Function at 0x401cd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b220
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x424
mov eax, dword [0x48d870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x434], ecx
mov byte [ebp - 0x41d], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x418], 0x400
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x401df3
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x401de6
mov dword [ebp - 0x424], 0
jmp 0x401d9c
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x424]
cmp edx, dword [ebp + 0x18]
jge 0x401ddc
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401dda
mov byte [ebp - 0x41d], 1
jmp 0x401ddc
jmp 0x401d8d
mov dword [ebp - 0x430], str.18P4MwP1LPHDNtqqHLIJU455QeM2QN1Dqxx9WtPheXykoOp26TlOhDgRmkJb4eABnGXmM2MEgRauwJyvsMxGPwzaA07tlMLb9ORcf01NuHK108BzHRTW6555AiEELELjM47TPKNORX9YEVJRtp4X3bIfFDNEn4cQ7lIozfhhzuQGidu2gvTKeljFoKBCim3FGoNiY0scibajXDqvMsYMV4bjaR9NgBKW7IX1Cx3MxXJtwVP6qXdwki7oIyaajeBqRTs1mjLAeFhMxPS0l7PsvOG7UdeLER6SI0GzcgttdP9sR3Xy2K8eGbmfhXRChIanDgPUebUDfGxP6M20r4EajTHRkHqTPxiN4eoWKRXD5htnuLEo0qmd0wkxw76THyzXRGbce8vsnoNI1gVLmwXzRC5YRvESX8eKi98WWWYBS0C0gP8hb3ydCVQMKlzi1mKzMCXAjudan8tRLAXnGkivppa62Tqj6MwJtzqXvo02CbhYRvGCTHP7xQX0Ppjzny3d5XjzWYQYiM0wyV6qJkETYBLqNmApbMWliyj3I7NCvPVp2j4C845MruFd2y0J5FSUJRRaC9uwMsH6H2ynUyhTiSm6H87tkCpqzsA5k9vWO1g6dkapO1o5VYLsGn8xFaS7NcV57p8vhCAuNARKFSLHvQcoCLfoGWGLCmsx7WzdO2UGj7A0TWVbldg7XA3Xs9VREO0vUK7l4badL4DzXvKSOReAXSjUxtChKN1gbRp4mLqiLeekEdMrjEFKDzTx1dFn3QEeyrxyRoUTpWrCW0eEgtBuJnSVvhPXY5ze0j2rb5J6aJjTq5iubWauoLB1HK6cnIiPVvwbPlgIoVKcSUUruX9CtMPXRED9qsIYD6DRhUAenu53XTk7TgVqkiB9Y801iy0OIrVD6cwYNlFL5onWDaacxy818Qm4818BtoxwlQb0Bm04zzFzywYd76WCwsWT0ESMSiasxL1UTvA1KkIIiJ9yzIUIFF7AW1WUF46ghQo34EvFPnhHLxltuxRgirKq9EAwUH5FtyFEAMmoRP7V5df0r4SR5I6Qw7w0UctxhwVefVSKTUFGvQRHIyib6Hp7bQhexsEIuX6FjJUsdBCGweY4zBTDtfOjEVcfTiuRknmsdMqA7AsNkE2qH5Rltez0qesfM2oxrsiMBHpANnw1NVW4f4E0CxX4Xm2wEuocYeMpm9XlwwrY5phd6mBctTnL4d38Na12UD0oJK5SWW9W6f0dY3Ahgs2p7Gjx1lJIWqMKypTM3Y66VICcMn8fKmT6qojMdEeUyNqEoKW2O05IUUpG1j0iYfSLpLaSw8uNpANPO5CVB247uhvY2XFcAAmyNUeW89oi1Ity2zK22KfC9G580CkeKM7VGy22mwO6JhJBLkB88r2ArndYNtUJK7UeGYKcjubHGg5xLM17undkvvpCDikfmADi1cUUxXE6J0DuGI0AKkQ0UemxQFAGRRAirVgV1UpVzgIcNNAlY97C2FGW9X2ybdpssHwLSPscq0nCnd1rXDbX94KpKbSOqdqeC1OW15Vy0ItdVr9auBDKgo2bpPeR1LzduxGU6RboyuQQfjv2m0qFbw7el45zB9tg1jCBndPyTjF5fDYnOwH28CFS5ePCSlK7HdB2t65083RHjrzntLqGIYW6UcuXRIoayK1SSV3WlVLIoCbvFid9kujRVThVXz4tByTBsnUDzoj9vxB4LajVs6xraW6rAmT70DbjSexNnITiYeOlaPTksW7yfRiDtad9VpLWGrwIU5lItm2Fmc7qxjetm0I0IIzEGFxeb478grKiDgCmshqvj0yHYbb4Wm57vPgXcTo8X5zNlvxXaPFLacjW9d6au0wCuEVqxOsih3LOaoIg13WDMmpwel6Ukmy1W2YNH6SB44IqoGVnjLgoAOpEjnbIlcVAbENsqQ2f7yzQ0GtfM5VY8WXYrVd78P2vRv7pEdkNeMkqGcgJDkz0f6NxBlOMY6MOcOYkyhkf6HOGQxLD
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401e02
mov dword [ebp - 4], 0xffffffff
jmp 0x401e12
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004136b5
mov esp, ebp
pop ebp
ret 0x14