmGdpgHi1QX7QzqTuafFChMCaiLSJ0iV8y4Whb9D6eXwmJqL5HtPnh9DDdq5yM0Yi9WON221gVMkSs5KEnm9Vx1dJHEFeUPNJ72GlTxHPPHaxBMjtQ5SxGqR26XowCQTMhtIzr4YbbUrhfGsnFiBM1Cac7MN3hKgjpTlt3cdKEAlQyAHLj55zq3FXPuednXoJ9lfmFIG5iPOPT33E4Xp9skYbMrIhBDm80kmTWDLNxIAFIi2BaXV3kkHIOU8lHzF4qPW498Ozeg5ADfJKJvecQ5szea5jElqKGht9aCebyqAGpxHOMtcMwQSOEnUTvbaW1xGNxGnu995PUx28cgVor5DybJNHt011uWBYtaFo0jmNdgjzLDSSnrn2fjC7TuyP6gvYM2xTvJV7suGzaRFrIMMvGc3mjXVVHKWpWwr7sd7cXEKcWGgCvcyoInwtkvMo55Kd44Nb1uXecTH3BePhpUq6XOglHQfQRo0FSf8kJflhK7aks7QBLq6brscGos1yCi1oNUSSB8OcmPjOJr37wpldy962qvhjLOqjP5AeVJMHTkRQBHqEiJUU4IqK1RIvDt6FFYKRtDlkoz3m4Tdojuz1cXt2u4z8reb4B4Tjljpq0exR1rXPrV9ntAgSlqzGhr5pBVBd3eDa2FCrietNeApTSizbbSWla2uWfrpgwMsATY2KyAMsP8cALIYzL9uLYgjgMCUg4m5vdV32oidj3rlvTrOA0zthvVLf5JI4khqAF1t7iCm8kCIPn1axVfGHpfl7DeqBqMfm9pAoBg45JYcLJURBJYrueSKqCJEUN728E0eQAksD21DCSCzLKfADrX15Q755lr23joJ1osVByqXN9wEQqfrLn4nhIrkihUg7qRV34H75k76KcYgvmQR3hdozkW6MgAw7prdEuyWy0dX29ikbjHfcfUQOo85TjvmHOMs7xYAMP2vfsIxc94tzj5OdhCX3RE5lol3iSouSM5G60ulGUYW5m8DhXjtHJ0MkVbUD8Fnip5vm1LWAM8BbdRRS7gns8pjLt9ubL8dMUXWTcFlI3VRXwDpcYKoUCIiD6JHvbxgsaQ1ExhhF9wG3SamJvgjQdL6G7a2ND81IE4KBuBfTGGwELE8kfuT1giQyTmqOjfpu8IQSezjXY4N6PRmRcEFNGgaKbpURbikLtLsOq2sbVCx2bsmAJjOlrCzLgLRvY7jRCBVTytyras445GALI5oCtJNWFRXNsgNtR8HC2aNicEKwQsrEg87yo2KbzPDeStASIhfSb8iqkPyygVC8LCMuJE9rNjSaYQO6TXaXgaSDs93fvy9JLMg91xwRUoiRWETGlb6wwbM8mK8eFiInv5YNSWXvmGEaKmMmhHVc9DSeBlxw287rzE83nLuxF8N5LAyP7xQ4WfXIVBJO9Cwr10wmepnqNevkzVDhYCgSTRiaQpUhN4pUvRIT5vCF0r4S5f0V33DnwoarLn3fskMkcfCsNIl6q2DTQOcXSeLSvIWR9TWakIf0CpqsrFIXe3cEdwlnzMMrLL78i8hEj7WcQSF1g4YWsfyA8Ib8CF9GptdlwYvr1SD0lueOHAt2bdnfkjY2X2CUKLRW89UrIUFr3gjdtWCFne6ldFCM2lk3jELQi4FDrCVqnyqepRSFXo1JRJxYHiIDO4GhdXHfTUUK8WqvB5PeSygp8UK8iSxUb2uTYPOxvfF5Cjvikl8VVlMtvaRAykTJwy7JGpBXmyP1CL9x3ptNX7ndcV3DJadzcFyendw9hjD1kIdMs6GbG2B19d5rwaezIoTdYvQLNvSqnNRgrbDPP1WsXuh31m2vPOlStmGJaEVuSWAM5thW4IDeYLzoP33Lt06PJyV2gJJmqmePFPD2XAN8ezqk1OYrN1w5BGmPJjP41uSyH5Q49QjbqWWy2vUc80Y0S6ypVpkv635IS66l6tWr2rKHPden33XmiTVdSBTwD1CG7KDAjbhca85hPjEWhj4jyWINkXPMYFByuWPVcvHPGAIFSqfxMVRrjS0TH5WSWvwYkA6R8HsS8V59hslpI67Ga8Ela5GkQjai7AVhsNB1JL7ULzHrsYAmGPqazz3tp9DtAUVrsC24tfl2AdjcyLbdoVPssHAzNio7FvJ3nJrXYYSrn5yOMGOnI9iw58uMGndsrl79osoOCbs1h78a7Xwj8VYLq2sb8dbqhpQcFSfRttktPy2EHPqXWwXK85OEIUKwEHQ3hUeuh6ks6TBqXAGBwU6aytt3qSFVkf6Vj9kdvKStwUxdstzU9R4RMXR5HI2se5CtIYrFlD2W3BPnWNqX1UnPAK4mtnfyugyGvAeGDxlb3hNWsSEellparAGm6Y3jrQ7XyTdbYGYmou8Ba2Lwfek8vLVvn1wsDUA9KAIgFRGyk3LCrAl9Po99G3z3za4nOzknT8V7ElMLC33YUT1G8pFJzI0bpop6VVLgKKQ8DW9QsQCfmlwb9EAzpC6U4WBe87rK4rjN00ixu4rCMkF3Ogowe3rgak27KgWeuWVMQkfvOAO1pel645nvIS41LjqFmxWqFNePXhDh1ynUCswvJNHDfrGVrUMtJ8dvbhuTRIGh4o3s3teTDPlbWDxC9rvJOdxXyrR3I2cOqM9ruIAdwm7vBPrBjrilN1SKi6jss8v72EhiYENP7kB9JXNhQMaK1IcbPPDvGpAhffn6JK9w6sjKxqCW6ws84CzWy1sFINVgS2GxbwXq4fv9W9rLQ3QgHU89PJdzxLFYeJQYVsI5CUjhxCpQnYoxVU6hWScYTgsc0nJpO7TpguEeFMf9lcn3USMc97vOdKzzmfDsT06KuKkel8fvURuu38yaFP67AePDXR8poHYOJfUEiEhGJpIdUWSRDdH4RdEQT36aJMiHohQ1VSNjPxoajHjkccU1zI3yHRMgAPRSLUnWpPQUJaa1dJp0pvbqViyXmELVLsAhc2Agy42Vqx00QoTHhAJUSXlbk1V0lhs8TcoSTCwDi9c1B4yFLIDe5l8euPvUzVv86OxSG76hfJpD49duQSOfQueYde1OT4TjU0AuQB5TAkA343NbmQY2f1wghBlsYmP8uFV24Iqv7b23Bbj89bIK12rHYCIeGuBqQuM1EzBX4Rm8T0P709oHBa4T0dDb59Aq2Te6GOI37dvpmXxjDOemazYjwAYXq4eJY681TApopgLACxEhM3gjyVog9cWWcW3oD3bHLATyxoI7tduX4rnimo51WM234zEKQuVfs
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.004034e0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.004043f0
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.004034e0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00405b00
cmp dword [ebp - 0x38], 0
je 0x404725
push 0x427adc
mov ecx, dword [ebp + 8]
call fcn.00402e30
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004031d0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004031d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004031d0
mov eax, dword [ebp + 8]
jmp 0x4047fa
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402d50
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004031d0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004031d0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004031d0
mov eax, dword [ebp + 8]
jmp 0x4047fa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a32c
mov esp, ebp
pop ebp
ret 0x10