Function at 0x40ef00
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4300eb
mov eax, dword fs:[0]
push eax
mov eax, 0x8378
call fcn.00429680
mov eax, dword [0x43c4c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x82c0], esi
mov edi, ecx
mov dword [ebp - 0x82c4], eax
mov dword [ebp - 0x82c8], esi
mov dword [ebp - 0x82cc], 0x100
mov dword [ebp - 0x837c], 0x435554
mov dword [ebp - 0x836c], 0x435678
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea ecx, [ebp - 0x8364]
push ecx
lea edx, [ebp - 0x837c]
mov dword [ebp - 4], esi
mov ebx, 1
push edx
mov dword [ebp - 0x82c0], ebx
call fcn.0040c670
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x837c]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea ecx, [ebp - 0x8364]
call fcn.00408750
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x8328], esi
mov dword [ebp - 0x8324], esi
mov dword [ebp - 4], 3
mov dword [ebp - 0x8274], esi
xor edx, edx
push 0xa
mov eax, str.HKEY_USERS
lea esi, [ebp - 0x8284]
mov dword [ebp - 0x8270], 7
mov word [ebp - 0x8284], dx
call fcn.00406cf0
mov ebx, esi
mov byte [ebp - 4], 4
call fcn.0040ee40
mov byte [ebp - 4], 3
cmp dword [ebp - 0x8270], 8
mov dword [ebp - 0x82c0], eax
jb 0x40f02b
mov eax, dword [ebp - 0x8284]
push eax
call fcn.00418932
add esp, 4
xor ebx, ebx
xor ecx, ecx
push ebx
mov esi, 7
mov word [ebp - 0x8284], cx
xor edx, edx
push edi
or eax, 0xffffffff
lea ecx, [ebp - 0x8230]
mov dword [ebp - 0x8270], esi
mov dword [ebp - 0x8274], ebx
mov dword [ebp - 0x821c], esi
mov dword [ebp - 0x8220], ebx
mov word [ebp - 0x8230], dx
call fcn.00406970
mov byte [ebp - 4], 5
xor eax, eax
mov dword [ebp - 0x828c], esi
mov word [ebp - 0x82a0], ax
push 0x15
mov eax, str.Volatile_Environment
lea esi, [ebp - 0x82a0]
mov dword [ebp - 0x8290], ebx
call fcn.00406cf0
mov byte [ebp - 4], 6
xor ecx, ecx
push 8
mov eax, str.HOMEPATH
lea esi, [ebp - 0x8268]
mov dword [ebp - 0x8254], 7
mov dword [ebp - 0x8258], ebx
mov word [ebp - 0x8268], cx
call fcn.00406cf0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x8220]
push 0x4354dc
xor edi, edi
lea ecx, [ebp - 0x8230]
call fcn.00409300
test eax, eax
jne 0x40f120
mov edx, dword [ebp - 0x82c4]
push ebx
push edx
or eax, 0xffffffff
lea ecx, [ebp - 0x8230]
call fcn.00406970
push 0x41
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea esi, [ebp - 0x82a0]
call fcn.00406cf0
push 8
mov eax, str.Personal
lea esi, [ebp - 0x8268]
call fcn.00406cf0
mov edx, dword [ebp - 0x82c0]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x82cc]
push eax
lea ecx, [ebp - 0x214]
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x40f363
jmp 0x40f150
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x82bc]
mov dword [ebp - 0x82c4], ebx
push ecx
lea ebx, [ebp - 0x82a0]
call fcn.00408eb0
add esp, 8
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x82bc]
mov edi, 8
cmp dword [ebp - 0x82a8], edi
jae 0x40f18f
lea eax, [ebp - 0x82bc]
lea edx, [ebp - 0x82c4]
push edx
push 0x20019
push 0
push eax
mov eax, dword [ebp - 0x82c0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f2eb
mov eax, dword [ebp - 0x8268]
mov dword [ebp - 0x82d0], 0x8000
cmp dword [ebp - 0x8254], edi
jae 0x40f1d1
lea eax, [ebp - 0x8268]
lea ecx, [ebp - 0x82d0]
push ecx
lea edx, [ebp - 0x8214]
push edx
mov edx, dword [ebp - 0x82c4]
lea ecx, [ebp - 0x82d4]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f2de
mov dword [ebp - 0x823c], eax
mov word [ebp - 0x824c], ax
lea eax, [ebp - 0x8214]
mov dword [ebp - 0x8238], 7
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f220
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x8214]
lea esi, [ebp - 0x824c]
call fcn.00406cf0
mov eax, dword [ebp - 0x8230]
cmp dword [ebp - 0x821c], edi
jae 0x40f255
lea eax, [ebp - 0x8230]
mov esi, dword [ebp - 0x823c]
mov ebx, dword [ebp - 0x8220]
mov edx, esi
cmp esi, ebx
jb 0x40f269
mov edx, ebx
mov ecx, dword [ebp - 0x824c]
