Function at 0x40aad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b838
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x487870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x48], str.6D0qIU5HW0U05Doo8oVNgPVTDOIKTgAuETckSWrYHQnKin6THztEXOamHCos2LdiCtv7agPnAHJEHtguhfU4zf4FVJxVWFiNfYMsSPXD5kNaAyIzWgq9CbVRnY3RRq3wW2YriniBl3YFCtAf2wcrCuW9QEjNrM4Cqf6xDoaiiEgqWjlf0SzQ0N7NPzmbPKbSugeB58IPwwaybuNUAgVFcvekw7NmAADKdKzTKCWwjsP8nE4hGzICwJWjO6NzKOYjRom4KDFLER022HBYpKvMkrJvjU6VNg4gTRV75Iw9hCU7
push 1
lea ecx, [ebp - 0x18]
call fcn.00409680
lea ecx, [ebp - 0x18]
call fcn.0040b860
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], str.m5QisuLPFmFFOPSEiQ0hSdDmj67omWdrieHhPb03KUlT5wscuwhh7kwV7wVQzSDbEqTp2hdw7Nu6olNIcHW3o0L53v4S4Uty4Px5ot7LK1F2W04OGIU4AqLPvXE7f5joWpRoN0lM0W8FUmL13Ifx5pSDcdtmzw9tvXiaDGp1ojHbvkPN5DamLkip4PXCwqktG7jRNXIlM6TUWTACmi0b466xiMb9y4C7ckCKJMy7hGQtt7JRfjfgTgjNokQkbNaXwT0HnI78cJmBm8nSR7wDIVLw54jNT4wDUVplaVtCchOiPaXY41C2uKhooTyqfmBDnnW046zjaDiJdxopw6qQG1uBA6EfdJ5ikI2mGN1fFC5GethxgTtKjyfRNIVXnISeowEtu3CvCWdWfYOYva4cssRsHsGsbvKkHcaED2ftY1opf0AQprSNGPS0BI266hRmjW23holiWGliXYd6cBImamWEyKGvAgLY3QPw4hhA09m78sFFPmsizfA2Ua5x8MqRwKjDbvhrQTpvt1oq2fcN6ig9hTdcfdbB6mmDjptnuO5nLm9ciC6IqUgwxcLHs4LKUdYwFUSlc4CNMf8JTGvDM6P6QF3vhPjNQEmW0wqMt9U3kuTORsUOUl5iAd1egckdzSKhwlTB8RuCc2q50MWe4MYXr4gJ0PJowSCB01Y7dpvddS3bPlmyY9rqmO123xNIRwzGINi73gKGe5wIIE2cYHerxman1bgvAth2sugQddGa5M0eK12dOj2drVcdvG91peDOxwh0zqoWEfXcLCwoQonrO4hda5WtO6DVKPBJfnAwPKm5osQeRYIfFFdcCsx34fqXr0mECPEBwHti2ksUeFrbgVrgx0aSaEict9BMkWA6Cy2cPSXmNCIj7q1CBWr4U8EEcYfFja276Q54HB6aWAI62YGMuEqBRj51wO7gIhhYRd8blMLBySqu6OMoUvwvlFgHOuUW2ogcUl2LdyYI3rJRBskjB0zIpv4O0rfDWVxud03YuSTckIt5ECKm9ghHMyDly72kw2IbptUyMDGsS4WcKI3iRpIho9q5cHbiKxtOOL4hxJks7zUJCEAVaSApIiV4gfoK3iecfrHj4zeKbYhShrSyNc0taU7Vipca3tfGVAEx8WSORd2jwUw70uVmpgzxRRuUd6YoCRAjO3tm1guEUNijxthnoSwTzpApH015Bw5pqlNhsbqwMy4vGpPhjIRh1UbWuQ5eEnD4yEiD39XsdwUNgbghDW57LjkNj9216OBY373KFnCV4S0Yyd747al4uCvbDeRlJPej2dN9cckpXCEwpvPKKesXOVzgJeJOUYEFTIUuwXnijxkDaFLUNnPTqqNcD8UHunW5iIYHjXxV7LXTimYbVa14MLGp6LmqzByQov4i89SLThcVeOkcdU2Tb9Sd2LnvxB5hCd1Lsd36AW1tC0KDg4lLAgjzMYnXVDhXx9wxHV7jlCSGFUzO5m42WJj9XrWBhgrgg1ykRgbOK31ALfzCx0viQlhDCaq7hMp7TYmdBjpaMWo0pn6ymBkww6AS96WYKct2mFqxctVVM2NyeoWDdjo3OdDKm8owDbu7vbx3BiTNxSKK16vxCEQtg5Qes7qR58P152JMoxuxa7vTGYDq2E7KYkEk2St1ian1Fci6M9UWcga9k
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
lea edx, [ebp + 0x10]
push edx
call fcn.0040b880
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x40abad
push 0x4410c4
mov ecx, dword [ebp + 8]
call fcn.0040b8a0
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b840
mov eax, dword [ebp + 8]
jmp 0x40ad51
