Function at 0x403790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412f20
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x48
mov eax, dword [0x4340a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x18]
call fcn.00403190
lea ecx, [ebp - 0x18]
call fcn.00403e20
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0x10]
call fcn.00401180
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x403856
push 0x426024
mov ecx, dword [ebp + 8]
call fcn.00403e60
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403f60
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00403f60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00403f60
mov eax, dword [ebp + 8]
jmp 0x403a53
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x30]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp + 0x14]
call fcn.00401180
push eax
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x4c], str.JrwY2jdDHT1LkaV51HbNwhNFCSLMQRMCjDrjJQtwmb1X20DmPEVV06hhP585cbIFsnbO9Sj1FvKhNL89SxmgOOkaqYvBEQsUMWYbwaqYIAFp68ve5pwsXPNYxPSM9SYJ4Ebt7elohFOYNXa4Aiwvqiox4mRS4ACahMc95nomPuPtisQKIhAO69CLzPC8fw3PCFx5yEMaxkUgn3E22r0cP5OLm1SBXue5vELuESubiXPFkrXhhR8OsyaJocWfYAuPu6x1pFnXFGWOQCvtnGoiJND3lcKXtbtGomAHOn4dXjdNmXEzo88jhojpdlKLGwd0JGbTukuq0agqexUGw018N9geCTtOFH1Xd0xHLt2w4AT9Nn9RSM4yiI46DSrK0MbOHEmA5dpuqknNEcenjrsl3rIEJxjTz5ASgAIJNdlIum2StnA7upDD0PaBK5xopAD4LdVFUkzI5CVF826v3xkQIBoH0GmaE1fP1kBh4DO2p1ViB0dAs9uLpFnN5tJ2EMSgHhBGxpPk3nEG0LRW61ntUc9R3wqzO1s0pM3rf9ojYvtECyxLgmvpKtJRlQVhLvtgz4jnKviMCbxNQhbO4SDi13aVLryndMTPzK6EgojCG5KxgAipBHNevEvdyfkY16f6EYhKBSiMnTN9wLTuMolCCfQVj731dlw0Wk5wig2kdd8ItSuvt1NcqWgs0UjfWaf4uLW5q3pk8BVa5F9zn421C8P92rrguTtqbMBVLTh0uBdfswoi6s8uvjJvaryrjzMKQk1RJKvBYFFvRCiVaCtl6h46zAw4WWejcJs2nH0tIeQoHMshWoGAYWYxNz0a8sqWMQrRm3E4dF06tzYIL6FDrvEyNXnEHfs58XKc2jqRlkaISetcLsAaligVVlNgFaXHANq7mcespt87JH5h2ISegT2ySefxbK6pqyN4VC2u4mu00Eq3vwfbl59lM4oQuiulNQqP1HMIoazWJqHe40DHqNPmahIq1JleJNawuLvWP2tjd6z5pIiOWfnGTfrhkJjpcW8zSlc4e54hNqescGGS3N0vjizh7ECKYiHInaR4OlWT2RoMWpByq1Y62GR9dzXIOhv4M9xYePy2xBh43N4PuHDLaEQmBgBnjOs1xqhVtv2l8vDTPfl4gOhYapPjpcikWiJkKma9YgjmKaIrtA1SoAcbS3R9TxgN9tM4asfUvY5quPkr46SiboKYzHLRtcky9EiD7vEzhtNHywHcyx4BAOj1Qn9lEILW8yfKDqtzRvHbjSGCP6SrbFe1K6lc8roVblSupmQqdNLGglzcEqXNlmlSRSeTTtnNAKAjSAeRGotn6yNdLkGWQHDo5fCkcRHypawtUpCbDL6Ine1joQj973nwaAzqgv6iucgiUvTTSqvz5Au8t9kLAeGerWeAAeH0trHHcqe85QiDvVUIhH609TpwwehXAbyqmOBPkoevJj40J4fsOcwfohcfmuolYlz1CwtRO9Hx1vKwSs1H2TlypT3vVDoG2RRh05b8B6ieeTbepcekGEc23WespfAxSnRXQcC1XFmmPGFGDSbxfvJPAxK75BR3AUbeaKIWCd4CrM65OynSLIEdELpflJAV30KwBTqwD2lsNMQb3GDe0LDwiFKvMjCt5zJDtVEkwpRbMXNhmd1Lgjp9Te6n7Lmwp3BFFmo46x5TqmliDxP3zeEAjnx89cJxDk43MUCv
mov dword [ebp - 0x54], str.nlzEn30nV2krVv1fXJxjVR4K23VHv6qxBW1UmPz0lO3gy5qSRgevPBI6YHHHpfrVHSX9r6kxC3YVYiuIV7AvyPU41qWPe3fkAyTDi1wgnKC2wEWypi8AWJMkPzVudHiFi6OcsdIISazgTyoYFyPDLULSML081nJH1keenMIQ3Jnkcp6rejd5Eqz3QLtgHav16M8KogzSr6D5Uya9IGjY8M7tDBHvH9l4YH5kIEDmf6XpVipeWwFUCXD9rr3yQlH3j196towciMXixQtyQmm7qoCm9HTcmIP5OlRMEn5B5qhNorHTtrViKVOKjYDgQdI2q4mIaXr9Gsy4xdeO4HvOFVfi75FFiGaF8cdJMX2FUxuhqgYIXNGCc9bgn2qr80Gw7uwldCuo7xJLUFCNF5AbbPbiz1mD6UA0IpXxYEMQmw0ScqA8OARAoE4jNtUroaVjn7EYze4UjL04Uv5za6FvuMUBP1z4ytzuGrgPkXPKiIsR4P3RE2F90N3L3sOPzr6qoWXRuUMSg58R4hfxkB3lmJ7KsQ99LHROnVtsbDWaPHLLGE9VoDvsU8XMKo5uSN1bDkYwq5yLeGak6K3gbIhuRSJufxan3frSmOey8F9ckj6nTiWwb86XjrRKSUVsLtN6OMsE6jvgF3oP3XEB0Oc1gF1OgmXrWTwQtipu2lG9pBQHSpJ9pumlBQ6hBTQ7TTOYS7nivw1jmRk3advGivQe7Km1MNakjMCaNK8S086AWVF10U4wIWtwsCfhkwx2fPFR4nYERPK7g6LRV1gQRDxGc7uAoFBfbgssGSKBnM8m3RtRRWID22SHLl7RK9Y3Yee3NRMgEBA7DWIq89PHHkQbxUmjRXlDTS1EHCVLJkNw5gp1oWKHtriiIPMrNqngzjA5O8xPztF1YSuaKEp66WANsBbaiXLf2xvVG8vKY1npEaTuGytdraB0IaBDFgd0Gy7I4YfnDlnL1AAG4Pp9y6MOsSopVbr1njsIKPDaaknzDUyy9GpSBs3KrC8lKMbQiGo3Ks893imzJ3NVzdtcSENPlFGAnnda2xyEcpFTF2yRa7lLoumIPN1HLNcGKphEzEkllRHBiKvRorb32yyR4IaBab2rpzb9iOOGBLe348WlzzmRkonUiVdkSuS3AKHvXIY8xKIx5jVmteXpsUPYoEGebPDY63FHK1tWP7d0fRMkvn3U32JYnPzhcMv5rIVKbjJekUbVoQ4YI8HH6zGFn5r0XlVtJijLdcYSXQHngKCoOQ3aXl1DIJiunYEEJtFXabcESol0twxW76cNr4PhOQJsgCDqR7TAKJ68kF82vxbnCAh9Ht0Qf9NakE9UanTY5idIHvFhLGdHUkrRhbapH58r9SHAjwzAFeNDvt46yfvkhqSE8OIR4NNIeB4fE5PUpRUXsNWu2XfWBhKiBVQVk8r0Tyj08LDwzukylsqWg6RAqqgGp3t9CEcPsUKhmuW4PmDa859Cdg2CUECKECkVdCIq3lWSBnIjfEajU2icJBKJTV5xS5PswYcsITKUJJW4hw0nVnxWyGdVQqR8XMfL7pihoahMi7DdL41yyR5IkwVzQwfId4zJGgeLT7UgseNIXjQTj0CVxBFkDNuzicy34BHnXdir11uEthTeQUoCCRrcC2T2hpJefdYbbnjJrAJ9kWkfYu8lRFxuMdMuCTpClzMM3WaRNkBnUc3tDk6huRwTPwstcMCpCQooWKgWRJdE3TKfUF4axKdo2nhxdadBtUAMb3llYzBkURUI1wkk13HhlmAll5M2rnEkTymMbNVP6SKTizGDLXldmgKCAxFldwpXasym6xkIyFgDictBy9Kai5aant13