Function at 0x40be40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x40ffcb
push eax
mov eax, 0x4228
mov dword fs:[0], esp
call fcn.0040f710
mov al, byte [esp + 0xf]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
or ecx, 0xffffffff
mov edi, str.SoftwareSigmaTel
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x4240], ebx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4135b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x38]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.STSysTray1.0
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x38]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4135b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.EventExpressions
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x38]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4135b4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x38]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x4248]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x20019
lea ecx, [esp + 0x40]
push ebx
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c11a
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, dword [sym.imp.MSVCRT.dll__mbscmp]
xor edi, edi
lea edx, [esp + 0x14]
lea eax, [esp + 0x238]
push edx
push eax
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x40]
push 0
lea edx, [esp + 0x148]
push ecx
push edx
push edi
push eax
mov dword [esp + 0x54], 0xff
mov dword [esp + 0x34], 0x3fff
call ebp
test eax, eax
jne 0x40c084
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
cmp esi, eax
je 0x40c050
mov eax, dword [esi]
lea ecx, [esp + 0x138]
push eax
push ecx
call ebx
add esp, 8
test eax, eax
jle 0x40c050
mov eax, dword [esp + 0x2c]
add esi, 4
cmp esi, eax
jne 0x40c031
lea edx, [esp + 0x138]
push edx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push 1
push esi
call fcn.0040cc90
inc edi
mov dword [esp + 0x20], 1
jmp 0x40bfeb
test edi, edi
je 0x40c10f
mov edi, dword [esp + 0x424c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40c102
mov ecx, dword [esp + 0x2c]
sub ecx, eax
sar ecx, 2
cmp esi, ecx
jae 0x40c102
lea edx, [esp + 0x14]
lea ecx, [esp + 0x238]
push edx
mov dword [esp + 0x18], 0x3fff
mov edx, dword [eax + esi*4]
mov eax, dword [esp + 0x14]
push ecx
push 0
push 0
push edx
push eax
call ebx
test eax, eax
jne 0x40c0ff
lea ecx, [esp + 0x238]
push ecx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 8]
push edx
push 1
push eax
mov ecx, edi
call fcn.0040cc90
inc esi
jmp 0x40c09b
lea ecx, [esp + 0x24]
push ecx
call fcn.0040c6f0
add esp, 4
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x28]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x423c]
mov eax, dword [esp + 0x24]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4234
ret