Function at 0x408960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov eax, dword [0x446054]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [esp + 0x28]
push eax
push 0x20119
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4089c1
push eax
push ecx
mov edx, str._nError_RegOpenKeyEx__
mov ecx, 0x447558
call fcn.0040edb0
add esp, 4
mov ecx, eax
call fcn.0040b440
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00415ea4
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x40]
push eax
push 0
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x64]
push eax
push 0
push 0
push 0
push dword [esp + 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x408a1d
push eax
push ecx
mov edx, str._nError_RegQueryInfoKey__
mov ecx, 0x447558
call fcn.0040edb0
add esp, 4
mov ecx, eax
call fcn.0040b440
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00415ea4
mov esp, ebp
pop ebp
ret
xor esi, esi
xor al, al
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
cmp dword [esp + 0x30], esi
jbe 0x408b8f
push 0x800
call fcn.00416440
add esp, 4
mov dword [esp + 0x10], eax
push 0x3fff
call fcn.00416440
add esp, 4
mov dword [esp + 0x18], eax
push 0x7ffe
call fcn.00416440
add esp, 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x3fff
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x24]
push esi
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x408bfd
mov ecx, dword [esp + 0x10]
mov eax, 0x442044
mov dword [esp + 0x34], ecx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x408acd
test dx, dx
je 0x408ac9
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x408acd
add ecx, 4
add eax, 4
test dx, dx
jne 0x408aa7
xor eax, eax
jmp 0x408ad2
sbb eax, eax
or eax, 1
mov ecx, dword [esp + 0xc]
test eax, eax
mov eax, 1
movzx ecx, cl
cmove ecx, eax
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x14], eax
jne 0x408b52
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x24]
push eax
push 0x101
push 0
push str.SOFTWAREAccelOpsAgent
push 0x80000002
mov dword [esp + 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408b4e
lea eax, [esp + 0x38]
mov dword [esp + 0x3c], 1
push eax
push esi
lea eax, [esp + 0x44]
mov dword [esp + 0x40], 0x8000
push eax
push 0
push dword [esp + 0x44]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 8]
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x408b68
movups xmm0, xmmword [esp + 0x10]
movups xmmword [eax], xmm0
add dword [edi + 4], 0x10
jmp 0x408b75
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.0040f1b0
inc esi
mov dword [esp + 8], esi
cmp esi, dword [esp + 0x30]
jb 0x408a33
cmp byte [esp + 0xc], 0
jne 0x408c36
push 0x800
call fcn.00416440
add esp, 4
mov esi, eax
mov dword [esp + 0x10], esi
push 0x3fff
call fcn.00416440
add esp, 4
mov dword [esp + 0x18], eax
push 0x7ffe
call fcn.00416440
add esp, 4
mov dword [esp + 0x1c], 0x441dbc
lea eax, [esp + 0x34]
mov dword [esp + 0x14], 1
push 9
push str.ConfData5
push 0xa
push esi
push eax
call fcn.0041e8ba
mov eax, dword [edi + 4]
add esp, 0x14
cmp eax, dword [edi + 8]
je 0x408c29
movups xmm0, xmmword [esp + 0x10]
movups xmmword [eax], xmm0
add dword [edi + 4], 0x10
jmp 0x408c36
push eax
push ecx
mov edx, str._nError_RegEnumValue__
mov ecx, 0x447558
call fcn.0040edb0
add esp, 4
mov ecx, eax
call fcn.0040b440
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00415ea4
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.0040f1b0
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00415ea4
mov esp, ebp
pop ebp
ret