Function at 0x40ae9d
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x230
mov eax, 0x4e32af
call fcn.004c2a93
mov esi, dword [0x541ad4]
push 0x12
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
mov edi, dword [ebp + 8]
cmp edx, 2
jne 0x40af17
movsd xmm3, qword [0x4f6bd0]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x40aefd
subsd xmm2, xmm3
divsd xmm3, qword [0x4f6bd8]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x4f6bc8]
ja 0x40aedf
and dword [ebp - 0x21c], 0
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40af47
xor al, al
jmp 0x40b123
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
xor ebx, ebx
call fcn.004c3990
add esp, 0xc
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40b107
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
call fcn.00401824
and dword [ebp - 4], 0
and dword [ebp - 0x224], 0
push str.Volatile_Environment
lea ecx, [ebp - 0x22c]
call fcn.00401824
push 0x5401f0
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.00401718
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 2
call fcn.0045107a
lea ecx, [ebp - 0x22c]
push ecx
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 3
call fcn.0045107a
add esp, 0x18
lea ecx, [ebp - 0x224]
push ecx
push 0x20019
push 0
push dword [eax]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00404fef
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
call fcn.00404fef
mov ecx, dword [ebp - 0x230]
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [ebp - 0x22c]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00404fef
test esi, esi
jne 0x40b0a9
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x238]
call fcn.00401824
push eax
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.0040bb2f
mov ecx, dword [ebp - 0x238]
lea ecx, [ecx - 0x10]
call fcn.00404fef
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x218]
push eax
inc ebx
push ebx
push dword [ebp - 0x21c]
mov dword [ebp - 0x220], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
call fcn.00450f19
test al, al
jne 0x40b0ed
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov ecx, dword [ebp - 0x228]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00404fef
test esi, esi
je 0x40af9a
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 4]
sub eax, dword [edi]
xor ecx, ecx
sar eax, 2
cmp ecx, eax
sbb eax, eax
neg eax
call fcn.004c2a42
ret