Function at 0x403f40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414141
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x44
mov eax, dword [0x463090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x18]
call fcn.00403190
lea ecx, [ebp - 0x18]
call fcn.00404530
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00404590
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x40]
call fcn.00402940
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x404015
push 0x43810c
mov ecx, dword [ebp + 8]
call fcn.004045f0
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004046f0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004046f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004046f0
mov eax, dword [ebp + 8]
jmp 0x404221
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 6
lea eax, [ebp - 0x30]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0
lea ecx, [ebp + 0x14]
call fcn.00401680
push eax
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004047b0
push eax
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00401680
push eax
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
jmp 0x4040aa
mov dword [ebp - 4], 4
jmp 0x4040e2
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x50], str.1XIo7V0X0fiA7USbosJqcve3sSP7ndhedUEgTLKUERheITPY4bcsozC7WoGYdXI30rSPNQpOwJCDLGJ6dFiiY6nD4IgxR6oIM7fPeJGFq6x4erhsjGTuQGymm4qCtz6FCr5fXEutcC6tRtUurWjV9Er1u24PXylO6N9h6rYeLjpCjeIae1gKnTvpbBXy8ilEpsGu4zsWaDu11kxVSlYjp0shdaSXAc19iAoCAdtIsokVesSNej6jn99stsvVJNYL5emIM7LyPNPp3vYfC9JDNbFLUEwaSOAyHkd72GgywsUh48XlToJr9DhhkM8TlnhGNRo257F64KKA68P2z165db7g0CHydWA20hDwLGzUQVDwtboEdHCvS65D58I4DAllzBUuAbcvVg9Dc7g8Cb7xGJpjhGvVuwbS1iWtHaAOzGiUw6FvxaJYRiqPNgh7Wlp4SVQXYXSwrI0LYEv4Lv5ysMBtnp92nY0xI7aq7Mo0Oq36mBij877Vf5zdhf5wuGx86zLhuCxkst9fH6bUq1aKNP6Jgt0Tb0gTz5XSlkUhC7RYlCYNwgYBsz3pAnFXHQ34LvtxBzgm7aGyR092g0H3hBvkbWSqu8blpl3b55QSc7UHHYII3D3gFHzqNjpO28OtMdYq7SlmdqixrH2D4PGrQlkg6FnNYXpKclqb9chFf6sHmFFSX57GOfJ8m0xqFAvvknr1Yxf6Ck6b9TBx9W7eALuPvb65JAV8Rl1iiDxrjaocS1WJaoo3YpYH0VHnacGYED69Ah94NxXgWl4CBLEUEOhzTVrbdhYtz5zrarKMbkU84Owm8Rul5MdMQHSEykd2yRkQaeLY9eKPg157vMvCzffc3F2d7uY5GAaMzShvVRtHU8H6y4fMgeAdi9lxbz843dOqiLNv5SBeE4O4PnzR2PyIB63o19rphEnfvuYCufySlfQBe8XbeS03S8qKn0NWQK1YHamVKdb1wBMIcfOhQCy48KrgkY2RHdkCvTPJJ1TtX2tIFpYgL90thufABJDECPGLtfxFW28gSoBKM1NMFYmjS72vlOUAw6XD1dTFxTioRuzNM997d7VXczYN6LUPuew2sgB3jqQ1S5zE2Dq4SXh734iqL6rmH7hj1jAnFCgijTzW4Yw47rfMXVcmFe7WvmCqLH4DHI0xUBg9ynS4bSTk4LVEwyeepivRHiw468z5ON9wpzJBFD28TLAXAFiPSzcIvdn5XEOzRCc4dFyqVmhiUhJMloBYflHykzOSGaUtQbHIjFl4vtXgPQ8gfjnSt9FqUOdEGSW3AcU7FN73MqirBGvqngIpTXULo5TE3va4ETTGrkXfatkpTrbdin372NlrSc8hwfq85NWA2v6YVBTO5l3sY19aCFTFqNS0ALbLjCKv1AKUpzIyd6zRUP6lABE62j3vokpnjqlQaUi7MViz5VN4YIi85EJIERjBPFHisu0DtK73hW009CmvyRuCqTkXdo9du3eFzmpw8rIz1G06ApsCA4lP3G9rgNa3Spt4D7WtH4SthrLSnYlkKOxgcmoWu2E7ibY28wH1AIAHubhye2aH3UMvB7j560ml2Yt9hiQ5StcASdOsiXmayBEmwQEvClGAIJWhYMuXtEOGBY4HDV6juOea0RsafR2Mmkcag2cy86TRo9EvG1gvcd8N3W0lNyOVjAJoiN6jy34mDAhaiiw0b8tOwlNFLEu6oiSjpxPgjdgFnlD3FMlO4CThcJI5fywsLcGa3nx2QLGFjGtBrqSRDrAOIgORYSmf0Y00OdSNvkNxJ7tmDa9QN4bGCvqCnsuMN14S7u3aNuOUTmkO67m57GuUKtrmQ0fWl4h9Mtejjq6PF9mIX4Byj39T59Jjc26CV2cnAsa4YCm6hJio9AXTMF2Kyg2DdtazUrNkDRp6s2I75GfkoqwwYzHbWHjajgk31LNAbQ3Df2wz2Km5Sg9Euvfq0SPYyusokqKwBgFtIvqxLSMhbKun0VflhC8ACtu2mOSprDmYcIkoweFEdwWAnXNmgbWLPGku0gfhodJ9OtnPdaeYj7H0CuyskknDaSVkx3D1fXVuFW2TnfE8e3FaR2EeJdHEdXfcDoDmXwB8IOWWi9tK8bFjurbCI5vwAoTuogDzUWk0t8OysIbFdaMud8nqHIMbjBs6tSggvpXEBVuGmkSpkGmsTacFlH8CW8tLzemJTPxguXPs7p8z7IvzR7LPqNEhUYw9sdVPt9V4PHyrX81p3FBy7Ifv7HgmMUExPefEjs3pLAd4jj6IymhueWKiW5yWinuMj5MF52MIM02wHuuST7qIvVtUSvWWgv8hm4mG6q4vKf4SNVNRhFdWN4AbgyB5Hac2lU0OlkQm0D84pAbdIg4fFSjVNKuSKSPDxP2vqF5UaoLKv7g1eyHUjaO9ljHGUDpMDPbkVVLfwjqK0CNyxcaYaGjVkUlrRo7FMrdsYrEKsnRF6AhFkHPAeTpaP4oeKxz8gwEFEa8Am2wO9JTAqjuey9znwpaRv9Vr8KE5t4SJ6NMxCOkVOf6gVOKGRMCFCaQ5MpzR2vCYijKGAuDANnR6fKR0casveqnOUqW90fXNrlezEiqH1dcat8JXEC5IXE4Gzny89quwQQH62DFGnTJSDxcYdrBb7tS09vmYiAJcFQnCxRPeddgHSW0gFYNhsqhiiEwVlDbBQA94v9Ph6AN7oJRKFMdVsR8q4jqc3r3nPnPpB1YBXoo3mMiCnj9T1FmFSYaJ6RjzuqGetHELlHYFhaDp3vMQ9UypfbNVGVGIDoOqkDft7hIfvEVnoinL47w4Oua05s4vAnuMTV3xfq27Awfop4MqywvmYfY3FBfqxAHBxxN435vDboD2WmC8XkfevucaRY0Eup9E8lHobQVa2i5EEQaFfASWpRYuex2efkci85p9BWj7VDxn2opnTg5Y5FFajD3Rt0VlCq1cCeRQMdV6oU272bS8fQPmO3F6Ecc8dR5IQeYOxf5sSxrej4QpWXefuSte6Qry8SB7
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00404800
cmp dword [ebp - 0x38], 0
je 0x404145
push 0x43988c
mov ecx, dword [ebp + 8]
call fcn.004045f0
mov eax, dword [ebp - 0x34]
or eax, 1
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004046f0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004046f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004046f0
mov eax, dword [ebp + 8]
jmp 0x404221
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00404590
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.004046f0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.004046f0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.004046f0
mov eax, dword [ebp + 8]
jmp 0x404221
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406bf9
mov esp, ebp
pop ebp
ret 0x10