Function at 0x40b270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506310
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x565680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
or esi, 0xffffffff
cmp dword [0x566ba0], 0
mov dword [ebp - 4], 1
je 0x40b3ee
cmp dword [0x566ba4], 0
je 0x40b3ee
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push 0x566cec
push eax
call fcn.00402a20
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004026b0
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b2fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [0x566ba4]
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.0041f8f0
push dword [ebp - 0x18]
lea ecx, [ebp + 8]
call fcn.004027b0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
push 0x566cec
push eax
call fcn.00402a20
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.004026b0
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b377
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [0x566ba4]
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 5
call fcn.0041f8f0
push dword [ebp - 0x14]
lea ecx, [ebp + 0xc]
call fcn.004027b0
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b3ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b3ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
xor ebx, ebx
cmp byte [0x566b9c], bl
mov ecx, 0x5651b8
sete bl
add ebx, 0x80000001
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], 6
je 0x40b47f
cmp byte [0x56002c], 0
jne 0x40b47f
mov eax, dword [0x566ce4]
cmp dword [eax - 0xc], 0
jne 0x40b437
mov ebx, SysReAllocStringLen
jmp 0x40b47f
push 0x519f08
lea eax, [ebp - 0x20]
push 0x566ce4
push eax
mov ebx, SysStringLen
call fcn.00402ae0
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004026b0
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b47f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov byte [ebp - 4], 8
call fcn.0040c990
test al, al
jne 0x40b500
movd xmm4, dword [0x566ac0]
movsd xmm3, qword [0x519ef8]
movsd xmm6, qword [0x519f00]
movsd xmm5, qword [0x519ef0]
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
jmp 0x40b4d0
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x40b4ea
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x40b4d0
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, str.Software_
mov byte [ebp - 4], 9
test eax, 0xffff0000
jne 0x40b541
movzx edi, ax
push 0
push edi
call fcn.00402f50
add esp, 8
test eax, eax
je 0x40b54e
push edi
push eax
lea ecx, [ebp - 0x14]
call fcn.004073a0
jmp 0x40b54e
push str.Software_
lea ecx, [ebp - 0x14]
call fcn.004027b0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0xa
call fcn.00402a20
push 0x566ce8
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xb
call fcn.00402a20
push 0x519f08
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xc
call fcn.00402ae0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xd
call fcn.00402a20
add esp, 0x30
lea ecx, [ebp - 0x38]
push 0x20019
push dword [eax]
push ebx
call fcn.0040bb90
mov edx, dword [ebp - 0x20]
test eax, eax
setne bl
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b5cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b5ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xb
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b60f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xa
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b62f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b64f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x38]
test bl, bl
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x40b6cf
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
push edi
mov dword [ebp - 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b6a3
cmp dword [ebp - 0x28], 4
jne 0x40b6a3
test edi, edi
je 0x40b695
push edi
call ebx
xor edi, edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
mov byte [ebp - 0xd], 1
jmp 0x40b6d3
mov ecx, dword [0x566ac0]
mov eax, ecx
imul eax, ecx
and eax, 0x80000003
jns 0x40b6ba
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 2
jne 0x40b6c6
inc ecx
mov dword [0x566ac0], ecx
test edi, edi
je 0x40b6cf
push edi
call ebx
xor edi, edi
mov byte [ebp - 0xd], 0
test edi, edi
je 0x40b6da
push edi
call ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b6fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b71a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 0xc]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x40b73b
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret