Function at 0x405132
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1dc
mov eax, 0x41efa1
call fcn.0040dc60
mov dword [ebp - 0x1e0], ecx
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x1dc], ebx
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
push 0xe
pop ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x54]
push eax
mov esi, 0x401354
lea edi, [ebp - 0x54]
push 0x80000002
rep movsd dword es:[edi], dword [esi]
call fcn.0040698c
mov dword [ebp - 0x1cc], eax
lea ecx, [ebp - 0x1e4]
push ecx
xor edx, edx
lea ecx, [ebp - 0x1c8]
push ecx
push edx
push edx
push 0x40138c
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c8], edx
mov dword [ebp - 0x1e4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405242
push dword [ebp - 0x1c8]
mov byte [ebp - 0x1c], al
lea edi, [ebp - 0x1b]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push 0x4012e8
push eax
call fcn.004055e0
add esp, 0xc
test eax, eax
js 0x405242
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 0x1bc], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4051fb
sub ecx, edx
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00403c3b
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 2
call fcn.004054f8
push ebx
push 1
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 1
call fcn.00403f4f
mov ebx, dword [ebp - 0x1dc]
push 0x11
pop ecx
mov esi, 0x401398
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x9c]
push eax
push 0x80000002
movsb byte es:[edi], byte [esi]
call fcn.0040698c
mov esi, eax
mov dword [ebp - 0x1e8], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x4053d5
push 0x103
lea eax, [ebp - 0x19f]
push 0
push eax
mov byte [ebp - 0x1a0], 0
call fcn.0040f99c
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push ecx
push esi
mov dword [ebp - 0x1c0], 0x104
mov dword [ebp - 0x1c4], ecx
call edi
test eax, eax
jne 0x4053d5
xor ebx, ebx
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], ebx
mov byte [ebp - 0x1bc], bl
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4052ec
sub ecx, edx
push ecx
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00403c3b
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 4
call fcn.004054f8
push ebx
push 1
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.00403f4f
mov eax, dword [ebp - 0x1c4]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x1c0]
push ecx
lea ecx, [ebp - 0x1a0]
inc eax
push ecx
push eax
push esi
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], 0x104
call edi
test eax, eax
je 0x4052cd
mov ebx, dword [ebp - 0x1dc]
jmp 0x4053d5
xor eax, eax
push 0xffffffffffffffff
push eax
push ebx
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x1a8], 0xf
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 0x1bc], al
call fcn.00403baa
cmp dword [ebp - 0x1a8], 0x10
mov eax, dword [ebp - 0x1bc]
mov byte [ebp - 4], 5
jae 0x4053ad
lea eax, [ebp - 0x1bc]
mov ecx, dword [ebp - 0x1e0]
push eax
call fcn.00404e05
mov edi, eax
push 0
lea ecx, [ebp - 0x1bc]
push 1
test edi, edi
jne 0x40540c
mov byte [ebp - 4], 3
call fcn.00403f4f
add ebx, 0x1c
cmp dword [ebp - 0x1d8], ebx
jne 0x40536d
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4053ea
push esi
call edi
mov eax, dword [ebp - 0x1cc]
test eax, eax
je 0x4053f7
push eax
call edi
xor edi, edi
lea ecx, [ebp - 0x1dc]
call fcn.004055ae
mov eax, edi
call fcn.0040dce3
ret
call fcn.00403f4f
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x40541e
push esi
call ebx
mov eax, dword [ebp - 0x1cc]
test eax, eax
je 0x4053f9
push eax
call ebx
jmp 0x4053f9