Function at 0x4096a0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
je 0x40971e
cmp dword [ebp + 0xc], 0
je 0x40971e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40971e
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x40971e
mov dword [ecx], 0xffffffff
mov edi, dword [eax]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x404708
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x409774
cmp ecx, 2
jne 0x40974a
mov eax, dword [0x4116fc]
mov esi, dword [eax]
mov esi, dword [esi + 4]
mov ecx, esi
test edi, edi
jne 0x409729
push 0x404708
push 0x1e
push edi
push eax
call dword [0x412204]
call esi
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0x404708
push 0x27
push 0
push eax
call dword [0x412204]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [0x4116fc]
push 0x404708
push 0x14
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x412204]
mov ecx, edi
call esi
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x200
call fcn.0040acec
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x409ac6
xor eax, eax
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0x20], eax
xor edi, edi
lea eax, [ebp - 0x30]
mov dword [ebp - 8], edi
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
mov dword [ebp - 0x1c], 1
cmp ecx, 0x103
je 0x409aaa
lea ebx, [ebx]
test ecx, ecx
jne 0x409aa1
xor eax, eax
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], eax
call fcn.0040a390
test al, al
jne 0x4099ab
push ebx
mov dword [ebp - 0x18], 0
call fcn.0040a390
test al, al
jne 0x4099ab
push 0x2e
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
push 0
push ebx
mov edi, eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4099a8
test edi, edi
je 0x409848
lea eax, [ebp - 0x24]
push eax
push edi
push ebx
call fcn.0040f739
mov bl, al
test bl, bl
je 0x4099a5
mov eax, dword [ebp - 0x24]
lea ecx, [edi + 2]
jmp 0x4098cb
mov ax, word [esi]
mov ecx, ebx
sub ax, 0x30
mov bl, 1
cmp ax, 9
ja 0x409863
mov eax, dword [ebp - 0xc]
xor bl, bl
mov ecx, dword [ebp - 0x18]
jmp 0x4098cb
mov eax, dword [ebp - 4]
xor edx, edx
cmp dx, word [eax]
je 0x4098bc
cmp eax, esi
jae 0x4098bc
cmp word [ecx], 0x30
jne 0x40987e
add ecx, 2
cmp ecx, esi
jb 0x409871
mov eax, esi
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x14
jle 0x409893
mov eax, dword [ebp - 0xc]
xor bl, bl
mov ecx, edx
jmp 0x4098cb
push 0xa
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edx
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
cmp esi, dword [ebp - 0x28]
jne 0x4098b2
cmp eax, 0x7fffffff
jbe 0x4098c1
mov eax, dword [ebp - 0xc]
xor bl, bl
mov ecx, dword [ebp - 0x18]
jmp 0x4098cb
mov eax, dword [ebp - 0xc]
xor bl, bl
test bl, bl
je 0x4099a5
xor ecx, ecx
mov edi, dword [ebp - 8]
test bl, bl
je 0x4099a0
test ecx, ecx
jne 0x4099a0
cmp eax, edi
jle 0x4099a0
mov esi, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 0x20]
inc esi
mov dword [ebp - 8], edi
test eax, eax
je 0x409900
push eax
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
add esp, 4
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040acec
add esp, 4
mov dword [ebp - 0x20], eax
test eax, eax
je 0x409ac6
xor ecx, ecx
test esi, esi
je 0x409934
cmp esi, 0x7fffffff
jbe 0x409939
mov ecx, 0x80070057
test ecx, ecx
js 0x40998f
mov ecx, esi
mov edx, eax
test esi, esi
je 0x409972
mov edi, SysReAllocString
sub edi, esi
mov esi, dword [ebp - 4]
sub esi, eax
lea eax, [edi + ecx]
test eax, eax
je 0x40996e
movzx eax, word [esi + edx]
test ax, ax
je 0x40996e
mov word [edx], ax
add edx, 2
sub ecx, 1
jne 0x409951
jmp 0x409972
test ecx, ecx
jne 0x409975
sub edx, 2
mov edi, dword [ebp - 8]
xor eax, eax
neg ecx
mov word [edx], ax
sbb ecx, ecx
and ecx, 0x7ff8ff86
add ecx, 0x8007007a
jmp 0x409998
test esi, esi
je 0x409998
xor edx, edx
mov word [eax], dx
test ecx, ecx
js 0x409ac6
mov ebx, dword [ebp - 4]
jmp 0x4099ab
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], pe_nt_image_headers32
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x1c]
mov ecx, eax
cmp ecx, 0x103
jne 0x4097d0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x409aaa
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [esi], eax
lea eax, [ebp - 0x28]
push 0x17
push eax
push ebx
push 0x404798
push 0x4116f8
mov dword [ecx], edi
call fcn.0040a3b0
add esp, 0x18
test al, al
je 0x409ac6
push dword [ebp + 8]
mov edi, dword [ebx]
mov bl, 1
mov esi, dword [esi]
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x409ac8
cmp ecx, 2
jne 0x409a82
mov eax, dword [0x4116fc]
test esi, esi
mov esi, dword [eax]
mov esi, dword [esi + 4]
mov ecx, esi
jne 0x409a6c
push edi
push 0x1e
push 0
push eax
call dword [0x412204]
call esi
add esp, 0x10
jmp 0x409ac6
push dword [ebp - 0x28]
push edi
push 0x27
push 0
push eax
call dword [0x412204]
call esi
add esp, 0x14
jmp 0x409ac6
push dword [ebp - 0x20]
push 0x14
mov edi, dword [0x4116fc]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x412204]
mov ecx, edi
call esi
jmp 0x409ac6
push 0x404708
push 0x13
jmp 0x409a87
mov eax, dword [0x4116fc]
push 0x1d
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x412204]
call esi
add esp, 0xc
xor bl, bl
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x409ad6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x409ae7
push eax
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10