Function at 0x40dc80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x42a3ac]
xor eax, dword [esp + 0x218]
mov dword [esp + 4], 0
mov dword [esp + 0x214], eax
mov eax, 0x41f2bd
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dcb0
push ebx
push ebp
push esi
sub eax, edx
mov esi, eax
push edi
push esi
call fcn.00401db0
mov edi, dword [eax + 0x10]
mov ebx, dword [esp + 0x234]
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x41f2bd
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebx]
add esp, 4
cmp cl, 0x2f
mov dword [esp + 0x10], eax
je 0x40dd28
cmp cl, 0x5c
je 0x40dd28
mov ecx, dword [0x42b61c]
test ecx, ecx
je 0x40dd28
mov edx, dword [ecx + 0x10]
test edx, edx
je 0x40dd28
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd10
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00404730
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40dd8a
mov esi, dword [eax + 8]
test esi, esi
je 0x40dd8a
mov ecx, 0x421fa4
lea edi, [ecx + 1]
jmp 0x40dd40
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40dd40
sub ecx, edi
cmp esi, ecx
jl 0x40dd6d
mov eax, dword [eax + 0x10]
push ecx
sub eax, ecx
add eax, esi
push 0x421fa4
push eax
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
jne 0x40dd8a
push 0x422aec
lea ecx, [esp + 0x14]
call fcn.0040d010
test al, al
jne 0x40dd8a
push 0x2f
lea ecx, [esp + 0x14]
call fcn.00405be0
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dd90
sub eax, edx
push eax
push ebx
lea ecx, [esp + 0x18]
call fcn.00404730
push 0x422aec
push 0x421fa4
lea ecx, [esp + 0x18]
call fcn.00401f10
mov eax, 0x422aec
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ddc0
mov ebx, dword [esp + 0x10]
sub eax, edx
test ebx, ebx
je 0x40de22
mov ecx, dword [ebx + 8]
cmp ecx, eax
jl 0x40de22
push eax
sub ecx, eax
add ecx, dword [ebx + 0x10]
push 0x422aec
push ecx
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
je 0x40de22
mov esi, dword [ebx + 8]
lea edi, [esi - 1]
cmp esi, edi
jle 0x40de22
mov eax, dword [ebx + 0x10]
mov ecx, esi
sub ecx, esi
inc ecx
push ecx
lea edx, [eax + esi]
push edx
add eax, edi
push eax
call fcn.00412880
mov eax, dword [ebx + 8]
sub edi, esi
add esp, 0xc
add eax, edi
mov dword [ebx + 8], eax
mov eax, 0x422aec
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40de30
sub eax, edx
test ebx, ebx
je 0x40de81
cmp dword [ebx + 8], eax
jl 0x40de79
push eax
mov eax, dword [ebx + 0x10]
push 0x422aec
push eax
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
je 0x40de79
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 8]
push ecx
lea edx, [eax + 1]
push edx
push eax
call fcn.00412880
mov eax, dword [ebx + 8]
add esp, 0xc
dec eax
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0x10]
jmp 0x40de85
xor ecx, ecx
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
lea esi, [ecx + 1]
push esi
push eax
push 0
push 0xfde9
call ebp
mov edi, eax
lea eax, [edi + edi]
push eax
call fcn.004121c0
add esp, 4
test ebx, ebx
mov ecx, eax
mov dword [esp + 0x1c], ecx
je 0x40deba
mov eax, dword [ebx + 0x10]
jmp 0x40debc
xor eax, eax
push edi
push ecx
push esi
push eax
push 0
push 0xfde9
call ebp
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push 0
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e095
mov edx, dword [esp + 0x18]
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3a]
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40dfbf
lea esp, [esp]
mov eax, dword [esp + 0x10]
inc edi
inc eax
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
mov word [esp + 0x2c], 0x2f
call fcn.0040d060
add esp, 8
push 1
push 1
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00405500
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx + eax*4]
inc eax
test ecx, ecx
mov dword [ebp + 8], eax
je 0x40df74
test esi, esi
mov dword [ecx], esi
je 0x40df8f
mov eax, dword [esi + 4]
test eax, eax
js 0x40df74
inc eax
mov dword [esi + 4], eax
test esi, esi
je 0x40df8f
mov eax, dword [esi + 4]
test eax, eax
js 0x40df8f
dec eax
test eax, eax
mov dword [esi + 4], eax
jne 0x40df8f
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3a]
push ecx
push edi
push edx
mov dword [esp + 0x30], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40df20
jmp 0x40dfc3
mov ebp, dword [esp + 0x14]
xor edi, edi
push edi
push edi
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x38]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40e088
jmp 0x40dff0
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x28]
push edx
inc edi
call fcn.0040d060
add esp, 8
push 1
push 1
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00405500
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x10]
lea ecx, [ecx + eax*4]
inc eax
test ecx, ecx
mov dword [edx + 8], eax
je 0x40e038
test esi, esi
mov dword [ecx], esi
je 0x40e053
mov eax, dword [esi + 4]
test eax, eax
js 0x40e038
inc eax
mov dword [esi + 4], eax
test esi, esi
je 0x40e053
mov eax, dword [esi + 4]
test eax, eax
js 0x40e053
dec eax
test eax, eax
mov dword [esi + 4], eax
jne 0x40e053
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push 0
push 0
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x38]
push edx
push edi
push eax
mov dword [esp + 0x30], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40dff0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40e099
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push edx
call fcn.0041249e
mov esi, dword [esp + 0x230]
add esp, 4
test ebp, ebp
mov dword [esi], ebp
je 0x40e0be
mov eax, dword [ebp + 4]
test eax, eax
js 0x40e0be
inc eax
mov dword [ebp + 4], eax
test ebx, ebx
je 0x40e0d9
mov eax, dword [ebx + 4]
test eax, eax
js 0x40e0d9
dec eax
test eax, eax
mov dword [ebx + 4], eax
jne 0x40e0d9
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
test ebp, ebp
je 0x40e0f5
mov eax, dword [ebp + 4]
test eax, eax
js 0x40e0f5
dec eax
test eax, eax
mov dword [ebp + 4], eax
jne 0x40e0f5
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx]
mov ecx, dword [esp + 0x224]
xor ecx, dword [esp + 0x228]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x218
jmp fcn.00412490