Function at 0x404180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415b19
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x44
mov eax, dword [0x4543c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x18]
call fcn.00406190
lea ecx, [ebp - 0x18]
call fcn.00402dc0
mov byte [ebp - 4], 3
mov dword [ebp - 0x48], str.93NG04XINtbnsgr1evwf5TiG6XLAmjHhD5PfJApoqE7P7kIgTVjrFltRbsanpU28FyhvabwC4K7He2Wo40NIu4sjwAmhebDxc3BCm7Vq9LqbhD0IwqXKkMhX7bTOKCyrkTKjg5waHSmA8rvj9BhOOGd5BilAiIxCg8fQLfssssdh4BS81HIJxqMef9dezUaFos39BdakUgJz3756gBCUBlYW35oypvIsmTtMnjGCUdgMkW9ovvMC36nRvO1YVwLpUh8hKiEWtjtyOu1hkunIpsRqNKNyDKB4DlL2qu83shDzWlFWBkalm6BHbBnILLWhyHeJBfGo3peyhw1n3VBc7xb4gMy0BvqDy76y3MrGLFUhorUibnRqufE60jnSzjCvkqCb7fTWtFAuYRecxSSlQDXaasExylOI3CdRFH2m8wfBDMHxmqchAG6FD1vPfvFHrDemOuEwhLPvDcIJ0lqgwDa9Ukbv7DdIGgeXU8M70RHMbAtNeKbHzsWJFarIIKxAJKwpuydvXu2EbKPxKBU9nFMw1znfMWPvxabyLjkVgykWHvL6ezThgfApyRntggk70j9pEo5xsgna4Gj1h5cVeJPgWHECRCWKGIV07N28SkazULefIbynJQ3oTgGa5PG6L1z2vyPHNwTpkVI9UeccH2575HfoxTkvG1nUIaDfn8VO1vahsTLKzSn3U4OMQCmcUVHuiidwWTppppyouR3MsUYjdlHAKwKXMpeUtPnriyfD3hmO4h6o8SW3brVV5P1czySG3QWXAK7JCqBu8IbX2HlvrilISt9PS5iRTUicp8lw8YJcWVOKWKAjNNas1QomgN8iDToIQEQFw9RU7EPl9VssSdg3t2E4dm6IwHf6OYmLgCVo6TAUaCRnEI64jbsuwyvL8P1WOxjNvgAK05q9ImS5G7NgEU7W7TgEQk7g0T8MSSh05idis7LWekBt4LFz4zHa1Cdh8UfRkeaTHklbTl7F7xGCqdUkyvMFPEhCLr2Hq1SpafE4xIpToLtFLRiOAg9YUVsuqYJVmheGbS51ICfnyCKUF1U5UPzbMYx5iJIvo5OuE5h1DK744qzdqr6T3CMNx2aU0IpnMF77u73LgOKDV6VnyELN2zRcaNhHohRKOk0Ok5hI33QjsRssBgehBs3n9BMAG4O1NqKNzU2X0iXI9kqG8TdJlQG4tjobg5zJ3r1fzBbao8Nt52CkL28nvLj2BgXfG4ANp7PXzEo2EHwypXAVK6PM7IBlcLYEBKOqJlhJebs3wKJbkW24qwUGGylmoBwehg4MPiwAQrSL6DLFJldTX2jIDapeic7fvnFmDsrPstmp0lMMOR0Nxpmq9gLNvx6qkezS5qkMRbGWlnQJ0yXlmwMk7pACceLW4fpg7QQECgP2NSUbYpVrp7N4CiTMkvkMltgJQla9hISzvabN7tTT9Q7YwXF8190MtBhoHc3ifdb8ObD7jxhbx1Ux6Det24ldnq2euYUoJi8KeAqPwJwQnMb8Y6sFxyYEQjifd2r72LGuUCABUc9RmcKfAGQudiUmTEPSMv8j8WlkvNvJO4JBbXhv2ety97pbHQxWafhTJId45QS9NtXOsDfJe5YnqRyBRheh2Rn5U9rBm3qK2Hiskdc2ARncEkJNDb9udoMbaeH4DOF9EwrSsp5m50r3eMEYY6G2hzoB5g3OBVJc6gha4SI9QMvTYXFmMOPi0zTmFtyufU7BMqh5PpIFbRQwDGQDv44TtefuYucusqWBJsmDLlQdplGsIWX4etgK6Xy39lVXSf8VwDU8bH75WGd0yQvoxpJsgU1zfykWhFSCpCIdavQ58Xgu3ExGTfhwXELRK7EYe9kPHyqGpaFIyGWds5hQXe5dfWX0Or28hGYEYI9ITsMxiDoNIYR2UIKXg88FWxmm7cjLsDsEfM33DMeSG9RpwXnvy8TELPwpiJsmWKq6masJ0r5N5pxF95tPXz9HW5lLcwj8PpyUvgf8QntHqNR2H61dFGYB
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00402c60
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x404261
push 0x41c81c
mov ecx, dword [ebp + 8]
call fcn.00402d40
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00402fa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00402fa0
mov eax, dword [ebp + 8]
jmp 0x40440a
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00407140
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x40], str.2DO8RIAgq9fUDAV7fdiP89pEKJ34Ay01mHL1vYCRh07J17rfX2aHCliKXcGUJ2e1j8qhCg5xCJsgUD2LC7x4JRjwkhELqY2MExr8DCQHOYRskYYY2uSTTw2x0H55jE4vMOvSpaBzl7vN6lQvFmCkR6IakWARXMfIJ2jT9SMbRbXm2qrhD8d
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404020
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00407140
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], str.pI6Q0tG7jKhUIPQPtx6PBhGtR1xjeooxU77oUknTyv1VxlNMpqGGyCJH4T5p3pVYnqlAMt7nQEfbmTNf2KXVs8KI3KCJ6qYCcrgDXwd7spoJRE6jlwdTaVMAsGcegUdMuOtqjEU9VizQITk58yQz1IJOe9q0voJOd3IybAmX4bs0CVxAXsrDUMqmwVBlKu2X1pSkuFwuUisPga9OaIIwg1ADM9FM0TWro4YKDNl9N8wen7XIMDukXQMwJec3cpKpwVdxwuAJlxjgGjdcHkLRsixkmWn4mR60pOR7CKXAoJ7c
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00405710
cmp dword [ebp - 0x38], 0
je 0x404325
push 0x41d11c
mov ecx, dword [ebp + 8]
call fcn.00402d40
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00402fa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00402fa0
mov eax, dword [ebp + 8]
jmp 0x40440a
mov dword [ebp - 0x4c], str.Hrnxo0eJoLR7zf7LFo2QFz9om3I0DMk1LoilCrXewvPmpN0n82ozrSKhRppik7nnrA3CUQGa8QFL4NMUofoJL50JfTGf1iAX1dY38hSMMLqsEG6hh3DiVotHp3B22Lt5nFtprGMagRFccmKHgHMkB1ASs6JqAoKl4yWyvYpdsvufyaVHuFs
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402c60
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00402fa0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00402fa0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00402fa0
mov eax, dword [ebp + 8]
jmp 0x40440a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a3eb
mov esp, ebp
pop ebp
ret 0x10