Function at 0x4133ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x419010]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, dword [ebp + 0x1c0]
mov ecx, dword [ebp + 0x1c4]
push ebx
push esi
mov esi, dword [ebp + 0x1bc]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x59], bl
mov dword [ebp - 0x6c], 1
je 0x413681
cmp eax, ebx
je 0x413681
cmp ecx, ebx
je 0x413681
mov byte [eax], bl
push edi
mov byte [ecx], bl
call fcn.0041335d
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x60]
push ecx
push eax
push ebx
push esi
mov esi, SysReAllocStringLen
push esi
mov dword [ebp - 0x74], eax
call edi
test eax, eax
jne 0x413510
cmp dword [ebp - 0x60], ebx
je 0x413510
push 0x206
lea eax, [ebp - 0x56]
push ebx
push eax
mov word [ebp - 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x68], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4134fb
cmp dword [ebp - 0x6c], 1
jne 0x4134fb
mov ecx, 0x40726c
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4134aa
cmp dx, bx
je 0x4134a6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4134aa
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x413484
xor eax, eax
jmp 0x4134af
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4134bb
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x4134f7
mov ecx, 0x407270
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4134e9
cmp dx, bx
je 0x4134e5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4134e9
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4134c3
xor eax, eax
jmp 0x4134ee
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4134fb
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x59], bl
mov dword [ebp - 0x60], ebx
jne 0x413674
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
push ebx
push 0x4071e8
push esi
call edi
test eax, eax
jne 0x413588
cmp dword [ebp - 0x60], ebx
je 0x413588
or dword [ebp - 0x68], 0xffffffff
push 4
pop esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x4071dc
push dword [ebp - 0x60]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413571
cmp dword [ebp - 0x68], 1
jne 0x413563
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x41356d
cmp dword [ebp - 0x68], ebx
jne 0x413571
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x59], bl
mov dword [ebp - 0x60], ebx
jne 0x413674
jmp 0x41358b
push 4
pop esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
push ebx
push dword [ebp - 0x70]
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x413674
cmp dword [ebp - 0x60], ebx
je 0x413674
push 0x206
lea eax, [ebp - 0x56]
push ebx
push eax
mov word [ebp - 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x70], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41366b
cmp dword [ebp - 0x6c], 1
jne 0x41366b
mov ecx, 0x40726c
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41361c
cmp dx, bx
je 0x413618
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41361c
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x4135f8
xor eax, eax
jmp 0x413621
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41362d
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x413667
mov ecx, 0x407270
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413659
cmp dx, bx
je 0x413655
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413659
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x413635
xor eax, eax
jmp 0x41365e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41366b
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp - 0x59]
mov byte [eax], cl
xor eax, eax
pop edi
jmp 0x413686
mov eax, 0x80004005
mov ecx, dword [ebp + 0x1b0]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413c2a
add ebp, 0x1b4
leave
ret 0xc