Function at 0x40daa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x1088
call fcn.004487b0
mov eax, dword [ebp + 8]
mov edx, 0x7fff
mov ecx, eax
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x1080], edx
mov dword [esp + 0x107c], esi
mov dword [esp + 0x1078], edi
mov edx, dword [esp + 0x107c]
mov esi, dword [esp + 0x1078]
mov edi, esp
lea ebx, [esp + 0x1074]
call fcn.0040de10
call fcn.0040de20
mov dword [edi], esi
mov dword [edi + 0xc], 0x20019
mov dword [edi + 8], 0
mov edx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
call edx
sub esp, 0x14
mov dword [esp + 0x1070], eax
mov byte [esp + 0x106f], 0
mov ecx, dword [esp + 0x38]
call fcn.004d2100
cmp dword [esp + 0x1070], 0
mov dword [esp + 0x30], eax
jne 0x40dc86
lea eax, [esp + 0x6e]
mov dword [esp + 0x68], 0x1000
mov ecx, dword [esp + 0x1080]
mov edx, dword [esp + 0x1074]
mov esi, esp
lea edi, [esp + 0x68]
mov dword [esi + 0x14], edi
call fcn.0040de30
lea eax, [esp + 0x64]
mov dword [esi + 0xc], eax
mov dword [esi + 4], ecx
mov dword [esi], edx
mov dword [esi + 8], 0
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1070], eax
mov ecx, dword [esp + 0x68]
mov byte [esp + ecx + 0x6e], 0
cmp dword [esp + 0x1070], 0
jne 0x40dc60
mov eax, dword [esp + 0x64]
mov dword [esp + 0x28], eax
mov eax, 0
mov ecx, dword [esp + 0x28]
sub ecx, 0x9c26fac5
add ecx, 0xa21a0268
sub ecx, 0x63d9053b
mov edx, eax
sub edx, ecx
mov ecx, eax
add ecx, 1
add edx, ecx
sub eax, edx
add eax, 0xa7b7ca0e
add eax, 0x5de5fd98
sub eax, 0xa7b7ca0e
cmp eax, 2
ja 0x40dc56
lea eax, [esp + 0x6e]
mov ecx, dword [esp + 0x68]
mov edx, esp
mov dword [edx + 4], ecx
call fcn.0040de40
lea ecx, [esp + 0x40]
call fcn.004e2be0
sub esp, 8
mov dword [esp + 0x24], eax
mov eax, esp
lea ecx, [esp + 0x40]
call fcn.0040de50
mov ecx, dword [esp + 0x38]
call fcn.004ff990
sub esp, 4
lea ecx, [esp + 0x40]
mov dword [esp + 0x20], eax
call fcn.00506f10
jmp 0x40dc5b
jmp 0x40dc5b
jmp 0x40dc60
mov eax, dword [esp + 0x1074]
mov ecx, 0x3fff
mov ecx, esp
call fcn.0040de60
call fcn.0040de70
call eax
sub esp, 4
mov dword [esp + 0x1c], eax
jmp 0x40dc86
mov byte [esp + 0x106f], 1
mov dword [esp + 0x3c], 1
test byte [esp + 0x106f], 1
jne 0x40ddf3
mov al, 1
mov ecx, 0
call fcn.0040de80
mov esi, dword [0x80a090]
mov edi, ecx
sub edi, edx
mov ebx, ecx
sub ebx, 0x17d18724
add edi, ebx
sub ecx, edi
add ecx, 0xa203797e
sub ecx, 1
sub ecx, 0xa203797e
add ecx, 0x2b239f38
sub ecx, 0x17d18724
sub ecx, 0x2b239f38
imul edx, ecx
and edx, 1
cmp edx, 0
sete ah
cmp esi, 0xa
setl cl
mov ch, cl
xor ch, 1
mov dl, ah
xor dl, ch
and dl, ah
mov ch, ah
xor ch, 1
and ch, 0
mov dh, al
xor dh, 0
and ah, dh
mov bl, cl
xor bl, 1
and bl, 0
and cl, dh
or ch, ah
or bl, cl
xor ch, bl
mov cl, dl
xor cl, 1
mov ah, ch
xor ah, 1
xor al, 1
mov dh, cl
and dh, 1
and dl, al
mov bl, ah
and bl, 1
and ch, al
or dh, dl
or bl, ch
xor dh, bl
or cl, ah
xor cl, 1
or al, 1
and cl, al
or dh, cl
test dh, 1
jne 0x40dd68
jmp 0x40ddff
mov ecx, dword [esp + 0x38]
call fcn.00506f10
mov ecx, 0
mov eax, 0x473fa16b
mov edx, dword [0x80a094]
mov esi, dword [0x80a090]
add eax, 0
sub eax, 1
add eax, 0xb8c05e95
mov edi, ecx
sub edi, edx
mov ebx, ecx
sub ebx, eax
add edi, ebx
sub ecx, edi
imul edx, ecx
and edx, 1
cmp edx, 0
sete al
cmp esi, 0xa
setl ah
mov cl, ah
xor cl, 1
mov ch, al
xor ch, cl
and ch, al
mov cl, al
xor cl, 1
mov dl, ah
and dl, cl
xor ah, 1
and al, ah
or dl, al
mov al, ch
and al, dl
xor ch, dl
or al, ch
test al, 1
jne 0x40ddee
jmp 0x40ddff
jmp 0x40ddf3
mov eax, dword [esp + 0x34]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esp + 0x38]
call fcn.00506f10
jmp 0x40dd68