Function at 0x40de30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f065
mov eax, dword fs:[0]
push eax
sub esp, 0x670
mov eax, dword [0x43c3f4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x624], ecx
mov dword [ebp - 4], 0
mov edx, dword [0x43d174]
mov eax, dword [edx + 0xc]
mov ecx, 0x43d174
call eax
add eax, 0x10
mov dword [ebp - 0x634], eax
mov byte [ebp - 4], 1
mov edx, dword [0x43d174]
mov eax, dword [edx + 0xc]
mov ecx, 0x43d174
call eax
add eax, 0x10
mov dword [ebp - 0x628], eax
lea ecx, [ebp - 0x62c]
push ecx
push 0xf003f
push 0
push ebx
mov byte [ebp - 4], 2
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
call edi
test eax, eax
je 0x40defe
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x628]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40e632
push 0
push 0
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x65c]
push edx
lea eax, [ebp - 0x678]
push eax
mov eax, dword [ebp - 0x62c]
push 0
lea ecx, [ebp - 0x660]
push ecx
lea edx, [ebp - 0x668]
push edx
push 0
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40e308
mov eax, dword [ebp - 0x668]
dec eax
mov dword [ebp - 0x630], eax
js 0x40e2fb
mov eax, dword [ebp - 0x630]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x67c]
push ecx
mov ecx, dword [ebp - 0x62c]
lea edx, [ebp - 0x61c]
push edx
push eax
push ecx
mov dword [ebp - 0x67c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [ebp - 0x61c]
push edx
push ebx
lea eax, [ebp - 0x41c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x644]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x41c]
push edx
push esi
call edi
test eax, eax
jne 0x40e2ef
push eax
push eax
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x65c]
push ecx
lea edx, [ebp - 0x678]
push edx
mov edx, dword [ebp - 0x644]
push 0
lea eax, [ebp - 0x660]
push eax
lea ecx, [ebp - 0x66c]
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x40e2ef
cmp dword [ebp - 0x66c], eax
je 0x40e04c
mov eax, dword [ebp + 0x18]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x63c], esp
mov edi, esp
call fcn.0040d9b0
mov ecx, dword [ebp - 0x620]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [ebp - 0x624]
push eax
push ecx
lea edx, [ebp - 0x41c]
push edx
push esi
call fcn.0040de30
add esp, 0x14
jmp 0x40e2d0
mov edx, dword [ebp - 0x644]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push edx
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x650], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40e2d0
mov esi, dword [ebp - 0x620]
lea eax, [ebp - 0x41c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e0a0
sub eax, edx
lea ecx, [ebp - 0x41c]
sar eax, 1
push ecx
lea edx, [ebp - 0x634]
push edx
mov ebx, eax
call fcn.0040d810
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e0d0
sub eax, edx
lea ecx, [ebp - 0x21c]
sar eax, 1
push ecx
lea edx, [ebp - 0x628]
push edx
mov ebx, eax
call fcn.0040d810
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0x648]
push ecx
mov ebx, 0x4347dc
call fcn.0040d580
lea edx, [ebp - 0x634]
push edx
lea ecx, [ebp - 0x654]
push ecx
mov ebx, eax
mov byte [ebp - 4], 3
call fcn.00415010
push eax
lea edx, [ebp - 0x640]
push edx
mov ebx, 0x4347dc
mov byte [ebp - 4], 4
call fcn.0040d580
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x674]
push edx
mov ebx, eax
mov byte [ebp - 4], 5
call fcn.00415010
add esp, 0x20
mov byte [ebp - 4], 6
mov ebx, dword [esi + 4]
mov edi, dword [eax]
mov dword [ebp - 0x63c], ebx
cmp ebx, dword [esi + 8]
jb 0x40e17e
mov esi, dword [ebp - 0x620]
lea eax, [ebx + 1]
call fcn.00415560
test al, al
je 0x40e36f
mov eax, dword [esi]
lea ebx, [eax + ebx*4]
mov dword [ebp - 0x664], ebx
mov byte [ebp - 4], 7
test ebx, ebx
je 0x40e199
push ebx
mov ecx, edi
call fcn.0040d440
mov edi, 1
add dword [esi + 4], edi
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x674]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e1ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e213
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x648]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e239
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x628]
mov ebx, dword [eax + 4]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x63c], edx
cmp ebx, dword [eax + 8]
jb 0x40e278
mov esi, dword [ebp - 0x624]
lea eax, [ebx + 1]
call fcn.00415630
test al, al
je 0x40e36f
mov esi, dword [ebp - 0x620]
mov eax, dword [ebp - 0x624]