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x4c], str.MMJ127CM3nAcwQRymYIxsW5fqHc9Ozpn2S1qLjDF5OL76tch4lyliols9bRk8sipMdw4QSxDXoJwSu5oVCd9b5RAymfy0Ma0952Do99H1vP390lToHrJngm41WraApuimrPukPxacJriv4zDXbxu5EMAyVyDu3ujK0Jvz86F3TS0YD8hkjljjrodPqJsFtaQP83bPHpbc4z3ioCERDjArjA0MEWq04qJF0woo9o1mb0NBp3e7ob223krq2tcCenKVOpJfaiGPqVgtOCSwKEiDgGwtHLbanF6EyRXhjA4XQvvYq5FdVFrlOUJjUVi9kpBNmzKMiC9EqjPxDlEtx7f5HV5SOxJmzT8pN8wPVqrpVoNRuAVBzPjA7m7JqCXYfCtzM6uncJ0h9ef4H8BwdDcw6VOiAOQsllaIyNpWorVVoh0zMpp525DjGgpfFd6tzJdUdQiiV4F5pwRVxROM1i6aGeFkxWavbyoYWoI4bPIhaXIQNEJTfSAAAw25FLJhJ5Yz5bo7btxd4dF7vLe2IgXgxmtTYHOb1AiMMIOpIfbw2c7cLhodoAVYrvC6R3If0oL4ilm4gRgGr5NbVfsPaNYGPdBRPN5Y5fg0wK4OmBmeqVydLCIQp36fW4AAlEXmTiJhwASzD79pdtcN3IfnbPGFN6PItfYreKlV0XovlCRkqSrRTpFxUBUjweeX86rwSuTT5rFOV97yi22Ugg8SMX1nqTnghUYPpelPp8Fb541Q1Q5rPFSFp39u7SxITqGzavN7aHeIL3qcOo6Q4PmQYBlJoiAEYq1SeHtdYSecMxqqtfkQnlwajLwa6DT7NNHrB4YjcKN3bvUoOCW1awTTnQitKpbxMWOncGXF4AO86l9KNggmhuKOGv0LIziawHFS1iTTwtv82UgLOxYKQjmNrg9S8k3jtBVHD3sDzR7zkfbhRIeioIeJY2btY1VND7JPWJuwlCPG6ruBtVDnF55wF8vU558XCzEy8N3eY1KvmNtxA28ELRR8qbxdoCIFbTFqsOH2OyM7LIbOwk86oxfrFYJ7dTPontcXR4KPxgE6sTYBvxHpDROlgiunqxea90Iyr9frimRlJRoYoGm4kT8AeeUi3nuMF7MHc8DYcmhXzbCS9w88b63di95iscWNcarw5rDW1YL8ilC3RrAhOqECLA8QrJIEcafHS2e9a6d7AQa3OCMHKhlQULctOjPuHidtc8gaFcheUg285xOPd4P8TespJyjyBve9XrtVHcOJd4kJHKY777tuJbSqOcObBDAmy9h4B5CRXcBDGtv1P1h3lVqlulrKXKYpFMSyO1WH445Pyk6Ojjmde373C84t3BB7YpNLso2qOWLe1HVsm26MAfXwrBimnF9VYtNmhMbkTaqtTELmHB8Neq0OAKyaHz2xaN490PO40aPe8M3lqQXSXwk4b3jeIAh41pwA6mrPgWhuQbfkX2yN3r1aEWRmNo72EqHNCI3uTUVOg2G3oFiue8AzaFYfK2hVMkhSmQG8z6a42yDx9IcWVokBLrbpziXM117fMSoPgqaTXANlwxyx9dyHVtJdoDXfQQqBYbfPpPPR0HsEGYWRxKzlwRJPrgvvFDCvREbLQ6ezWk552T0a1C2iKR98mhVfP4HWAG7LiBHIoovgMm3Y2xl0FItWDy9R3x0joKWIw2vCp1UmPMNjwEfWdPT7Pel8EIEb9plxWLDK6W04ugqjcMJv1M7nC3fVYAgMSf7wV2WFeuXWz6nMWLTnFSBEnh94LjH2PQ6mMM76ioEuiRvcRrRIHeIYbJSagocosQf8NICPtN4eQpFhSgis3bbFTKay73W4n22U0ISsTgsOwD2KfKinPJXt1afvLn4fpRXAiK1eQGP04ybeR29m0QhEY9XKVpRnBSxBnj9f2CctfJvzvCUBGkyipDoj6zH3lNBcUIp2rS86NTOBETOWDy6RaSaqLjkNK8bl7UPxlFQWwLi8A39X4w9kouBvvcOaIgqIIqkdhthkcdu
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.004034f0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.0040ba10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.004034f0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040ba60
cmp dword [ebp - 0x38], 0
je 0x40ac73
push 0x4417d4
mov ecx, dword [ebp + 8]
call fcn.0040b8a0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b840
mov eax, dword [ebp + 8]
jmp 0x40ad51
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b880
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b840
mov eax, dword [ebp + 8]
jmp 0x40ad51
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004136d5
mov esp, ebp
pop ebp
ret 0x10