Function at 0x40a560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505efd
mov eax, dword fs:[0]
push eax
sub esp, 0xbd4
mov eax, dword [0x564690]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xbc8], eax
or esi, 0xffffffff
cmp dword [0x565ba8], 0
mov dword [ebp - 4], 0
je 0x40a666
cmp dword [0x565bac], 0
je 0x40a666
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xb94]
push 0x565cac
push eax
call fcn.00402920
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.004025b0
mov edx, dword [ebp - 0xb94]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a603
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xb90], eax
mov ecx, dword [0x565bac]
push 0
lea eax, [ebp - 0xb90]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 2
call fcn.0041f910
push dword [ebp - 0xb90]
lea ecx, [ebp + 8]
call fcn.004026b0
mov edx, dword [ebp - 0xb90]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a666
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5641c0]
xor ebx, ebx
cmp byte [0x565bb0], bl
mov ecx, 0x5641c0
sete bl
add ebx, 0x80000001
mov dword [ebp - 0xb8c], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xbac], eax
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], 3
je 0x40a7a6
call fcn.0040c450
mov ebx, dword [0x565ae0]
test al, al
jne 0x40a6be
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0x50
jb 0x40a6b4
or esi, 0xffffffff
cmp byte [0x55f02c], 0
jne 0x40a73c
mov eax, dword [0x565ca4]
cmp dword [eax - 0xc], 0
jne 0x40a6df
mov eax, SysReAllocStringLen
mov dword [ebp - 0xb8c], eax
jmp 0x40a73c
mov eax, SysStringLen
push 0x518d18
mov dword [ebp - 0xb8c], eax
lea eax, [ebp - 0xb94]
push 0x565ca4
push eax
call fcn.004029e0
add esp, 0xc
push eax
lea ecx, [ebp - 0xbac]
mov byte [ebp - 4], 4
call fcn.004025b0
mov edx, dword [ebp - 0xb94]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a736
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [0x565ae0]
mov eax, ebx
imul eax, ebx
and eax, 0x8000000f
jns 0x40a74d
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 7
jne 0x40a7a0
xor edx, edx
mov dword [ebp - 0xb90], edx
lea edi, [ebp - 0x9f0]
xor ecx, ecx
mov eax, ebx
inc ecx
cdq
xor esi, esi
idiv ecx
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xb94], edx
lea ecx, [esi + 1]
mov esi, ecx
cmp esi, 0xf
jl 0x40a776
mov ecx, dword [ebp - 0xb98]
add edi, 0xf
cmp ecx, 0x10
jl 0x40a762
mov edx, dword [ebp - 0xb90]
inc edx
mov dword [ebp - 0xb90], edx
cmp edx, 2
jl 0x40a760
mov ebx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbbc], 0
mov dword [ebp - 0xbb8], 0
mov dword [ebp - 0xbb4], 0
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
mov byte [ebp - 4], 5
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xb8c], eax
mov eax, str.Software_
mov byte [ebp - 4], 6
test eax, 0xffff0000
jne 0x40a80f
movzx esi, ax
push 0
push esi
call fcn.00402e50
add esp, 8
test eax, eax
je 0x40a81f
push esi
push eax
lea ecx, [ebp - 0xb8c]
call fcn.00407600
jmp 0x40a81f
push str.Software_
lea ecx, [ebp - 0xb8c]
call fcn.004026b0
lea eax, [ebp - 0xb8c]
push eax
lea eax, [ebp - 0xbac]
push eax
lea eax, [ebp - 0xba0]
push eax
mov byte [ebp - 4], 7
call fcn.00402920
push 0x565ca8
push eax
lea eax, [ebp - 0xb90]
push eax
mov byte [ebp - 4], 8
call fcn.00402920
push 0x518d18
push eax
lea eax, [ebp - 0xb98]
push eax
mov byte [ebp - 4], 9
call fcn.004029e0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0xb94]
push eax
mov byte [ebp - 4], 0xa
call fcn.00402920
add esp, 0x30
lea ecx, [ebp - 0xbbc]
push 1
push dword [eax]
push ebx
call fcn.0040b750
mov edx, dword [ebp - 0xb94]
test eax, eax
setne bl
add edx, 0xfffffff0
or edi, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a8b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb98]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a8db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb90]
add edx, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a8fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xba0]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a921
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb8c]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a944
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x40a955
mov eax, dword [ebp - 0xbbc]
xor bl, bl
jmp 0x40ae07
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
mov dword [ebp - 0xbb0], 0x400
call fcn.004e6690
add esp, 0xc
xor esi, esi
mov dword [ebp - 0xb90], esi
call fcn.0040c5b0
test al, al
jne 0x40a9ab
mov ebx, dword [0x565ae0]
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0xde
jb 0x40a998
mov esi, dword [ebp - 0xb90]
or edi, 0xffffffff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xbb0]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
push dword [ebp - 0xbbc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
inc esi
