Function at 0x40b9dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40b9e4
call fcn.004c0cc0
push dword [esp + 0x50]
call fcn.0049c2e0
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.0049c000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.0049c000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x40ba35
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004bdf70
call fcn.004c0c50
mov edx, 0x57f2a2
pop ecx
push ecx
call fcn.0049c340
mov ecx, eax
call fcn.0049c350
je 0x40ba9d
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 8]
call fcn.004be4e0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004be510
lea eax, [esp + 4]
push eax
call fcn.004c0b60
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004be510
call fcn.004c0c50
mov edx, 0x57f2a2
pop ecx
push ecx
call fcn.0049c340
mov ecx, eax
call fcn.0049c350
je 0x40bb05
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 8]
call fcn.004be4e0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004bdf70
lea eax, [esp + 4]
push eax
call fcn.004c0b60
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40bb20
push 0x58e794
push 0x24
push dword [esp + 0x54]
call fcn.004bf9d0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40bbaa
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40bb78
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040c2ef
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004c0b60
cmp dword [esp + 0x14], 0
je 0x40bb88
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x57e040
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
pop eax
push eax
call fcn.0049c2b0
pop edx
add eax, edx
jmp 0x40c2cd
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40bc33
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40bc08
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040c2ef
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004c0b60
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x57e040
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
pop eax
push eax
call fcn.0049c2b0
pop edx
add eax, edx
jmp 0x40c2cd
cmp dword [esp + 0x20], 0
je 0x40bc9e
push dword [esp + 0x20]
call fcn.004bfa20
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x40bc9e
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40bc73
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.0049c008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x57e040
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
pop eax
push eax
call fcn.0049c2b0
pop edx
add eax, edx
jmp 0x40c2cd
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x40bd2f
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40bd04
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040c2ef
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004c0b60
push dword [esp + 0x1c]
call fcn.004bfa40
mov edx, 0x57e040
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
pop eax
push eax
call fcn.0049c2b0
pop edx
add eax, edx
jmp 0x40c2cd
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40bd43
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp], eax
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40bf34
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x40be0e
mov dword [esp + 0x30], 0
jmp 0x40bd6f
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x40be09
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
mov edx, 0x57e7ba
push edx
call fcn.004c0bf0
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
mov eax, 0x57ea1a
push eax
push 2
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004bfa60
cdq
push edx
push eax
call fcn.004be670
call fcn.0049c2c2
add dword [esp], edx
call fcn.004be6f0
pop eax
mov edx, 0x57e964
push edx
call fcn.004c0bf0
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
inc dword [esp + 0x30]
jno 0x40bd6f
jmp 0x40beb2
mov dword [esp + 0x30], 0
jmp 0x40be18
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x40beb2
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
mov edx, 0x57e7ba
push edx
call fcn.004c0bf0
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
mov eax, 0x57ea1a
push eax
push 2
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004bfa60
cdq
push edx
push eax
call fcn.004be670
call fcn.0049c2c2
add dword [esp], edx
call fcn.004be6f0
pop eax
mov edx, 0x57e964
push edx
call fcn.004c0bf0
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
inc dword [esp + 0x30]
jno 0x40be18
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0x18]
call fcn.004be4e0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004bdf70
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40bf02
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x1c], eax
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x54]
call fcn.0049c2e0
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
pop eax
push eax
call fcn.0049c2b0
pop edx
add eax, edx
add esp, 4
jmp 0x40c2cd
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40bf95
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40bf64
push dword [esp + 0x20]
pop eax
call fcn.0049c2a0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0x28]
pop eax
call fcn.0049c2a0
cdq
push edx
push eax
call fcn.004be120
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
jmp 0x40c29b
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40c05d
push 0
push 0
push dword [esp + 0x28]
call dword [0x63b58c]
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x40c058
push dword [esp + 0x28]
call fcn.004bfa20
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x40c056
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call dword [0x63b58c]
and eax, eax
je 0x40c04d
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0x34]
call fcn.004bfa70
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40c04d
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004c0b60
push dword [esp + 0x10]
call fcn.004be4e0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.004bfa40
jmp 0x40c058
jmp 0x40c29b
mov ebx, 7
cmp ebx, dword [esp]
jne 0x40c1d5
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x40c12f
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.004bfac0
call fcn.004c0c50
mov edx, 0x57e040
pop ecx
push ecx
call fcn.0049c340
mov ecx, eax
call fcn.0049c350
je 0x40c0df
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
mov edx, 0x57e2bc
push edx
call fcn.004c0bf0
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
jmp 0x40c11f
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.004bfac0
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
jmp 0x40c06b
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.004be510
call fcn.004c0c50
mov edx, 0x57e2bc
pop ecx
push ecx
call fcn.0049c340
mov ecx, eax
call fcn.0049c350
je 0x40c197
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0x18]
call fcn.004be4e0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004bdf70
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40c1d0
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004c0b60
push dword [esp + 0x10]
call fcn.004be4e0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
jmp 0x40c29b
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x40c235
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40c209
push dword [esp + 0x20]
call fcn.004bfb30
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0x28]
call fcn.004bfb30
push edx
push eax
call fcn.004be120
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
jmp 0x40c29b
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40c29b
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0b20
pop edx
push eax
push dword [esp + 0x28]
call fcn.004bfa70
lea eax, [esp + 0x14]
push eax
call fcn.004c0b60
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40c29b
mov edx, dword [esp + 0x10]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004c0b60
push dword [esp + 0x10]
call fcn.004be4e0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.004bfa40
mov edx, dword [esp + 0xc]
push edx
call fcn.004c0b20
pop edx
push eax
push edx
call fcn.004c0bf0
pop eax
push eax
call fcn.0049c2b0
pop edx
add eax, edx
jmp 0x40c2cd
push dword [esp]
call fcn.004c0d20
push dword [esp + 0xc]
call fcn.004c0d20
push dword [esp + 4]
call fcn.004c0d20
add esp, 0x30
pop ebx
pop ebp
ret 0x14