Function at 0x4079b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4341f0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x42c
mov eax, dword [0x49f868]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 0x41d], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x418], 0x400
mov dword [ebp - 0x438], str.h5oXTFQqMSdE3w71FVCwNAqIrTXd5fGkqvb2XLv41M5WJu3gXC0qYegQIDf6H6KDWkS8AwdmUAfudIpHcvW5ukHT8tqzYubmEB66pajXXv4KbKbhkjnWX6it11StnIU9bdxxCq2VR3srpcKQ6xmbCmsBXaENocjBQO7GVGvLC33oDIVf0z4DavxOSdpOyn7hP0PvxQLtvG5IE6TeiCQTMuJ2TJsVpNqFY4QG9sIt2tpFg9ex1FcffRaGpDKLv8Lf0esB2zaEYeALgOQSXBIDMMOC7bSco34piu7jWQMlr6LGs6aQG5bLaTBaUU5fEmBv4HoA9xbkHAJkI3S5wBu0Fxg44sKIcjxSF0U30Vhc76ybBKiiG6aPDCygpOMfUO0kaUgFn2bAERw1HXNb2V1TlWvF2MdYgjuQG37z7rrLwBNE5Tk1sI95c5nxa1vghS4y1avVq78OBySt1FNjOymlnER9tNF0V90Nybx0SU3ETBNqBQoSAHwHpjoAOdgH19Tnmfj5vHM4yr52UrARTFrhgAcLaVgqinAj9ITBGgFBSlKqPV5Kva0ge1drBrhOmKb1e7r1blNIioohceRlO55U45dbqRm6IH1czd4T9E4Boi5QGHdMTvzAQcGoY265L5KTOXUSaO7mQwp0TcBwpMoI6JUjPuz9MaiwdxcGatjQxcu8jYQlGorNH3V0EvqfXJMKDGNjKTKKRWCQ0ffYNoA1SxQzTgVsb7yRrP61PJewgSxrF4620IrqD1lNTfE0EPKlbJDdY6tRUnp7apJdxLF1z1H2V5QbubrkV6nc6VzcofaIuIolyNV6NfgxGgt8y2zs0oKx8HbeIE7sVVdFSrDNrqbV0nzTY4wTxGlRq5gXeDywvbbt92DNgWcJAMALT32wSw2dPLibQiLLkpKncipFXL3dCGsUYSA7StHctwQ7usTcc0XRmcGBtUC1e3XEF1fmPpw5z6ylYKRSDVojqYztWoOctEKq4pEQts0ODfaQ8zt9QFfYBauKGcGanYfOYv2210XWlLs1H2koLaf3zvdAepiKVlIyWjah7IBHyskCn4Q90VKyu5MIj4Nb4KhwcjqORvoSp8HMQlk6TXFsTbDBSfs2F3PIExLORz909CD6HjO7tMuzSmvh53BjzM9jVvKg7m2aiMftwcf8sriDDXUBz90P4Lgz34eYyFV7mlEGth798qEQrPUHUxc3rHmuCa2Odjnsn5PVUEvmAR4Rguryr7ChGWlBw4praL3e2WzW3626YKKkoS9J1ARGxKjDiJ3C0sPcR33WD4IWf8JHfmCDlScYneKyKLP6pbyQfy7C6Q5NCEfwjEqnXYym7oGE6pPF97XqlOlcnF5NHEIj6T3Qe3CzfcvrNwl74OP0dj1n3E7lp4MDhAXIjnMPSo7HIEQg4gOjFD5reM37Yui4wEAqeq6UFHQv0X2TaMyXpAf9BXb4Y9hbDng9PLm6RIub8fMTpaEhW2SLtWinlVYytrjQM83ahSihUVd6XuDlA34
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x407add
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x407ac6
mov dword [ebp - 0x424], 0
jmp 0x407a86
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x424]
cmp edx, dword [ebp + 0x18]
jge 0x407ac6
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x407ac4
mov byte [ebp - 0x41d], 1
jmp 0x407ac6
jmp 0x407a77
