Function at 0x40dbd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 0x24], str.SoftwareWimInfoREG
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call fcn.004316f0
sub esp, 4
call fcn.00431690
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call fcn.00431ad0
sub esp, 8
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
lea eax, [esp + 0x68]
mov dword [esp], eax
call fcn.00431ad0
sub esp, 8
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0
call fcn.00431730
call fcn.00431730
call fcn.00431780
mov dword [esp + 4], eax
mov dword [esp], 0xff
call fcn.0042f070
sub esp, 8
call fcn.00431780
mov dword [esp + 4], eax
lea esi, [esp + 0x2c]
mov dword [esp], esi
call fcn.00431900
sub esp, 8
mov dword [esp + 0x30], 0xff
lea eax, [esp + 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x40dd38
mov eax, dword [esp + 0x34]
lea ebp, [esp + 0x30]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
lea edi, [esp + 0x38]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov edx, dword [esp + 0x68]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegQueryValueExW
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x40ddc0
mov dword [esp + 4], 0x441c28
mov dword [esp], esi
call fcn.00431a20
sub esp, 8
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegCloseKey
sub esp, 4
jmp 0x40dd4b
mov dword [esp + 4], 0x441c28
mov dword [esp], esi
call fcn.00431a20
sub esp, 8
call fcn.00431730
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00431990
sub esp, 4
call fcn.00431880
mov ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004319f0
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004319f0
sub esp, 4
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.004319f0
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.004319f0
sub esp, 4
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.004319f0
sub esp, 4
mov eax, ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call fcn.00431730
call fcn.00431730
call fcn.00431780
mov edx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0042f070
sub esp, 8
call fcn.00431780
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00431900
sub esp, 8
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov edx, dword [esp + 0x68]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegQueryValueExW
sub esp, 0x18
mov eax, dword [esp + 0x38]
cmp eax, 7
jne 0x40dd22
mov dword [esp + 4], 0x441c28
lea edi, [esp + 0x28]
mov dword [esp], edi
call fcn.00431a20
sub esp, 8
mov dword [esp + 4], 0x441c28
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00431a20
sub esp, 8
mov eax, dword [esp + 0x30]
test eax, eax
jg 0x40decb
lea esi, [esi]
call fcn.00431730
call fcn.00431730
call fcn.00431780
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.0042f3d0
sub esp, 8
call fcn.00431780
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00431900
sub esp, 8
jmp 0x40dd22
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00430060
sub esp, 4
lea ebx, [ebx + eax + 2]
mov eax, dword [esp + 0x30]
cmp eax, ebx
jle 0x40de70
call fcn.00431730
call fcn.00431730
mov ebp, dword [esp + 0x2c]
add ebp, ebx
call fcn.00431780
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.00431330
sub esp, 8
call fcn.00431780
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00431900
sub esp, 8
call fcn.00431730
call fcn.00431730
call fcn.00431780
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00430530
sub esp, 8
call fcn.00431b20
call fcn.00431830
mov dword [esp + 4], eax
mov dword [esp], 0x441c28
call fcn.00431b50
test eax, eax
jne 0x40deb0
call fcn.00431730
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00431990
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00431990
sub esp, 4
mov dword [esp], 0x43f830
call fcn.00431990
sub esp, 4
call fcn.00431780
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00431900
sub esp, 8
jmp 0x40deb0