Function at 0x413020
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42db5d
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x4376f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x280], eax
xor eax, eax
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], eax
push edx
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 1
mov dword [ebp - 0x284], esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov byte [ecx], al
lea eax, [ebp + 0x10]
push eax
lea esi, [ebp - 0x278]
call fcn.00401b70
mov ebx, dword [ebp + 0xc]
mov ecx, esi
call fcn.00412900
xor edi, edi
add esp, 0x20
cmp eax, edi
jne 0x4130f3
mov dword [ebp - 0x274], edi
mov eax, dword [ebp - 0x274]
push edi
push edi
push edi
push edi
lea ecx, [ebp - 0x284]
push ecx
mov ecx, dword [ebp - 0x278]
lea edx, [ebp - 0x214]
push edx
push eax
push ecx
mov dword [ebp - 0x284], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x413110
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x24], 0x10
jb 0x413265
mov edx, dword [ebp + 0x10]
push edx
call fcn.004185a3
add esp, 4
mov al, 1
jmp 0x41344d
xor eax, eax
mov word [ebp - 0x24c], ax
mov ebx, 7
lea eax, [ebp - 0x214]
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x413133
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x24c]
call fcn.0040a370
lea eax, [ebp - 0x24c]
lea esi, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00415540
mov esi, 8
cmp dword [ebp - 0x238], esi
jb 0x413185
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.004185a3
add esp, 4
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x290], edi
mov dword [ebp - 0x28c], edi
cmp byte [ebp + 0x2c], 0
mov byte [ebp - 4], 5
jne 0x41326c
cmp dword [ebp - 0x21c], 0x10
mov ecx, dword [ebp - 0x230]
jae 0x4131ba
lea ecx, [ebp - 0x230]
mov edx, dword [ebp - 0x280]
mov esi, dword [edx + 0x10]
mov ebx, dword [ebp - 0x220]
mov eax, esi
cmp esi, ebx
jb 0x4131d1
mov eax, ebx
cmp dword [edx + 0x14], 0x10
jb 0x4131d9
mov edx, dword [edx]
call fcn.00401040
test eax, eax
jne 0x4131f4
cmp esi, ebx
jae 0x4131eb
or eax, 0xffffffff
jmp 0x4131f2
xor eax, eax
cmp esi, ebx
setne al
test eax, eax
sete al
test al, al
je 0x4133bc
mov edi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x230]
call fcn.00406580
mov edx, dword [ebp - 0x278]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x10
cmp dword [ebp - 0x21c], esi
jb 0x413239
mov eax, dword [ebp - 0x230]
push eax
call fcn.004185a3
add esp, 4
mov dword [ebp - 0x21c], 0xf
mov dword [ebp - 0x220], 0
mov byte [ebp - 0x230], 0
cmp dword [ebp + 0x24], esi
jb 0x413265
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004185a3
add esp, 4
mov al, 1
jmp 0x41344d
xor edx, edx
lea eax, [ebp - 0x214]
mov word [ebp - 0x24c], dx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x413290
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x24c]
call fcn.0040a370
mov byte [ebp - 4], 6
mov ebx, dword [ebp - 0x270]
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x280]
or ebx, 1
mov dword [ebp - 0x270], ebx
call fcn.00415490
add esp, 4
mov edi, 7
mov dword [ebp - 4], edi
or ebx, 2
push eax
lea edx, [ebp - 0x294]
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x270], ebx
call fcn.0040a950
add esp, 4
test al, al
je 0x41332b
mov ecx, dword [ebp - 0x290]
sub ecx, dword [ebp - 0x294]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov byte [ebp - 0x269], 1
jne 0x413332
mov byte [ebp - 0x269], 0
test bl, 2
je 0x413370
and ebx, 0xfffffffd
mov dword [ebp - 0x270], ebx
cmp dword [ebp - 0x254], esi
jb 0x413357
mov edx, dword [ebp - 0x268]
push edx
call fcn.004185a3
add esp, 4
xor eax, eax
mov dword [ebp - 0x254], edi
mov dword [ebp - 0x258], 0
mov word [ebp - 0x268], ax
mov dword [ebp - 4], 5
test bl, 1
je 0x41339c
and ebx, 0xfffffffe
mov dword [ebp - 0x270], ebx
cmp dword [ebp - 0x238], esi
jb 0x41339c
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.004185a3
add esp, 4
cmp byte [ebp - 0x269], 0
je 0x4133b6
mov edi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x230]
call fcn.00406580
mov edi, dword [ebp - 0x294]
mov byte [ebp - 4], 4
test edi, edi
je 0x413400
mov esi, edi
cmp esi, dword [ebp - 0x290]
je 0x4133f7
cmp dword [esi + 0x14], 8
jb 0x4133df
mov edx, dword [esi]
push edx
call fcn.004185a3
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x1c
jmp 0x4133c6
push edi
call fcn.004185a3
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x21c], 0x10
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], eax
jb 0x413430
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.004185a3
add esp, 4
inc dword [ebp - 0x274]
xor edi, edi
jmp 0x4130b2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041836d
mov esp, ebp
pop ebp
ret