Function at 0x40aa90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b838
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x40
mov eax, dword [0x491870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x18]
call fcn.004095e0
lea ecx, [ebp - 0x18]
call fcn.0040b860
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [ebp - 0x44], str.WAWgamvBRUWIBaaGyWWejTX9DtJxrbehK2VEEIq6Bd5pcF4TFHUrwND8d4xpvzIsbrLwcR0hm3tsaGqsjr2ukzutMAS0wOrKFQYioDFnzCuG2W3aTUsX77vWwKx5Arse4eRgVwqcByOi1iJSaQ5kq4bRsFyJucN5xwruJLM6I0nLXPjzhSBPYJv9yVenD1zxHCwWLiK32vlTmRzhMDrzza1iCA8I62PUzlImdIQyA5aRkRo6DGPsd6Kmp76PxBIDvvkjkp9KicA9DxDf9yIfYWh0wsg8khkbjPteAnbjWMAxFNbX2GSv8SDsr2WjpMN5732lxn3vhdqbuJUBqxME5HqvBhbWsH3O7Eui4cnlJA7HUTpS4l3qv183Ka65Twsqu6oiNna374hUpH3JHMpG1bBLnYbyBkOhRpzxY1k43dda0WW773JoqduyJzweEQOkOKHMfDlbkmyYiNIvHx1JALTweiNOA8w87hyaawyktpuMgDl45GhjjhPSX2gWnuhVGcVchJ4yEIPTob4A4WE5lV54JbJ9ttMyIIKP56R5NcVyAmwuFNlqqFhy3CCNKU5wA31m0bJfvgKOdnEP6IB6dcS38NTczUwYRrMuskjx5ONG5IImNbOfj2clRE9xJPLGj9ckLE2Aylc2u9jopIoqkninTBvStiP5Uqtlg4aaCLAE9DmVIPQxLhagxFFdvc5dRXTGrDRoV2iWXh06DzKyG6wgnT8HPzjdd8usOKxxdCvft94FDLd4AUhpb4vEknB5ct5oSNrG6c22YsNJHFQbG9rWJSeH5TxOn3bY0xW9hmpsi66z13zpMXltsVazRFTAiVCyyvQ4ESVMnz3N1KjMzy0gutQLbiTjRNpwoeIB6PlDHzgbkmtYqrmnC73ATBc66MJLedvlHJLBAg47yM3E2O2vOwp80fsiaBPeaWUFMRSO9h3oWa0ytUjda257jkEASgUUJQoLJbP2rJ38nMjuaRjRTHLNAr11HUfXOhbG7kkyoabJpd0lYLUGokE3tA2UJW4xHzhiDGyhQzO0ba469FJFblrhsgtWJVFT6Yrh8kfFvpBYvyyOizaGTWmuXom94Flo2LdaA1CLXzr6QwvBrrnqn0ahimYNJ8or06Si6drdKrv7jq1GYbipx47OD0TArv8wQ8vQW8YbdOf584yuxoCUdVvNTTmTjvHYvKtxVgGQWxoxhbUuTIxJbX0I9rrWyRUTNXpX15TuSrbrUHdXjwl6CcHwWmwI8ze9jdtpYULpeASOzEwC732rAhFQnpi1YJ1abGqX5erIytEQ6J8aMTzWXYFR5fSVo5VrGXWskAL86q71GftkP7SCse9ejpTNW2Ns7YGvBKkMCGl2R9fQS3QaB4g8QkmfBACJQ5erBAnosnQTt3kvBwh4LHSh7lN9BqDKo19qS8RaxxBRFcN5LIWC8szS4EaCxRh5hSVlLwvOo44uYsVlccBPJPCGfnP6kQbg9e2Qr4CB6L6xdmd7OUVwpr0VMvHfc0bRGWS
mov dword [ebp - 0x3c], str.hfAdndRPjWEviBGkxWdJzQXAcPK0pYoAw7MeemAci7Um5oB0qWp90uXKH6jSturNu1bRYcfbAjkMAsKD20DMCjXp7fXukGpLhk8DIezwkXkMmvVb
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.0040b880
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40ab6d
push 0x44aba4
mov ecx, dword [ebp + 8]
call fcn.0040b8a0
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b840
mov eax, dword [ebp + 8]
jmp 0x40ad18
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.004034e0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x48], str.Klv1D2rcfNfDNTCAy6DMPPiBIYpgJtt5m1ov8C1ByLILlhQiueoSdJp5V55AFJlxwboreEIkR3kfeOkbsr34TQoqpW3Og1G8VHxoMMJHN7emUgxf