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x430], str.sArbB7Y17iPuaYENe5OyPv3tEBJHjxmxxuUsTQoTGHvUahmOW3IynWXcdAfLJxMDpd5NuDX0dlIqJ8fuxvrWeImhWa92KlyOKupTzTGB2gNasNovqLBeGJIIGOKeMs1e9Obx5A8SURsU7wVXUYE1NtaoHiCFtoApdpvGD8pV9KH6GA5nk0T4hRn5IBHnCFNirjlqxwhHx7MLDDwv7Yc02gwYyIfzCQmOATfFRz28XsnbrB38M9npgGLCVrTQKK9hoIpyW9hJRLApOUiweyr8DCUKgjLilgCIe4nT3EfcIgKUw6gAnVjCNixXQWfIREINFLUfmQ9AfqOphJleYN13Ww3jlgk9PmM75zSSy78pr8nJRwmfwyMhMHLiBxHNLPycBXjKRlcFzwGY3esqShRUQkPGwVHg3hh9uB5xzbn0Pi0i3d2wGjt18SgjUqqtHdboqBhWrsPcykwGDxRROnWevMSj3lJ0vxMCKzoQf4MlQEtEC9jREE8Y8gHXfFpVJeHd76tOQwMI5syaG4iFCJLx1Dm4pgBC4PHxefveSv8acNWtUWYngzARYsiV1R0GrANWVorcPQNXICh3G6I99xhJFmyqlifAqktqRvlYNbqLD9PPMXA07BQKya41hDTr4YqQ7zd69h8sFm0aVekSxuXf3WnB3EEAgLHnYh5AHszbNPiQE6YHtWWoU1xSVobiLgx0UMexm6XXycndR8ETsvP6Ytr3iCFrcur61tT8qvkGFOu9pjKdESDjulI8ENQq4Tal2UmDy0p1XLk6Y6SLS1n63EL0E8WhMsIHMWmWQXjesq128RRNVflUbUmKRpV66q5AeWBPX5dofVNSP6bAY6kGl25RqoVJOv7BcodmXJ9wIqdLbMhw5vvmlLt8lc0udImUt9WonqVvQy4wLVoKflAbKX8fxexlJ7AaLyR4nNnnXYSQobkYmUuIOFC1jQKbWt4zFpkQKNkbOi1gUVksc0pRp8xiknBCAjz0DVRAWvE4aVLatjrCU2UTU7PAjxJgh8XMiVtiJhLHmiTc3iBHmAmwGottp7lgV6s9OqGEcC6mdniQjj26vFspUwqebyFyPQK1n15lGBlnh0stkzmUojJ4xajQYu9eHOkEvgRnxNJAc4fmVcn1z7BtMhqybBBjYeNYgkbbl552yzWKI41U5hn49bEI9EgJUaUEdV0FXGQY0xfQ6VmQwUcn6EA0oDNLHlOnHP8BmkzPIs0um8rOvDcx9w11ueUaxFKlP9mPwbPpesqyAJ47emokFRUFjUH2DfyUhCPLlW2TqOadavkP6QWxhJLlW4pBioeWIEHiDFw3uicpluR1BABEtzmEbfk6bmw80iIS8LYWeOAcJG5uqIzEHkGElhJSmqYY6j7Arbi17uoIm48Wn9B7en4DPfVsUG3XLUUrXakUbkpdaM0aOIXw6zMuO06RsQ25BarEzri0ot6siwPY8CVSBpgC7z1uG3eG9g38DmaXb5UFDt5fCdhQOBtIaMcByTeE8MVFp0DlvOCsDxsulEadce1KWF9Co1pFq1MC0SKYXyXu3vu5vNjn3KLWasn1WWSi4SOTsXI3NoJx4cpdreViBaSU8yplldyQbp1B8ol8bRqHYb457dfc781l56I8heMSxQbIa8fgIrtI0XHKSDtyXewThe40iNQJ5bnjnUPtX4l0vi2PFkxexifReOmAo6xo6bzFa3F10w2YlVNAKXQyBowqLlN8xraPkY6L8VqvRsnc7bpdQw9z5EP8C2nXpBCUYTza4TNYyc3j7RKI8fsV8dF0yRTBqUonGz05YlDQwz6Km5DjBOUY0cOe366a4s2xlutKsSNhgIhyRpssPJvMru8wnOPEDWdPqOb80crR2MJ84MqhMQDRmdTHaAaMr6puQqslWBA52AWKLd7nRh8ihQXQ185FzfAlb2s3REiUHh3TRPrliTXKeu4qJvkF7NbcKhryLrtRMlMibPJF3ugILLNns7clddULFwSTfEUQgAAOBtJQ
jmp 0x407af6
mov dword [ebp - 4], 0xffffffff
jmp 0x407b06
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e8d2
mov esp, ebp
pop ebp
ret 0x14