Function at 0x40e94a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push edi
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xbc], 0
mov byte [ebp - 0x78], 0
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x77]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0xb8], 0
mov eax, dword [0x45adec]
mov dword [ebp - 0xb4], eax
mov ecx, dword [0x45adf0]
mov dword [ebp - 0xb0], ecx
mov dx, word [0x45adf4]
mov word [ebp - 0xac], dx
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0xaa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x80], 0
xor eax, eax
mov dword [ebp - 0x7f], eax
mov byte [ebp - 0x7b], al
mov byte [ebp - 0x48], 0
mov ecx, 0x11
xor eax, eax
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0xc4]
push ecx
push 3
push 0
push 0x45adf8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40ea13
jmp 0x40ec23
mov dword [ebp - 0xbc], 0x2a
lea edx, [ebp - 0xbc]
push edx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0xc0]
push ecx
push 0
push 0x45ae14
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40ea59
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ec23
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0xb4]
push eax
call fcn.00422890
add esp, 8
lea ecx, [ebp - 0xc4]
push ecx
push 3
push 0
lea edx, [ebp - 0xb4]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40ea9f
jmp 0x40ec23
mov dword [ebp - 0x4c], 0x48
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
push ecx
push 0
mov edx, dword [ebp - 0xc4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40eadb
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ec23
lea ecx, [ebp - 0xb8]
push ecx
push 3
push 0
lea edx, [ebp - 0x48]
push edx
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40eb0d
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ec23
mov dword [ebp - 0xbc], 6
lea edx, [ebp - 0xbc]
push edx
push 0x45ff74
lea eax, [ebp - 0xc0]
push eax
push 0
push 0x45ae1c
mov ecx, dword [ebp - 0xb8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40eb61
mov edx, dword [ebp - 0xb8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ec23
push 0x45ae28
call fcn.00422ce0
add esp, 4
movsx ecx, byte [eax + 0x45ff74]
sub ecx, 0x30
and ecx, 0xff
mov edx, dword [ebp - 0xc8]
mov dword [edx + 0x1bc], ecx
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc4]
push edx
push 3
push 0
push 0x45ae2c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc0], 6
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0xc0]
push edx
push 0
push 0x45ae48
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 3
lea ecx, [ebp - 0x80]
push ecx
push 0x45ae58
call fcn.00422ac0
add esp, 0xc
test eax, eax
jne 0x40ec16
mov edx, dword [ebp - 0xc8]
mov dword [edx + 0x1c0], 1
mov eax, dword [ebp - 0xc4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret