Function at 0x401ce0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b250
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x42c
mov eax, dword [0x491870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 0x41d], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x418], 0x400
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x401e0d
mov dword [ebp - 0x438], str.7oF2iwC3XhsD9tDxnNzHXb1TVw4k6GqKAFbNtI6CwtmK8rbaSEALy4xKfX1DULLPVLWbUzBHaH5AFcwW2o7ih8OkadDygEPimamoIYEa0LzhrrVC9Y4gIHf3DkbH18xaPSnAr84rjuSp3Aw0gYUtTlzXNpW41MCzWrvN7uXHAJ8S4Rb37pKGkSQM1zm15XHO3TRVcMRGwmu30fFS9OetVrtOOUSmVKalbPaNBYzO2feClsyLtiyn9nb4XA6eh3fI5iD7Ilc8dhHHv1g5XqyLNj09pKBbLt1DcR9rnncjnolNSc0n9iAWcbiijy9b1soYEH6hQSnF2tDOM2PihwC557Np3cvyz85Jlov1STRdRub2wkFGifcfHzx3aQx3WsD2M6VREJ6wQoC6kDcuR7rnGeQnqLeJB8r9esy2N0PQ3aH5njYNlh1mb4sdNazbYBGuFE6xqud6OLfsOrnRNrfTJim1uhGfr8rDJmQj5mDLFe84LTB3YNVEoqTTQnKdiHxhONJcKXR4lzl8gjFSn2w7BcKAtJ2NP5HfXGdSTX0MLNVhi4r18o2IkEUt8DR3hNqxWfj0rfrn402wQlCg9C3KU5JzOqFrO95fhdF2IYWVAdOiP3GxXWIpf3RxInVNAbOE5TunyDAbRxBm5T1WTcMMzlgHeRfpGJF9h3yidSKwE4KVrlJHTBAPD5h0VeeRaorhqXdYpIbVTTGzFASbG10rEBx0EQEdYwOJPsptknT7KbVguEhQCIwlhx0Vn7iR8fikuRFIzlljy36mzhynOzbbALYFjq3Ctr91524AfpbuSFQBzYdx3UCwar6IRbSGTKzU0jgLRzteudV924xhPC4KYXjeFPPDdDvhlzxUpaAJkRcwwzHDm5iew3UYvP2r9fMtVdIxlJdRzQxEvjDPxaF8HBuppDFusy12g9b2w7o8AnVQsSadXj8ySQYzAI2xMgEDxLVGjprFWGuOJCTfYrdwTiGcuArJKQY4G3wHvX5fr2jDHFhAz11S0EaCILnBWA9iiq68mpji2GCOERB0sXdpVWmP8Kk5Ts4oIRoXzErRUUKeRTXn4M3MRswuJ6Rv5gvAXQF2iPaGs437w9iMwtoxrHePLnGzUx5gKoO79nt4hpYaNNnoEwC7JvnMH9xoNBdVv0iOc0G18h5pNOMyYXKQjWcT91dr5w9fmG8FVCr913YhASVJJlmX7linWyDD39YXa2V7ltIHa5lCcu5xRHyADjv3bqMdW4C4r5SrQ3QDWIVEARjI1C6IKI6o4fHRXFOBrpKRk6rsXoDXG1vbvaifPGAw5EyDh67M67Rt6Dsm3vlzoIpWoX0WEDRcSlwXYgUX3NbeWWdbct4SvwAdp7Gvve8NkYVH8NsDFBb28zinCJSDPHpg3gpv5oVouh75JaMs0aUCilE3JLX38l7yqxKoxj7DCVyHLzMcMD5EBkAXa1xF3hJIpDVvvtQQcGKz9X9JvFSGFRGvI0Vrf78tyHJ64zG1Til7J6qbkta9vzSHrcwHlc2F9sthIDsHBuX5msYH5KhmClrex8NeRFWn8676sUlao5qGOi0DnIdx0iUotli6kqeIbm9sHVPixQxvNEvur7vM0Qh9RoEQb850GtE8ltKBxAet2llQibi7vFI5yOzpQcuFHdiQIBhf49tW8TduAFhoQIQqzeP2FPki2OkbBDS32lnGGEAkITJqLbx4adjr01fC98zAgbnrx35NfGOnKDvQtw2vNoWG5qJtdppsn3UvR8NQjS4Puc3fFuSU7nJh8A9T9uO16oXXwsQHjQk2qpo3t5Y4WON2mJB1wHnq1AjcdXCHFYopJD6BrzwpnnjeQU76EUbJch6dQxAxJqVBlHlaDu42EJvvITtAwuXQaoKDy8giP7qkO1SOvCsCgAJSYej3