cmp dword [ebp - 0x8238], edi
jae 0x40f27d
lea ecx, [ebp - 0x824c]
test edx, edx
je 0x40f297
mov di, word [ecx]
cmp di, word [eax]
jne 0x40f2a0
add ecx, 2
add eax, 2
dec edx
jne 0x40f281
mov edi, 8
cmp esi, ebx
jae 0x40f2af
or eax, 0xffffffff
jmp 0x40f2b6
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x40f292
mov edi, 8
jmp 0x40f2b6
xor eax, eax
cmp esi, ebx
setne al
test eax, eax
sete bl
mov byte [ebp - 4], 8
cmp dword [ebp - 0x8238], edi
jb 0x40f2d6
mov edx, dword [ebp - 0x824c]
push edx
call fcn.00418932
add esp, 4
test bl, bl
jne 0x40f421
mov eax, dword [ebp - 0x82c4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x82c8]
mov byte [ebp - 4], 7
mov dword [ebp - 0x82cc], 0x100
cmp dword [ebp - 0x82a8], edi
jb 0x40f316
mov ecx, dword [ebp - 0x82bc]
push ecx
call fcn.00418932
add esp, 4
xor edx, edx
push edx
push edx
push edx
push edx
lea eax, [ebp - 0x82cc]
push eax
mov eax, dword [ebp - 0x82c0]
lea ecx, [ebp - 0x214]
mov word [ebp - 0x82bc], dx
mov edx, dword [ebp - 0x82c8]
push ecx
push edx
push eax
mov dword [ebp - 0x82a8], 7
mov dword [ebp - 0x82ac], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor ebx, ebx
test eax, eax
je 0x40f150
mov edi, 8
cmp dword [ebp - 0x8254], edi
jb 0x40f37f
mov eax, dword [ebp - 0x8268]
push eax
call fcn.00418932
add esp, 4
xor ecx, ecx
mov esi, 7
mov dword [ebp - 0x8254], esi
mov dword [ebp - 0x8258], ebx
mov word [ebp - 0x8268], cx
cmp dword [ebp - 0x828c], edi
jb 0x40f3b0
mov edx, dword [ebp - 0x82a0]
push edx
call fcn.00418932
add esp, 4
xor eax, eax
mov dword [ebp - 0x828c], esi
mov dword [ebp - 0x8290], ebx
mov word [ebp - 0x82a0], ax
cmp dword [ebp - 0x821c], edi
jb 0x40f3dc
mov ecx, dword [ebp - 0x8230]
push ecx
call fcn.00418932
add esp, 4
xor edx, edx
lea ecx, [ebp - 0x837c]
mov dword [ebp - 0x821c], esi
mov dword [ebp - 0x8220], ebx
mov word [ebp - 0x8230], dx
mov dword [ebp - 4], 0xffffffff
call fcn.0040b350
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041893d
mov esp, ebp
pop ebp
ret
xor ecx, ecx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x8238], 7
mov dword [ebp - 0x823c], 0
mov word [ebp - 0x824c], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40f447
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
lea esi, [ebp - 0x824c]
call fcn.00406cf0
mov edx, esi
push edx
mov eax, 0x4358f0
lea ecx, [ebp - 0x8284]
mov byte [ebp - 4], 0xa
call fcn.0040dc70
add esp, 4
mov edi, eax
mov esi, 0x43d85c
mov byte [ebp - 4], 0xb
call fcn.00402a70
mov esi, 8
cmp dword [ebp - 0x8270], esi
jb 0x40f4ae
mov eax, dword [ebp - 0x8284]
push eax
call fcn.00418932
add esp, 4
xor ebx, ebx
xor ecx, ecx
mov edi, 7
mov dword [ebp - 0x8270], edi
mov dword [ebp - 0x8274], ebx
mov word [ebp - 0x8284], cx
cmp dword [ebp - 0x8238], esi
jb 0x40f4e1
mov edx, dword [ebp - 0x824c]
push edx
call fcn.00418932
add esp, 4
xor eax, eax
mov dword [ebp - 0x8238], edi
mov dword [ebp - 0x823c], ebx
mov word [ebp - 0x824c], ax
cmp dword [ebp - 0x82a8], esi
jb 0x40f50d
mov ecx, dword [ebp - 0x82bc]
push ecx
call fcn.00418932
add esp, 4
xor edx, edx
mov dword [ebp - 0x82a8], edi
mov dword [ebp - 0x82ac], ebx
mov word [ebp - 0x82bc], dx
cmp dword [ebp - 0x8254], esi
jb 0x40f539
mov eax, dword [ebp - 0x8268]
push eax
call fcn.00418932
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x8254], edi
mov dword [ebp - 0x8258], ebx
mov word [ebp - 0x8268], cx
cmp dword [ebp - 0x828c], esi
jb 0x40f565
mov edx, dword [ebp - 0x82a0]
push edx
call fcn.00418932
add esp, 4
xor eax, eax
mov dword [ebp - 0x828c], edi
mov dword [ebp - 0x8290], ebx
mov word [ebp - 0x82a0], ax
cmp dword [ebp - 0x821c], esi
jb 0x40f591
mov ecx, dword [ebp - 0x8230]
push ecx
call fcn.00418932
add esp, 4
xor edx, edx
lea ecx, [ebp - 0x837c]
mov dword [ebp - 0x821c], edi
mov dword [ebp - 0x8220], ebx
mov word [ebp - 0x8230], dx
mov dword [ebp - 4], 0xffffffff
call fcn.0040b350
mov al, 1
jmp 0x40f405