mov ecx, dword [eax]
lea ebx, [ecx + ebx*8]
test ebx, ebx
je 0x40e289
fild dword [ebp - 0x63c]
fstp qword [ebx]
add dword [eax + 4], edi
mov eax, dword [ebp - 0x638]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x650]
push edx
mov edx, dword [ebp - 0x644]
lea ecx, [ebp - 0x21c]
add eax, edi
push ecx
push eax
push edx
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x650], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40e093
mov eax, dword [ebp - 0x644]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x658]
mov esi, dword [ebp - 0x64c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
dec dword [ebp - 0x630]
jns 0x40df55
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x62c]
push edx
push 0xf003f
push 0
push ebx
push esi
call edi
mov edx, dword [ebp - 0x62c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push 0
push edx
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x630], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40e60b
mov esi, dword [ebp - 0x620]
mov edi, dword [ebp - 0x658]
test edi, edi
jne 0x40e379
xor eax, eax
jmp 0x40e38f
push 0x8007000e
call fcn.0040cd60
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e380
sub eax, edx
sar eax, 1
push edi
lea ecx, [ebp - 0x634]
push ecx
mov ebx, eax
call fcn.0040d810
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e3a7
sub eax, edx
lea edx, [ebp - 0x21c]
sar eax, 1
push edx
lea ecx, [ebp - 0x628]
push ecx
mov ebx, eax
call fcn.0040d810
lea edx, [ebp + 0x18]
push edx
lea eax, [ebp - 0x654]
push eax
mov ebx, 0x4347dc
call fcn.0040d580
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x648]
push edx
mov ebx, eax
mov byte [ebp - 4], 8
call fcn.00415010
push eax
lea eax, [ebp - 0x63c]
push eax
mov ebx, 0x4347dc
mov byte [ebp - 4], 9
call fcn.0040d580
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x64c]
push edx
mov ebx, eax
mov byte [ebp - 4], 0xa
call fcn.00415010
add esp, 0x20
mov byte [ebp - 4], 0xb
mov ebx, dword [esi + 4]
mov edi, dword [eax]
mov dword [ebp - 0x664], ebx
cmp ebx, dword [esi + 8]
jb 0x40e455
mov esi, dword [ebp - 0x620]
lea eax, [ebx + 1]
call fcn.00415560
test al, al
je 0x40e36f
mov eax, dword [esi]
lea ebx, [eax + ebx*4]
mov dword [ebp - 0x640], ebx
mov byte [ebp - 4], 0xc
test ebx, ebx
je 0x40e4d8
mov edx, dword [0x43d174]
mov eax, dword [edx + 0xc]
mov ecx, 0x43d174
call eax
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 0xd
test edi, edi
je 0x40e4af
test edi, 0xffff0000
jne 0x40e4b3
movzx edi, di
push edi
call fcn.0040cde0
add esp, 4
test eax, eax
je 0x40e4d8
push eax
mov eax, edi
mov edi, ebx
call fcn.0040d6c0
mov esi, dword [ebp - 0x620]
jmp 0x40e4d8
xor eax, eax
jmp 0x40e4cf
mov eax, edi
lea edx, [eax + 2]
jmp 0x40e4c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e4c0
sub eax, edx
sar eax, 1
push edi
push ebx
mov ebx, eax
call fcn.0040d810
mov ebx, 1
add dword [esi + 4], ebx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e506
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e52c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x648]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e552
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x654]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e578
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x624]
mov ecx, dword [ebp - 0x628]
mov edi, dword [eax + 4]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x640], edx
cmp edi, dword [eax + 8]
jb 0x40e5b3
mov esi, dword [ebp - 0x624]
lea eax, [edi + 1]
call fcn.00415630
test al, al
je 0x40e36f
mov eax, esi
mov esi, dword [ebp - 0x620]
mov ecx, dword [eax]
lea edi, [ecx + edi*8]
test edi, edi
je 0x40e5c4
fild dword [ebp - 0x640]
fstp qword [edi]
add dword [eax + 4], ebx
mov eax, dword [ebp - 0x638]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x630]
push edx
mov edx, dword [ebp - 0x62c]
lea ecx, [ebp - 0x21c]
add eax, ebx
push ecx
push eax
push edx
mov dword [ebp - 0x638], eax
mov dword [ebp - 0x630], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40e361
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x628]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e63e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e664
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x18]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e68a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419bd7
mov esp, ebp
pop ebp
ret