Function at 0x4089fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push 0x401aa4
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408a45
mov edx, dword [ebp - 0xc]
lea ecx, [edx - 3]
cmp ecx, 0x39
ja 0x408a58
mov dword [0x421e44], edx
jmp 0x408a60
cmp eax, 2
je 0x408a60
test eax, eax
jle 0x408a5a
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401ab4
push ebx
mov dword [ebp - 4], 4
call esi
cmp eax, 2
je 0x408a99
test eax, eax
je 0x408a99
jle 0x408a93
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
mov eax, dword [ebp - 0x10]
cmp eax, 3
jbe 0x408aa7
push 3
pop eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
cmp dword [edi], 0
je 0x408ad2
test eax, eax
jne 0x408ac8
xor esi, esi
inc esi
push esi
call fcn.00419610
push esi
push esi
call fcn.00419657
and dword [edi], 0
jmp 0x408afe
push 1
push eax
call fcn.00419657
jmp 0x408b04
test eax, eax
je 0x408b04
xor esi, esi
inc esi
push esi
push eax
call fcn.00419657
push esi
push 0
push 0x401ac8
push 0x401840
push 0
call fcn.00419528
test eax, eax
js 0x408cdf
mov dword [edi], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push 0x401ad0
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408b33
cmp dword [ebp + 8], eax
setne al
mov dword [0x421e48], eax
jmp 0x408b4e
cmp eax, 2
je 0x408b4e
test eax, eax
jle 0x408b48
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401aec
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408b7d
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x408b90
mov dword [0x421e4c], ecx
jmp 0x408b98
cmp eax, 2
je 0x408b98
test eax, eax
jle 0x408b92
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401b08
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408bc5
cmp dword [ebp + 8], eax
setne al
mov dword [0x421e50], eax
jmp 0x408be0
cmp eax, 2
je 0x408be0
test eax, eax
jle 0x408bda
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401b2c
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408c0f
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x408c22
mov dword [0x421e54], ecx
jmp 0x408c2a
cmp eax, 2
je 0x408c2a
test eax, eax
jle 0x408c24
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401b50
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408c57
cmp dword [ebp + 8], eax
setne al
mov dword [0x421e58], eax
jmp 0x408c6e
cmp eax, 2
je 0x408c6e
test eax, eax
jle 0x408c6c
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401b78
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408c9d
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x408cb0
mov dword [0x421e5c], ecx
jmp 0x408cb4
cmp eax, 2
je 0x408cb4
test eax, eax
jle 0x408cb2
and eax, 0xffff
or eax, 0x80070000
test eax, eax
js 0x408cdf
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x401ba0
push ebx
mov dword [ebp - 4], 4
call esi
test eax, eax
jne 0x408cdf
cmp dword [ebp + 8], eax
setne al
mov dword [0x421e60], eax
pop edi
pop esi
pop ebx
leave
ret 8