Function at 0x409e70
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbf8
mov eax, dword [0x4703d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xbec], ecx
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0xbf8], esi
mov dword [ebp - 0xbe0], ebx
je 0x40a1cc
cmp eax, ebx
je 0x40a1cc
mov ecx, dword [ebp + 0x10]
mov edx, dword [eax]
push ecx
push ebx
push edx
call fcn.0043c140
push str.MfeEnumDependentServices:_n
call fcn.0040ef30
add esp, 0x10
mov dword [ebp - 0xbdc], ebx
mov dword [esi], ebx
call fcn.00402fe0
mov esi, eax
cmp esi, ebx
je 0x409f02
cmp esi, 0xffffffff
je 0x409f02
push ebx
lea eax, [ebp - 0xbe4]
push eax
push ebx
push ebx
push ebx
push ebx
push 0x9edb6510
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
lea ecx, [ebp - 0xbdc]
push ecx
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServices
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, ebx
mov edi, eax
je 0x409f32
cmp esi, 0xffffffff
je 0x409f32
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x40a1ae
cmp dword [ebp - 0xbdc], ebx
je 0x40a1ae
call fcn.00402fe0
mov esi, eax
push esi
call fcn.00403050
mov eax, dword [ebp - 0xbdc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0xbe8]
push edx
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0xbe8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x409faf
push str.MfeEnumDependentServices:_could_not_get_info_for_services_key_n
call fcn.0040ef30
mov ecx, dword [ebp - 0xbdc]
push ecx
call fcn.0042a5f0
add esp, 8
push esi
call fcn.00403030
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0x10
push esi
call fcn.00403030
xor esi, esi
mov dword [ebp - 0xbf0], 0x200
call fcn.00402fe0
mov edi, eax
push edi
mov dword [ebp - 0xbe4], edi
call fcn.00403050
cmp dword [ebp - 0xbe8], ebx
mov byte [ebp - 0xbd5], 1
jbe 0x40a155
jmp 0x409ff0
mov ecx, dword [ebp - 0xbdc]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xbf0]
push edx
lea eax, [ebp - 0x404]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov dword [ebp - 0xbf0], 0x200
je 0x40a131
test eax, eax
jne 0x40a140
mov eax, dword [ebp - 0xbdc]
lea edx, [ebp - 0x404]
push edx
push eax
call fcn.0042a710
mov edi, eax
add esp, 8
test edi, edi
jne 0x40a06c
lea ecx, [ebp - 0x404]
push ecx
push str.MfeEnumDependentServices:_Warning:_Could_not_open_subkey__S_n
call fcn.0040ef30
push edi
call fcn.0042a5f0
add esp, 0xc
jmp 0x40a11a
push 0x3e8
lea edx, [ebp - 0xbd4]
push 0
push edx
call fcn.0043c140
add esp, 0xc
push 0x3e8
lea eax, [ebp - 0xbd4]
push eax
push str.DependOnService
push edi
call fcn.00403450
test al, al
je 0x40a111
mov ecx, dword [ebp - 0xbec]
push 0
push ecx
lea edx, [ebp - 0xbd4]
push edx
call fcn.00403370
test al, al
je 0x40a111
mov eax, dword [ebp - 0xbec]
push eax
lea ecx, [ebp - 0x404]
push ecx
push str.MfeEnumDependentServices:__S_depends_on__S_n
call fcn.0040ef30
lea edx, [ebp - 0x404]
push edx
call fcn.00428150
mov edx, dword [ebp - 0xbf4]
mov ecx, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x404]
push eax
mov eax, dword [edx]
push ecx
lea ecx, [eax + esi*2]
push ecx
call fcn.004293f0
lea edx, [ebp - 0x404]
push edx
call fcn.00428150
add esp, 0x24
add dword [ebp - 0xbe0], 1
lea esi, [esi + eax + 1]
push edi
call fcn.0042a5f0
add esp, 4
mov edi, dword [ebp - 0xbe4]
add ebx, 1
cmp ebx, dword [ebp - 0xbe8]
jb 0x409ff0
jmp 0x40a155
push str.MfeEnumDependentServices:_No_more_dependent_services_n
call fcn.0040ef30
add esp, 4
jmp 0x40a155
push eax
push str.MfeEnumDependentServices:_ERROR__RegEnumKeyEx_returned_System_Error_Code_d_n
call fcn.0040ef30
add esp, 8
mov byte [ebp - 0xbd5], 0
test edi, edi
je 0x40a165
cmp edi, 0xffffffff
je 0x40a165
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xbec]
mov eax, dword [ebp - 0xbe0]
mov ecx, dword [ebp - 0xbf8]
push edx
push eax
push str.MfeEnumDependentServices:_Found__u_dependent_services_on__S_n
mov dword [ecx], eax
call fcn.0040ef30
mov eax, dword [ebp - 0xbdc]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0xbd5]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0x10
push str.MfeEnumDependentServices:_could_not_open_services_key_n
call fcn.0040ef30
mov ecx, dword [ebp - 0xbdc]
push ecx
call fcn.0042a5f0
add esp, 8
jmp 0x409f9a
push str.MfeEnumDependentServices:_NULL_ptr_n
call fcn.0040ef30
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0043c015
mov esp, ebp
pop ebp
ret 0x10