Function at 0x407530
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8dc
mov eax, dword [0x41a190]
xor eax, esp
mov dword [esp + 0x8d8], eax
push ebx
push ebp
push esi
push edi
push 0x422bc8
mov esi, ecx
xor edi, edi
call fcn.00401580
push eax
push esi
call fcn.004065a0
push 0x422b98
call fcn.00401580
push eax
push esi
call fcn.004065a0
add esp, 0x18
lea eax, [esp + 0x18]
push eax
push 0x20019
push edi
push 0x422b48
call fcn.00401580
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebx, 0x400
jne 0x4076e3
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x4ec]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xfc]
push edx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
jne 0x4076d6
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x4e8]
push ecx
push edx
lea eax, [esp + 0xf0]
push eax
push 0x422b30
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0x14
lea ecx, [esp + 0x4e8]
push ecx
push 0x422b00
call fcn.00401580
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
call fcn.004060b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x80000002
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x40766c
push eax
push 0x422acc
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
lea eax, [esp + 0xe8]
push eax
push 0x422aa4
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
lea ecx, [esp + 0xe8]
push ecx
mov ecx, esi
call fcn.00406de0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x4ec]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xfc]
push eax
add edi, 1
push edi
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
je 0x4075e0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4076fb
push eax
push 0x422a78
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
push 0x422a44
call fcn.00401580
push eax
push esi
call fcn.004065a0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push 0x422b48
call fcn.00401580
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407882
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x4ec]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0xfc]
push edx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
jne 0x407875
jmp 0x407780
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x4e8]
push ecx
push edx
lea eax, [esp + 0xf0]
push eax
push 0x422b30
call fcn.00401580
add esp, 4
push eax
call fcn.004060b0
add esp, 0x10
lea ecx, [esp + 0x4e8]
push ecx
push 0x422b00
call fcn.00401580
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
call fcn.004060b0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x28]
push edx
push 0x80000001
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x40780b
push eax
push 0x422acc
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
lea eax, [esp + 0xe8]
push eax
push 0x422aa4
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
lea ecx, [esp + 0xe8]
push ecx
mov ecx, esi
call fcn.00406de0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x4ec]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0xfc]
push eax
add edi, 1
push edi
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call ebp
test eax, eax
je 0x407780
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40789a
push eax
push 0x422a18
call fcn.00401580
add esp, 4
push eax
push esi
call fcn.004065a0
add esp, 0xc
mov ecx, dword [esp + 0x8e8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040acd2
add esp, 0x8dc
ret