Function at 0x409e80
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0
je 0x409efe
cmp dword [ebp + 0xc], 0
je 0x409efe
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x409efe
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x409efe
mov dword [ecx], 0xffffffff
mov edi, dword [eax]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push 0x404708
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x409f54
cmp ecx, 2
jne 0x409f2a
mov eax, dword [0x41172c]
mov esi, dword [eax]
mov esi, dword [esi + 4]
mov ecx, esi
test edi, edi
jne 0x409f09
push 0x404708
push 0x1e
push edi
push eax
call dword [0x412228]
call esi
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0x404708
push 0x27
push 0
push eax
call dword [0x412228]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [0x41172c]
push 0x404708
push 0x14
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x412228]
mov ecx, edi
call esi
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x200
call fcn.0040b4cc
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x40a2a6
xor eax, eax
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0x20], eax
xor edi, edi
lea eax, [ebp - 0x30]
mov dword [ebp - 8], edi
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
mov dword [ebp - 0x1c], 1
cmp ecx, 0x103
je 0x40a28a
lea ebx, [ebx]
test ecx, ecx
jne 0x40a281
xor eax, eax
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], eax
call fcn.0040ab70
test al, al
jne 0x40a18b
push ebx
mov dword [ebp - 0x18], 0
call fcn.0040ab70
test al, al
jne 0x40a18b
push 0x2e
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
push 0
push ebx
mov edi, eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40a188
test edi, edi
je 0x40a028
lea eax, [ebp - 0x24]
push eax
push edi
push ebx
call fcn.00410049
mov bl, al
test bl, bl
je 0x40a185
mov eax, dword [ebp - 0x24]
lea ecx, [edi + 2]
jmp 0x40a0ab
mov ax, word [esi]
mov ecx, ebx
sub ax, 0x30
mov bl, 1
cmp ax, 9
ja 0x40a043
mov eax, dword [ebp - 0xc]
xor bl, bl
mov ecx, dword [ebp - 0x18]
jmp 0x40a0ab
mov eax, dword [ebp - 4]
xor edx, edx
cmp dx, word [eax]
je 0x40a09c
cmp eax, esi
jae 0x40a09c
cmp word [ecx], 0x30
jne 0x40a05e
add ecx, 2
cmp ecx, esi
jb 0x40a051
mov eax, esi
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x14
jle 0x40a073
mov eax, dword [ebp - 0xc]
xor bl, bl
mov ecx, edx
jmp 0x40a0ab
push 0xa
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edx
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
cmp esi, dword [ebp - 0x28]
jne 0x40a092
cmp eax, 0x7fffffff
jbe 0x40a0a1
mov eax, dword [ebp - 0xc]
xor bl, bl
mov ecx, dword [ebp - 0x18]
jmp 0x40a0ab
mov eax, dword [ebp - 0xc]
xor bl, bl
test bl, bl
je 0x40a185
xor ecx, ecx
mov edi, dword [ebp - 8]
test bl, bl
je 0x40a180
test ecx, ecx
jne 0x40a180
cmp eax, edi
jle 0x40a180
mov esi, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 0x20]
inc esi
mov dword [ebp - 8], edi
test eax, eax
je 0x40a0e0
push eax
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
add esp, 4
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040b4cc
add esp, 4
mov dword [ebp - 0x20], eax
test eax, eax
je 0x40a2a6
xor ecx, ecx
test esi, esi
je 0x40a114
cmp esi, 0x7fffffff
jbe 0x40a119
mov ecx, 0x80070057
test ecx, ecx
js 0x40a16f
mov ecx, esi
mov edx, eax
test esi, esi
je 0x40a152
mov edi, SysReAllocString
sub edi, esi
mov esi, dword [ebp - 4]
sub esi, eax
lea eax, [edi + ecx]
test eax, eax
je 0x40a14e
movzx eax, word [esi + edx]
test ax, ax
je 0x40a14e
mov word [edx], ax
add edx, 2
sub ecx, 1
jne 0x40a131
jmp 0x40a152
test ecx, ecx
jne 0x40a155
sub edx, 2
mov edi, dword [ebp - 8]
xor eax, eax
neg ecx
mov word [edx], ax
sbb ecx, ecx
and ecx, 0x7ff8ff86
add ecx, 0x8007007a
jmp 0x40a178
test esi, esi
je 0x40a178
xor edx, edx
mov word [eax], dx
test ecx, ecx
js 0x40a2a6
mov ebx, dword [ebp - 4]
jmp 0x40a18b
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], pe_nt_image_headers32
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x1c]
mov ecx, eax
cmp ecx, 0x103
jne 0x409fb0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40a28a
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [esi], eax
lea eax, [ebp - 0x28]
push 0x17
push eax
push ebx
push 0x404798
push 0x411728
mov dword [ecx], edi
call fcn.0040ab90
add esp, 0x18
test al, al
je 0x40a2a6
push dword [ebp + 8]
mov edi, dword [ebx]
mov bl, 1
mov esi, dword [esi]
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x40a2a8
cmp ecx, 2
jne 0x40a262
mov eax, dword [0x41172c]
test esi, esi
mov esi, dword [eax]
mov esi, dword [esi + 4]
mov ecx, esi
jne 0x40a24c
push edi
push 0x1e
push 0
push eax
call dword [0x412228]
call esi
add esp, 0x10
jmp 0x40a2a6
push dword [ebp - 0x28]
push edi
push 0x27
push 0
push eax
call dword [0x412228]
call esi
add esp, 0x14
jmp 0x40a2a6
push dword [ebp - 0x20]
push 0x14
mov edi, dword [0x41172c]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x412228]
mov ecx, edi
call esi
jmp 0x40a2a6
push 0x404708
push 0x13
jmp 0x40a267
mov eax, dword [0x41172c]
push 0x1d
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x412228]
call esi
add esp, 0xc
xor bl, bl
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40a2b6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40a2c7
push eax
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10