Function at 0x40bc67
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54d690
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x5a5fb0]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push esi
push edi
mov eax, dword [0x5a5fb0]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
call fcn.00405809
xor ebx, ebx
push ebx
lea edi, [esp + 0x28]
mov dword [esp + 0x20], eax
call fcn.004137e0
push ebx
lea edi, [esp + 0x38]
mov dword [esp + 0x2c4], ebx
call fcn.004137e0
lea eax, [esp + 0x44]
mov byte [esp + 0x2c0], 1
push eax
cmp byte [ebp + 8], bl
jne 0x40bd13
mov eax, dword [esp + 0x20]
call fcn.00405bc3
lea esi, [esp + 0x24]
mov byte [esp + 0x2c0], 2
call fcn.00413bb0
lea eax, [esp + 0x44]
mov byte [esp + 0x2c0], 1
call fcn.00413b10
push 0x57d7f0
mov eax, esi
jmp 0x40bd50
push dword [esp + 0x20]
call fcn.00405c32
lea esi, [esp + 0x24]
mov byte [esp + 0x2c0], 3
call fcn.00413bb0
lea eax, [esp + 0x44]
mov byte [esp + 0x2c0], 1
call fcn.00413b10
push 0x57d7fc
mov eax, esi
push eax
call fcn.004143e0
push 0x57d808
push eax
call fcn.004143e0
lea esi, [esp + 0x34]
call fcn.00413bb0
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov byte [esp + 0x2c0], 4
mov dword [esp + 0x20], 0x20019
call fcn.00405b59
test eax, eax
je 0x40bd90
mov dword [esp + 0x20], 0x20219
push 0x24
push 0x57d818
lea ecx, [esp + 0x6c]
call fcn.00408ba3
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
push ebx
push str.SOFTWAREIminent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40be80
push 0x206
mov word [esp + 0xa8], ax
lea eax, [esp + 0xaa]
push ebx
push eax
call fcn.005237f0
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x57d864
push dword [esp + 0x24]
mov dword [esp + 0x30], 0x208
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40be76
lea eax, [esp + 0xa4]
push eax
lea esi, [esp + 0x48]
call fcn.00408f69
mov eax, esi
push eax
lea eax, [esp + 0x84]
mov byte [esp + 0x2c4], 5
call fcn.0040cd42
pop ecx
mov esi, eax
lea edi, [esp + 0x64]
mov byte [esp + 0x2c0], 6
call fcn.0040887f
push ebx
push 1
lea ecx, [esp + 0x88]
call fcn.00405daf
push 1
xor edi, edi
lea esi, [esp + 0x48]
mov byte [esp + 0x2c4], 4
call fcn.004068d9
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x64]
lea esi, [esp + 0x44]
call fcn.00413940
push 0x57d884
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x2c8], 7
call fcn.004143e0
mov esi, eax
lea eax, [esp + 0x44]
call fcn.00413bb0
lea eax, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.00413b10
push 0x24
push 0x57d88c
lea ecx, [esp + 0x6c]
call fcn.00408ba3
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
push ebx
push str.SOFTWAREBeamrise
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bfb0
push 0x206
mov word [esp + 0xa8], ax
lea eax, [esp + 0xaa]
push ebx
push eax
call fcn.005237f0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push 0x57d8d8
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x208
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40bfa6
lea eax, [esp + 0xa4]
push eax
lea esi, [esp + 0x48]
call fcn.00408f69
mov eax, esi
push eax
lea eax, [esp + 0x84]
mov byte [esp + 0x2c4], 8
call fcn.0040cd42
pop ecx
mov esi, eax
lea edi, [esp + 0x64]
mov byte [esp + 0x2c0], 9
call fcn.0040887f
push ebx
push 1
lea ecx, [esp + 0x88]
call fcn.00405daf
push 1
xor edi, edi
lea esi, [esp + 0x48]
mov byte [esp + 0x2c4], 4
call fcn.004068d9
