Function at 0x4010d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x642c
call fcn.004076f0
mov eax, dword [0x40d044]
xor eax, esp
mov dword [esp + 0x6428], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx + 0x40dcb0]
push 0x5c
push eax
call fcn.0040162b
mov edi, eax
mov eax, dword [ebx + 0x40dcb0]
mov esi, edi
sub esi, eax
sar esi, 1
push esi
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.00401651
mov eax, dword [ebx + 0x40dcb0]
add esp, 0x14
xor edx, edx
push 0x2a
push eax
mov word [esp + esi*2 + 0x28], dx
call fcn.0040162b
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
neg esi
mov dword [esp + 0xc], esi
jne 0x401172
lea eax, [edi + 2]
lea edx, [esp + 0x430]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401154
xor ecx, ecx
mov word [esp + 0x2430], cx
jmp 0x401201
mov edx, dword [ebx + 0x40dcb0]
push 0x2a
push edx
call fcn.0040162b
mov ebx, eax
mov esi, ebx
sub esi, edi
sub esi, 2
sar esi, 1
dec esi
push esi
add edi, 2
lea eax, [esp + 0x43c]
push edi
push eax
call fcn.00401651
xor ecx, ecx
lea eax, [ebx + 2]
lea edx, [esp + 0x2444]
add esp, 0x14
mov word [esp + esi*2 + 0x430], cx
sub edx, eax
jmp 0x4011c0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4011c0
lea eax, [esp + 0x2430]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011e0
mov esi, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x2430], dx
xor edi, edi
mov ecx, str.HKEY_CLASSES_ROOT
lea eax, [esp + 0x20]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401236
test dx, dx
je 0x401232
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401236
add eax, 4
add ecx, 4
test dx, dx
jne 0x401210
xor eax, eax
jmp 0x40123b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401249
mov edi, 0x80000000
jmp 0x401346
mov ecx, str.HKEY_CURRENT_CONFIG
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401278
test dx, dx
je 0x401274
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401278
add eax, 4
add ecx, 4
test dx, dx
jne 0x401252
xor eax, eax
jmp 0x40127d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40128b
mov edi, 0x80000005
jmp 0x401346
mov ecx, str.HKEY_CURRENT_USER
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4012ba
test dx, dx
je 0x4012b6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4012ba
add eax, 4
add ecx, 4
test dx, dx
jne 0x401294
xor eax, eax
jmp 0x4012bf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4012ca
mov edi, 0x80000001
jmp 0x401346
mov ecx, str.HKEY_LOCAL_MACHINE
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4012f9
test dx, dx
je 0x4012f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4012f9
add eax, 4
add ecx, 4
test dx, dx
jne 0x4012d3
xor eax, eax
jmp 0x4012fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401309
mov edi, 0x80000002
jmp 0x401346
mov ecx, str.HKEY_USERS
lea eax, [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401338
test dx, dx
je 0x401334
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401338
add eax, 4
add ecx, 4
test dx, dx
jne 0x401312
xor eax, eax
jmp 0x40133d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401346
mov edi, 0x80000003
test esi, esi
jne 0x401360
lea eax, [esp + 0x430]
push eax
push edi
call fcn.004014a0
add esp, 8
jmp 0x401471
lea ecx, [esp + 0x14]
push ecx
push 0xf013f
push 0
lea edx, [esp + 0x43c]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401471
xor ebx, ebx
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x234]
push edx
push ebx
push eax
mov dword [esp + 0x2c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40146d
inc ebx
mov dword [esp + 0xc], 0x105
xor eax, eax
jmp 0x4013d0
movzx ecx, word [esp + eax + 0x220]
mov word [esp + eax + 0x4430], cx
add eax, 2
test cx, cx
jne 0x4013d0
lea eax, [esp + 0x2430]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013f1
lea edi, [esp + 0x4430]
sub eax, edx
add edi, 0xfffffffe
jmp 0x401410
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401410
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4430]
push ecx
push edx
call fcn.004014a0
add esp, 8
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x234]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4013b6
mov ebx, dword [esp + 0x10]
add ebx, 4
mov dword [esp + 0x10], ebx
cmp ebx, 0x54
jb 0x4010f7
mov ecx, dword [esp + 0x6434]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040161c
mov esp, ebp
pop ebp
ret