BjccUmqp2aTyETbxCuuh2HNp13eRvNGrAtP71mJFWeQ28c384g8gIbFB2ynHanmGgnHobXwboujS999Gy0eN3AJFud0GW0qLS9Eh3c6jATvXehxnaTbFloIVaQAYPq7sOz7B6s0KoEDai6186SSeNvxXvsBKcokoBaWMLF5wk6UuF2cMGxKqxiqIAiviMxO3U7CNl9qYuOBY3toVrbIMwzQt6KMWKw3Hxm2c0HoOHzUNvMK2XPepECyNos09DThtrvE8OAC2mmabzg8m3deYGayEshCqmbvjHRrjKu0XxmAo59c1AJdKho8fWcelgSwWyuT2GAFiVVwQkElXCvay0UNc7umz3pS2n40blu5YSHhXWWKVmoAOhQonSzASNaRWE2icmfTnnrcj09nx8TwvsIX3M7x53tA04wM7hn6738AuVjUbpfudKvRK3VL4DDQdnn1xvQSb80QbysQ8Moy4hFGpu6VNSUiyx85Fm5JSyqma6zqr2XiO27jdzQEopuhIC2wg2XrQR1uhayD13kLKVbRIqDAViwVjQ0tFCOY2fAFsLjfBQuAKKFKOO9oEY7bGyHvN7qFKw9jHhEOKCeSi9QDH8dLPjkF7fuK9m12AaTR5voCRFXioIqsUoUoRvbQByoRO9hSwggMMBfK8sTVGUzpijv1cbCV4gc0r7mjOARy19U3CAQum5TV3btkklzQdhmOfNQE4xwD7425cMo9brtMGXu6SpUnxE1v5FMxd7gysJdexVNAv9OW4hq5y9tXsB3Mi1HOv0kPwS0Cd312gdUFlmm45K1U8s2QS3vExv70SCSbyiJcXxdv14zOjMhfBHesnTDseAiA8tlwLXjlGWydVWzbadWKGWCPTzWSOPGc0lM6PvPc67jSfa2WDoE06XSLaUKSSuknfxz7Bv53rDgNqvPYN40ikEoxsJNFjptJKJ1vLFwHxXDAjp67NlvJH2eUCHlGk8ATt2o0NRnrMt84107fSMHcojcf6m1HvLiuoST636u5aqUo3Wneki1inOLkTbXGIbr9D9K4EvuYdXAUaFA0yaPouYaxCtLWbJ7wm54TAnDY48civ9Gr16yGmrfHrvsYryyjPjUoF8XrrPesx2Kwfbr4tVDd7nvAmmfcnTk7xlafCTGz3B7bQTNe8kDWW6RR8
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00404010
mov dword [ebp - 0x48], eax
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp + 0x14]
call fcn.00401180
push eax
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
jmp 0x403912
mov dword [ebp - 4], 3
jmp 0x40394d
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00404060
cmp dword [ebp - 0x38], 0
je 0x4039ac
push 0x428534
mov ecx, dword [ebp + 8]
call fcn.00403e60
mov eax, dword [ebp - 0x34]
or eax, 1
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403f60
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00403f60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00403f60
mov eax, dword [ebp + 8]
jmp 0x403a53
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403e40
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00403f60
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00403f60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00403f60
mov eax, dword [ebp + 8]
jmp 0x403a53
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00405b6d
mov esp, ebp
pop ebp
ret 0x10