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x64]
lea esi, [esp + 0x44]
call fcn.00413940
push 0x57d8f8
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x2c8], 0xa
call fcn.004143e0
mov esi, eax
lea eax, [esp + 0x44]
call fcn.00413bb0
lea eax, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.00413b10
push 0x24
push str.00000000_0000_0000_0000_000000000000
lea ecx, [esp + 0x6c]
call fcn.00408ba3
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x24]
push ebx
push str.SOFTWAREMyCuteBuddy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c0e0
push 0x206
mov word [esp + 0xa8], ax
lea eax, [esp + 0xaa]
push ebx
push eax
call fcn.005237f0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push str.AppInstanceUid
push dword [esp + 0x24]
mov dword [esp + 0x2c], 0x208
mov dword [esp + 0x30], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c0d6
lea eax, [esp + 0xa4]
push eax
lea esi, [esp + 0x48]
call fcn.00408f69
mov eax, esi
push eax
lea eax, [esp + 0x84]
mov byte [esp + 0x2c4], 0xb
call fcn.0040cd42
pop ecx
mov esi, eax
lea edi, [esp + 0x64]
mov byte [esp + 0x2c0], 0xc
call fcn.0040887f
push ebx
push 1
lea ecx, [esp + 0x88]
call fcn.00405daf
push 1
xor edi, edi
lea esi, [esp + 0x48]
mov byte [esp + 0x2c4], 4
call fcn.004068d9
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x64]
lea esi, [esp + 0x44]
call fcn.00413940
push 0x57d978
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x2c8], 0xd
call fcn.004143e0
mov esi, eax
lea eax, [esp + 0x44]
call fcn.00413bb0
lea eax, [esp + 0x44]
mov byte [esp + 0x2c0], 4
call fcn.00413b10
cmp byte [ebp + 8], bl
jne 0x40c160
push 0x57d984
lea eax, [esp + 0x28]
push eax
call fcn.004143e0
mov esi, eax
lea eax, [esp + 0x34]
call fcn.00413bb0
sub esp, 0x10
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004139b0
mov ecx, dword [esp + 0x2c]
call fcn.00405b92
jmp 0x40c280
push str.Iminent
lea eax, [esp + 0x38]
push eax
call fcn.004143e0
mov edi, eax
push 0x57d990
lea eax, [esp + 0x28]
push eax
call fcn.004143e0
push 0x57d99c
push eax
call fcn.004143e0
push 0x57d9ac
push eax
call fcn.004143e0
mov esi, eax
mov eax, edi
call fcn.00413bb0
push str.Beamrise
lea eax, [esp + 0x38]
push eax
call fcn.004143e0
mov edi, eax
push 0x57d9bc
lea eax, [esp + 0x28]
push eax
call fcn.004143e0
push 0x57d9c8
push eax
call fcn.004143e0
push 0x57d9d8
push eax
call fcn.004143e0
mov esi, eax
mov eax, edi
call fcn.00413bb0
push str.MyCuteBuddy
lea eax, [esp + 0x38]
push eax
call fcn.004143e0
mov edi, eax
push str.EventStat
lea eax, [esp + 0x28]
push eax
call fcn.004143e0
push str.appInstanceUids
push eax
call fcn.004143e0
push 0x57da0c
push eax
call fcn.004143e0
mov esi, eax
mov eax, edi
call fcn.00413bb0
mov dword [esp + 0x80], vtable.Json::FastWriter.0
mov dword [esp + 0x98], 0xf
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
mov byte [esp + 0xa0], bl
sub esp, 0x1c
mov byte [esp + 0x2dc], 0xe
mov eax, esp
mov dword [esp + 0x30], esp
lea ecx, [esp + 0x40]
push ecx
push eax
lea ecx, [esp + 0xa4]
call fcn.0040e100
mov esi, dword [esp + 0x38]
call fcn.0040589f
lea ecx, [esp + 0x80]
call fcn.0040577b
push ebx
push 1
lea ecx, [esp + 0x6c]
call fcn.00405daf
lea eax, [esp + 0x34]
mov byte [esp + 0x2c0], bl
call fcn.00413b10
or dword [esp + 0x2c0], 0xffffffff
lea eax, [esp + 0x24]
call fcn.00413b10
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.0051f4ef
mov esp, ebp
pop ebp
ret