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb90], esi
test ebx, ebx
je 0x40a9ed
cmp ebx, 0x103
jne 0x40adea
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xb8c], esi
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 0xb
test eax, 0xffff0000
jne 0x40aa35
movzx edi, ax
push 0
push edi
call fcn.00402e50
add esp, 8
test eax, eax
je 0x40aa68
push edi
push eax
lea ecx, [ebp - 0xb8c]
call fcn.00407600
jmp 0x40aa62
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aa40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xb8c]
call fcn.00409890
mov esi, dword [ebp - 0xb8c]
cmp dword [esi - 0xc], 0
mov byte [ebp - 4], 0xc
je 0x40ad74
mov ecx, dword [0x565ae0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ebx, 0xc
idiv ebx
cmp edx, 2
jne 0x40ab8f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xbc4], eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xbc0], eax
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0xbd0], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xbd8], eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xbe0], eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xbd4], eax
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [ebp - 0xbcc], eax
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xbdc], eax
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
xor ebx, ebx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xba8], eax
lea edi, [ebp - 0x9b3]
jmp 0x40ab60
mov esi, 1
mov ebx, 0xe
lea ebx, [ebx]
add edi, 0xa
inc esi
dec ebx
jne 0x40ab70
mov ebx, dword [ebp - 0xb98]
inc ebx
mov dword [ebp - 0xb98], ebx
cmp ebx, 3
jl 0x40ab60
mov esi, dword [ebp - 0xb8c]
cmp dword [0x565ba8], 0
je 0x40ace6
cmp dword [0x565bac], 0
je 0x40ace6
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xba0], eax
mov eax, dword [0x5641c0]
mov ecx, 0x5641c0
mov byte [ebp - 4], 0xd
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xba4], eax
mov byte [ebp - 4], 0xe
test esi, 0xffff0000
jne 0x40ac06
movzx edi, si
push 0
push edi
call fcn.00402e50
add esp, 8
test eax, eax
je 0x40ac12
push edi
push eax
lea ecx, [ebp - 0xba4]
call fcn.00407540
jmp 0x40ac12
push esi
lea ecx, [ebp - 0xba4]
call fcn.00402620
mov ecx, dword [0x565ba8]
lea eax, [ebp - 0xba0]
push eax
lea eax, [ebp - 0xba4]
push eax
mov byte [ebp - 4], 0xf
call fcn.0041ed70
push 0x51661c
push dword [0x565cac]
lea ecx, [ebp - 0xba0]
call fcn.004078e0
mov eax, dword [ebp - 0xba0]
add esi, 0xfffffff0
lea edx, [eax - 0x10]
cmp edx, esi
je 0x40ac9d
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x40ac8e
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x40ac8e
push edx
call fcn.00405870
add esp, 4
mov ebx, eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x40ac83
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [ebx + 0x10]
mov dword [ebp - 0xb8c], eax
jmp 0x40ac9d
push dword [eax - 0xc]
lea ecx, [ebp - 0xb8c]
push eax
call fcn.00409890
mov edx, dword [ebp - 0xba4]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40acc3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xba0]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ace6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xbc8]
lea eax, [ebp - 0xb8c]
push eax
call fcn.0040c5e0
call fcn.0040c560
test al, al
jne 0x40ad68
mov edi, dword [0x565ae0]
mov eax, edi
cdq
sub eax, edx
xor ecx, ecx
mov ebx, eax
sar ebx, 1
mov esi, 0xc1
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], ebx
test ebx, ebx
jle 0x40ad5d
mov eax, edi
cdq
and edx, 3
lea edi, [edx + eax]
sar edi, 2
xor edx, edx
test edi, edi
jle 0x40ad4c
mov eax, edx
mov ecx, edi
lea ecx, [ecx]
add esi, eax
dec eax
dec ecx
jne 0x40ad40
mov ecx, dword [ebp - 0xb98]
add edx, ecx
dec ebx
jne 0x40ad35
mov ebx, dword [ebp - 0xba8]
mov edi, dword [0x565ae0]
inc ecx
mov dword [ebp - 0xb98], ecx
cmp ecx, esi
jl 0x40ad23
mov ebx, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb8c]
mov dword [ebp - 0xbb0], 0x400
call fcn.0040c590
test al, al
jne 0x40ada9
mov eax, 0x8e
mov edi, 0x39
test edi, edi
je 0x40ada2
cdq
idiv edi
mov ecx, edi
mov eax, ecx
mov edi, edx
test ecx, ecx
jne 0x40ad91
add eax, edi
mov dword [0x565ae0], eax
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.004e6690
add esp, 0xc
call fcn.0040c4d0
add esi, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 5
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ade4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xb90]
test ebx, ebx
je 0x40a985
mov eax, dword [ebp - 0xbbc]
test eax, eax
je 0x40ae05
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov bl, 1
test eax, eax
je 0x40ae12
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xbac]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ae35
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x40ae56
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e50b4
mov esp, ebp
pop ebp
ret