Function at 0x4131af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
lea ecx, [ebp - 4]
mov dword [ebp - 0x1c], 1
call fcn.004069b2
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
call fcn.004069b2
call dword [0x42c090]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x41341d
push esi
push edi
push 0x4030dc
push 0x42cfe0
lea eax, [ebp + 8]
push eax
call fcn.004130f1
push eax
lea ecx, [ebp - 0x14]
call fcn.0041314c
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00406362
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
call fcn.0040e2a5
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 8]
push eax
mov edi, 0x20019
push edi
push ebx
push dword [ebp - 0x14]
mov dword [ebp + 8], 0x80004005
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp eax, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x20], eax
jne 0x4132c8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 4]
call fcn.00406a10
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x4021a4
push dword [ebp - 8]
call ebx
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call fcn.00407497
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.00406452
cmp dword [ebp - 0xc], 0
lea ecx, [ebp - 4]
jne 0x4132b1
push 0
call fcn.0040f977
mov eax, dword [ebp - 4]
cmp dword [eax - 0xc], 0
je 0x4132bb
and dword [ebp + 8], 0
jmp 0x4132bb
push 0x401ca4
call fcn.004090a6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
call fcn.00406928
cmp dword [ebp + 8], 0
jge 0x413372
lea ecx, [ebp - 0xc]
call fcn.004069b2
push 0x4030cc
lea ecx, [ebp - 0xc]
call fcn.00406a91
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.0040e2a5
push 0x4030ac
lea ecx, [ebp - 0xc]
call fcn.0040e2a5
lea eax, [ebp - 8]
push eax
push edi
xor edi, edi
push edi
push dword [ebp - 0xc]
push bind
call esi
test eax, eax
jne 0x4133ab
lea ecx, [ebp - 0x18]
mov eax, 0x104
push ecx
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], eax
call fcn.00406a10
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x4021a4
push dword [ebp - 8]
call ebx
push dword [ebp - 4]
mov esi, eax
call fcn.00407497
pop ecx
push eax
lea ecx, [ebp - 4]
call fcn.00406452
cmp esi, edi
lea ecx, [ebp - 4]
jne 0x41339f
push edi
call fcn.0040f977
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.00406362
mov edi, dword [ebp + 0xc]
and dword [ebp + 8], 0
mov ebx, 0x403df0
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 4]
push 0x4030a0
push esi
call fcn.0041cb5b
test eax, eax
pop ecx
pop ecx
jne 0x4133c4
mov esi, 0x403164
jmp 0x4133ff
push 0x401ca4
call fcn.004090a6
jmp 0x413367
cmp dword [ebp - 0x20], edi
je 0x413367
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
mov dword [ebp + 8], 0x80004005
call fcn.00406362
jmp 0x41341b
push 0x403098
push esi
call fcn.0041cb5b
test eax, eax
pop ecx
pop ecx
jne 0x4133dc
mov esi, 0x403154
jmp 0x4133ff
push 0x4021b4
push esi
call fcn.0041cb5b
test eax, eax
pop ecx
pop ecx
jne 0x4133f4
mov esi, 0x403144
jmp 0x4133ff
cmp dword [esi - 0xc], 0
jne 0x413406
mov esi, 0x403174
mov edi, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
push 4
pop ecx
mov edi, ebx
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x41341b
mov dword [ebp + 8], 0x80004005
pop edi
pop esi
cmp dword [ebp - 0x10], 0
pop ebx
je 0x41342d
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 8], 0
je 0x41343c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00406362
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.00406362
mov eax, dword [ebp + 8]
leave
ret 8