Function at 0x4054e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ec20
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x428
mov eax, dword [0x493224]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x438], ecx
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], 0x400
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x4055f4
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x420]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x4055ea
mov dword [ebp - 0x42c], 0
jmp 0x4055a3
mov ecx, dword [ebp - 0x42c]
add ecx, 1
mov dword [ebp - 0x42c], ecx
mov edx, dword [ebp - 0x42c]
cmp edx, dword [ebp + 0x18]
jge 0x4055ea
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x430]
push eax
lea ecx, [ebp - 0x420]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4055de
mov byte [ebp - 0x11], 1
jmp 0x4055ea
mov dword [ebp - 0x434], str.TaG1KzwzcTl9iHU7kGqeV8rNNL4r1441to7DMlk5IfsOfKytrWez3ooOl1pexGXP890UEoDUPHOl96gDeDMrE3839DUNVajJ7AAUasCOOtLifJfyNmqihENY6WJQV0YcVeMV4oQyGyOVgcBEC25KtNS5QabJMgN4pS5rd7jNfOyfqBlMjSlEMfkLQiGxgDsFAJE9oBlb2ULTxElfPus2PJppibQ3BmwPNfiVtXFiookhQEnOoLh9c9Oi8snJCfuMBfsSjksGpxjtaq8IsUlruqCI5F7MBGHdTQfkJVcQVxRhOr9CLwMykAjTD866oFphKylKG5PfBok9BGSDjrqmnIJ03cr3EO53QSh6gyUJargqwmf10QCkM2acpCtfcjY7djl6VnebBgajBr70JIMJCPKWrlcgGmGwTSbsgQiuBcBIgfqU2GeyCJRRMY6r3tb4qPtBMmhhCwpztlmzfrJA4RBjzXNMJKl2vMAbYkG7UovuFSXdYXJNbstzEA60HSVaaDwYoguwuH1LNzfw9ChoiMkUHWSwq8DCEFS5yK009g8soI2GT55HGgrw80dsTjY3xrXG2tUWpDegqc5jEjsnGjtA6ugEDPqwDRFfpalNBiQCps2r7DpaBuscy0nCEIiBYbzpfDMQMrBFnvoBeJz4NpQrdY2AuwNgWWP2bO7qOckeSYCLeybiDKtjxEOwdn5V7IDEhbwr5ngIGwG8wxII5conXJa0feEHh61PnUkCU5OIA611gDGrmyAuPwf28S8mE4duRyxxEbtgQnEh7EMEkeXEfQ0Yl7UQHFOgppTaVJMkMHRleBbWoCkq0aAO2iNyMXUQ8hMLVtuURIx70qwF5lYTqRSYwcCw3cKmPjziYOrW36yTaOcJxv6Rpg80KbED6q9fjbTHhL3gHK3bxOyCHJ9HgJtt5TCzyLWzaWFhGxHIFBTh57psp7V6UO55gY3Mf1uYVd0FJxPi9uLlT59Spas7Vh7yr3fB4DFE5XkNzmQ2Gf4lgPCbiS26x5LJ9Ae95SPpSEkYXPe4jC05wbf9BGeMBofxi7QpuBTBzdWOlYpylkucdCTcJuRaBzMXd4F9Esibf0pfN1TNz2g91m1kXC3AHdC3zP414IUESPbw1lab9mOdIjx6vS7LF40WvL7slqe9m00fmCJ5BSnug29Av5LaCBddQgwSOVdqsgmodCFVxjuFwWVHjmR0IHaL5goX8lcRHkGhstNYQhoo2yvzwi6XS35GtAJ6aNtUOdGoqIl2E8eS0PcBJENFwB6ledCuqAMdvn0VvmAp2f8HGRHei5trzSazPoKzn3iof6sPFXJVlhRCkL8Lj2Jht0cC2HuYxCw2iu0GlEQQdhRDbNVxGLmSbBVeQ6OysOqDFvIOuaUQyxdUze2M2pgIcY4zxOniEfiI9UPgCLL7vKzQKsEIMStRtW7iDqptHxRHgjJJImbevTj25Utv8WcayVxtYQRvaseYk7TFjoKgejoeRaxfYdLarUGECkh3DPSRqA1
jmp 0x405594
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405607
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004195fb
mov esp, ebp
pop ebp
ret 0x14