Function at 0x40dc64
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x904
mov eax, dword [0x4434f4]
xor eax, esp
mov dword [esp + 0x900], eax
and dword [esp + 0x18], 0
mov eax, edx
push ebx
push esi
push edi
or esi, 0xffffffff
mov dword [esp + 0x30], eax
xor ebx, ebx
mov edx, 0x401900
mov edi, ecx
test eax, eax
mov ecx, 0x401978
mov eax, edx
jne 0x40dca7
mov eax, ecx
push 0x401ad4
push eax
lea eax, [esp + 0x700]
push 0x105
push eax
call fcn.0040c0b5
add esp, 0x10
test eax, eax
js 0x40e12a
lea eax, [esp + 0x24]
push eax
push 0x20019
push 0
lea eax, [esp + 0x704]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e12a
xor ecx, ecx
mov dword [esp + 0x28], 0x50
push ecx
push ecx
push ecx
push ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [esp + 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40e0d0
mov eax, dword [esp + 0x1c]
xor ecx, ecx
and dword [esp + 0x34], ebx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov dword [edi], eax
pop ecx
test eax, eax
je 0x40e120
xor esi, esi
cmp dword [esp + 0x1c], ebx
jle 0x40ddba
push 0x20a
call fcn.0044183a
pop ecx
mov ecx, eax
mov eax, dword [edi]
mov dword [eax + esi*4], ecx
mov eax, dword [edi]
mov edx, eax
cmp dword [eax + esi*4], ebx
jne 0x40ddb3
xor ecx, ecx
mov dword [esp + 0x14], ecx
test esi, esi
jle 0x40dda4
mov eax, edx
mov edx, dword [eax + ecx*4]
mov dword [esp + 0x20], edx
mov edx, eax
cmp dword [eax + ecx*4], ebx
je 0x40dd9b
push dword [esp + 0x20]
call fcn.00441807
mov eax, dword [edi]
pop ecx
mov ecx, dword [esp + 0x14]
and dword [eax + ecx*4], ebx
mov eax, dword [edi]
mov edx, eax
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, esi
jl 0x40dd74
test eax, eax
je 0x40ddb3
push eax
call fcn.00441807
and dword [edi], ebx
xor eax, eax
pop ecx
inc esi
cmp esi, dword [esp + 0x1c]
jl 0x40dd4f
test eax, eax
je 0x40e11d
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x208
push eax
lea eax, [esp + 0x2ec]
mov dword [esp + 0x2c], 0x50
push eax
push 0
push 0
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x25c]
push eax
push 0
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40e0d0
mov esi, dword [esp + 0x30]
mov eax, 0x401900
test esi, esi
jne 0x40de16
mov eax, 0x401978
push 0x401adc
push eax
lea eax, [esp + 0x4f8]
push 0x104
push eax
call fcn.0040c0b5
add esp, 0x10
test eax, eax
js 0x40e07e
lea eax, [esp + 0x4f0]
push eax
lea eax, [esp + 0x24c]
push eax
lea ecx, [esp + 0x48]
call fcn.0040d7ff
xor eax, eax
mov dword [esp + 0x18], eax
mov esi, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
jmp 0x40de70
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x40de6c
mov eax, esi
sub eax, 1
je 0x40df7b
sub eax, 1
je 0x40df57
sub eax, 1
je 0x40df2e
lea eax, [esp + 0x40]
test esi, esi
je 0x40deb9
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [esp + 0x20], eax
jmp 0x40df98
inc esi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x40deb5
sub esi, 1
je 0x40df1d
sub esi, 1
je 0x40df07
sub esi, 1
je 0x40deec
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [esp + 0x18], eax
jmp 0x40df98
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0x404340
jmp 0x40df47
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0x404360
jmp 0x40df6b
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x404378
jmp 0x40df8a
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0x4042f8
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x40df98
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push 0x404318
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x40df98
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x404330
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
shl eax, 0x10
add ecx, eax
and dword [esp + 0x38], 0
mov eax, dword [esp + 0x20]
shl eax, 0x10
add esi, eax
and dword [esp + 0x3c], 0
mov eax, ecx
shr eax, 0x10
cdq
shld edx, eax, 0x10
shl eax, 0x10
mov dword [esp + 0x14], eax
movzx eax, cx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], edx
cdq
or ecx, eax
mov eax, dword [esp + 0x10]
or eax, edx
shld eax, ecx, 0x10
mov dword [esp + 0x10], eax
mov eax, esi
shr eax, 0x10
cdq
shl ecx, 0x10
or ecx, eax
mov eax, dword [esp + 0x10]
or eax, edx
shld eax, ecx, 0x10
mov dword [esp + 0x10], eax
movzx eax, si
mov esi, dword [esp + 0x30]
cdq
or dword [esp + 0x10], edx
mov edx, esi
shl ecx, 0x10
or ecx, eax
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x38]
call fcn.0040d8de
test eax, eax
jne 0x40e050
cmp dword [0x443534], 0xffffffff
jne 0x40e038
push ecx
push 2
pop edx
call fcn.0041e530
push 2
mov edx, 0x401a98
pop ecx
call fcn.0041e988
mov edx, esi
lea ecx, [esp + 0x38]
call fcn.0040d991
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x3c]
jb 0x40e07e
ja 0x40e066
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x38]
jb 0x40e07e
mov ecx, dword [edi]
lea eax, [esp + 0x2e8]
push eax
mov edx, 0x104
mov ecx, dword [ecx + ebx*4]
call fcn.0040c010
inc ebx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x34], eax
cmp eax, ecx
jae 0x40e0d4
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x104
push ecx
lea ecx, [esp + 0x2ec]
mov dword [esp + 0x2c], 0x50
push ecx
push 0
push 0
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x25c]
push ecx
push eax
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40de08
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
jle 0x40e115
cmp dword [edi], 0
je 0x40e115
mov esi, ebx
cmp ebx, ecx
jae 0x40e103
mov eax, dword [edi]
cmp dword [eax + esi*4], 0
je 0x40e0fe
push dword [eax + esi*4]
call fcn.00441807
mov eax, dword [edi]
pop ecx
and dword [eax + esi*4], 0
mov ecx, dword [esp + 0x1c]
inc esi
cmp esi, ecx
jb 0x40e0e3
test ebx, ebx
jne 0x40e117
cmp dword [edi], ebx
je 0x40e11d
push dword [edi]
call fcn.00441807
and dword [edi], ebx
pop ecx
test ebx, ebx
jle 0x40e11d
mov esi, ebx
jmp 0x40e120
or esi, 0xffffffff
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x90c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00441b90
mov esp, ebp
pop ebp
ret 4