Function at 0x10400cf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1079e94]
and dword [ebp - 0x410], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x410]
push ecx
push 9
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
push esi
push eax
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
mov ebx, 0x1003410
je 0x1040136
push edi
push 0x100cea8
call fcn.0101c17b
push edi
push 0x3a6013a
push esi
jmp 0x10403c7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x100ce90
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], 0x400
call esi
mov edi, eax
test edi, edi
je 0x104018b
push edi
push 0x100ce70
call fcn.0101c17b
push edi
push 0x3b6013a
push 0x100ce90
jmp 0x10403c7
mov eax, dword [ebp - 0x40c]
shr eax, 1
and word [ebp + eax*2 - 0x408], 0
push 0x897
call fcn.01052a94
push eax
call fcn.0105b329
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
push 0x100ce5c
call fcn.0105b329
add esp, 0x10
push 0x892
call fcn.01052a94
push eax
call fcn.0105b329
lea eax, [ebp - 0x408]
push eax
push 0x1006b60
call fcn.0105b329
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x100ce4c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], 0x201
call esi
mov edi, eax
test edi, edi
je 0x1040238
push edi
push 0x100ce70
call fcn.0101c17b
push edi
push 0x3cc013a
push 0x100ce4c
jmp 0x10403c7
lea eax, [ebp - 0x408]
push eax
push 0x898
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x100ce3c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], 0x201
call esi
mov edi, eax
test edi, edi
jne 0x10402be
lea eax, [ebp - 0x408]
push eax
push 0x1001b30
call fcn.0105b329
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.0103ff44
mov edi, eax
test edi, edi
je 0x10402e1
push edi
push 0x3e0013a
call fcn.01053610
jmp 0x10402e1
cmp edi, 2
jne 0x10403a2
push 0x884
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
pop ecx
pop ecx
xor edi, edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x100ce24
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], 0x201
call esi
mov esi, eax
test esi, esi
jne 0x104034e
lea eax, [ebp - 0x408]
push eax
push 0x1001b30
call fcn.0105b329
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.0103fed9
mov esi, eax
test esi, esi
je 0x104036d
push esi
push 0x3fd013a
lea eax, [ebp - 0x408]
push eax
call fcn.0105364b
jmp 0x104036d
cmp esi, 2
jne 0x1040375
push 0x886
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
pop ecx
pop ecx
xor esi, esi
test edi, edi
jne 0x10403cc
mov edi, esi
jmp 0x10403cc
push esi
push 0x885
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
add esp, 0xc
test edi, edi
jne 0x1040395
mov edi, esi
push esi
push 0x40d013a
push 0x100ce24
jmp 0x10403c7
push edi
push 0x885
call fcn.01052a94
push eax
call fcn.0105b329
push ebx
call fcn.0105b329
add esp, 0xc
push edi
push 0x3ec013a
push 0x100ce3c
call fcn.0105364b
push ebx
call fcn.0105b329
cmp dword [ebp - 0x410], 0
pop ecx
je 0x10403e8
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0xc