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.0040ba10
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.004034e0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040ba60
cmp dword [ebp - 0x38], 0
je 0x40ac3a
mov dword [ebp - 0x50], str.EdQJ5g0hRbWvj3AXrxeD0ciKpUc4WCe0zdEv96WzR5jB17vaKyNMgHM1mHTzMngrni7wabSGPCCIbEtrFmqNW4hX8qTA2xVIUYEechFvepCVcWUjBtxj8Y6AtrKaN2R9GigWMvABH07Ko66rGTbPinSvq43IaytcWLuTVbab52335U6BKdWNrvCXaFu78C0uCswe5Ti3q6m7u2OJmt4vXPCT5EQxGqvLlW3U8ydHYR8BOO1UHffaL7vONoXCK0UVtjoQqgtfdWuyfpemLCRRamgW7iMmc7X139qPLpVrL3EsPHSpceQAVS962Mh9RicbNzCxqHNGwPT7GncyjaFcjcMJMjV9aNOFBnysvFnOiLySSAiW2WMdkRCaI2aioIeXyJmxuRm5J8hrvNCevSrbNB4Xx63griWIBHVfNHiFynmwt1oSF4x9rNTpd84JDzYtnQ2tK19KxM86pIQBOon1zr2wVsQqoWmylT1CcvkLMj580LgP6SXb6rSFe5j4bgY3NF2zAKHsKuWA2rKOqI0zvBhqWEtnzHLNSaQNVhBLcyEsmlrwDbUDQBvDisE7dSypwu2dQqMXdlkMUyrGjJNjM1ltJoj4PLahvWKivutydmizHvJPUXu4wjYi938YeKkyrVW1FDmjYJ6ROYleHBvTPP4LGB0HhzK8LYfRETAhydsJrebWMw4i9QIOPU11Uq7HJMXQpeIKnfkfMP8L5J7hmuvDpsrLdP1Hrd8uosOiaRQudN2hlngn2LrFAlNNgJ2lObuPGimM0Lny6vGPaKQDhCYEOnMYgsFBAPtqVoihfirAUIPwWhUCKP3yUUhbtJqelqemnd1bDpNIgCcdVydpK93D23ojfFGHulzcNbn7eJq6IKozchaB77LpBqsf0KSjg752ByHXowsS343XDjVigfwFqoWWfTj5HqYvJxIUOGgg1SIBXDm7aS2sDUBmzngPH5eJJcFozKorvWUoJo0crju6FBkpCQX803unItc6YTDDsn73kR7deFw9SfhBJcPyUwaEQdivfRFs7Sj5meKtlp0jvg0lSQ6JhFVv8uyMw4AN0nRSWUQFAqKtc0cqNyDPCYd40puznxq6T6k8swQ7lyfYOD98eW4Fxq6OpztD5oYtPYJUEEeSyr3zvIKVVJl4pLSYNaKd93NhN2wf3KyPGkCsE3AvIIRKoBXvbVuYkg01Slu8T6yuIYliUOQKnMospoSY2dL4F7lr64StgM739MrcduoKIT5P8omKlUv4uYeuyshcXKdr1G4HJUHNA5tuYFbQEyx0mDKjkQG6yK3kOeeQVeSnOrv1bam00bBn79zfwDt0olR1CvQ7xUHchbwTICYDVri9PR2PgjqEA8mfB5WBqy8kd8LLFUNM2gLrqzp6HyKOCFRx3zMvLLLAc3GUC66EkrxToMX8UciEvNANxTp54KashfCjFtTVFJCBXt1pdj1AB6W0sF9LXDuFFx4kg82xWACkf0Sn4kt7xDEsLFj8xyGPGs30IAzGID5SIJCf9nEeQVDQ6ThLcAtmNf7RhRPXcJEaiX69ei9xXX88HxnmMIjvDPj52psfcVUaeUTXhBYfa9CCv11GvXslVRdo16hJdtxWcOorlzK8FlQV3TyB0dSLBFT46is2lPaDeNK9D8xuyTQ3u2s1fmpwE
push 0x44ad54
mov ecx, dword [ebp + 8]
call fcn.0040b8a0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b840
mov eax, dword [ebp + 8]
jmp 0x40ad18
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b880
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b840
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b840
mov eax, dword [ebp + 8]
jmp 0x40ad18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004136d5
mov esp, ebp
pop ebp
ret 0x10