Function at 0x40f544
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x415010]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, dword [ebp + 0x1c0]
mov ecx, dword [ebp + 0x1c4]
push ebx
push esi
mov esi, dword [ebp + 0x1bc]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x59], bl
mov dword [ebp - 0x6c], 1
je 0x40f81a
cmp eax, ebx
je 0x40f81a
cmp ecx, ebx
je 0x40f81a
mov byte [eax], bl
push edi
mov byte [ecx], bl
call fcn.0040f4f6
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x60]
push ecx
push eax
push ebx
push esi
mov esi, SysReAllocString
push esi
mov dword [ebp - 0x74], eax
call edi
test eax, eax
jne 0x40f6a9
cmp dword [ebp - 0x60], ebx
je 0x40f6a9
push 0x206
lea eax, [ebp - 0x56]
push ebx
push eax
mov word [ebp - 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x68], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f694
cmp dword [ebp - 0x6c], 1
jne 0x40f694
mov ecx, 0x4064b4
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f643
cmp dx, bx
je 0x40f63f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f643
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x40f61d
xor eax, eax
jmp 0x40f648
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40f654
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x40f690
mov ecx, 0x4064b8
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f682
cmp dx, bx
je 0x40f67e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f682
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x40f65c
xor eax, eax
jmp 0x40f687
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40f694
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x59], bl
mov dword [ebp - 0x60], ebx
jne 0x40f80d
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
push ebx
push 0x406430
push esi
call edi
test eax, eax
jne 0x40f721
cmp dword [ebp - 0x60], ebx
je 0x40f721
or dword [ebp - 0x68], 0xffffffff
push 4
pop esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x406420
push dword [ebp - 0x60]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f70a
cmp dword [ebp - 0x68], 1
jne 0x40f6fc
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x40f706
cmp dword [ebp - 0x68], ebx
jne 0x40f70a
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x59], bl
mov dword [ebp - 0x60], ebx
jne 0x40f80d
jmp 0x40f724
push 4
pop esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
push ebx
push dword [ebp - 0x70]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x40f80d
cmp dword [ebp - 0x60], ebx
je 0x40f80d
push 0x206
lea eax, [ebp - 0x56]
push ebx
push eax
mov word [ebp - 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x70], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40f804
cmp dword [ebp - 0x6c], 1
jne 0x40f804
mov ecx, 0x4064b4
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f7b5
cmp dx, bx
je 0x40f7b1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f7b5
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x40f791
xor eax, eax
jmp 0x40f7ba
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40f7c6
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x40f800
mov ecx, 0x4064b8
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40f7f2
cmp dx, bx
je 0x40f7ee
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40f7f2
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x40f7ce
xor eax, eax
jmp 0x40f7f7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40f804
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp - 0x59]
mov byte [eax], cl
xor eax, eax
pop edi
jmp 0x40f81f
mov eax, 0x80004005
mov ecx, dword [ebp + 0x1b0]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fdc4
add ebp, 0x1b4
leave
ret 0xc