Qi1AQ76MCGircH9tus4A24UzPCpMEf7c1KcFHRdzzbnP3Gg6lqKpz7XRgA02E1aQ9JVFyoyy9yhLyfGk6Qt2Xnr8Bc5PRoA1azflUyooWpD4TW4zj8RSUgHE0E3zYEzxDocJuUwEb9vzghPbcgecPuFbv6d0Gb2vFVLDFCiyCVqYgImHmGSKckhNIVS3SVve8ykG3BHSx1eilg31kY0i9feNilsAfdRJIwleKnBRw3nJW1FSpwRgjh4R9SYGunk2PQtlqYMclWYHw7p2ExXPO3gauo8BjRv7HstKe7R2LYvrLXlA6SNzu7Uk8TupLKo5bmOa8XkV8eC6XVIxsfpgbeAW2VOPGbQUJPsRDksLWCUPARTPNsdwni2xbmrCRYaUGuSOsQtJhKhsr9NgMdqNceEsfLiM7sAS4M8pr7T1PK9DNsAbfbmUGFFczjRaE7Mj37golpaT6gAWmIOEh3o7R68odAexbNGi6YrYVLsRdpcPh8mm9xV0HFVOUN3yOzyzNOTIT5Pv2RcDb9nBjoyB6nKnaAyKaN0y09XyRTax7OkC9vomrlOiVVaa5ayzh5WgHr2PrB9SKXWUGcgeq9rS3RvkydsmEiGn9fyjbljwRv0vNu9qlBaxcpYfaWcifALbL565A01Cba0lSTyRuuPQ8BCoa8musl8EcvhG7ert1c0dQek3kCnKvgfnwY2Xah0ng5O1atByulGM1wB9xOLCYUyWWhWBEiWA2ovo8TlpmSiGb6RX4U6c9T33NjmaHBS9I1btiukL7CEmzyWWWLwByj4FaQakxH3AMBNmWY4uWQ9bUKYbwgfmF1K2PfKDOiY4TKnvjPRAInKokMqnhhBpXC7rihazFpymS80MxjSd4y2aq46UUHX1QvWmJl0sGi1VOnRrNr7Cff7vhd8NmtMUEQVp4gpwTtROWbd890mghMHmmbWFHvDaHzvjRqaTLM0MJenQCzgGQ56wF7lOhL8ggk0XtJAzgfB9RdK4eqiBnvaJAtrcAdW4xBxoRzyuJedVcSQySGIRX1lz0YFkmORPHA4LKRBp5iFLNXexucGsq0ExeCNswALdShnoy3K2yk9VXdxCTx9vhpH03CUqcxyg9q5Ho6EVUrbm9ouLV9ShIJFdFutIIGgnwxCj5swyn3zA2iRmj7tbGUjnN0buB5XqYTiV98aiALwQwIAaKonLMtWwxd8tCLPztxarNBWmFzvXGuAlUDQJnowAvqK7FP8rShaQXSOUbBlqPpSsqi0TsdupHcLsVn923H4jjwkX8mclrmCpQAHfLXXIFnecJtiIK8s68zzsYxwvebYyGtKSLdy8j4xECg4iKGIFtyebF7ai5LdBrHH4y1v83DqOmT1SKf7A5AzQzmdL60GFvLXa1WC8IIUjTvL5orHypgs2vM9CBNOghXLJE9hpDdpnpg4NiFnrBEheKbLa657f6jasKcq9yiAUdlFp07Reuq4O4AcmhN9VeC39ffCpHovtUXsC2GJ4DHm2BjQP6TAYVr9JLVYaIbwdhkoyQ8lej8m32WxPDnbsn8YlIrcfJEjXfEtISRU7sTKUrllffbHOJLVc9qwok1Sc2eP1uatjKGTxnAGBrl6T5fdGM6PfvMBYYhEI00SuxHDLO5m4WRjVtaQj9ayjKH96G5bxG8QvTEukfsqrHOozUVGJnQG10NvTVVKwM7SkBMsNyCjcQdtNnIpLlSOECm0pHaN9tdl68PcG7KJqI8L3KrxlCy7qsWjjc5OfTvo2F6SnJiOQPDx6TNqywBjpOooTN1m4aP3A5jjaFVUQXRb9FfdA0mIyqKA66k6ghK8gWNQcDFLr3T7LN1UQJzgLtqwwUoLPfDkKznqxPHrhfSRV16mO9CoLB0bneB9d3C6SVmx9QyjDSW111ec9iibeWmQwfmadyzLCJBjRN05uyhgJpWUB0XfF3F9uo4J0Cau4msopc4NoY1lgLxN8KuOvTk3qhbVb5NftVM2p22Qzan68E31MJgE5X3O6H7SIGFOde05oJuURfyreyjwLSb9AbJ5VGnL08JQOL0UJcg1NBMlTTS7rMEf8SDL1tpRM7HNWLdxKLrvvOhSQ59ohKBrGVd94sJxcf4Wq8zvCfn5KEkcarcPTNvRaydOphQdN64qcsvWpRIJX5bwkjUI7FhbiwDH2LhpvcH9k62B6mlNdi78cUW9MJqDLYL2B
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x401e00
mov dword [ebp - 0x424], 0
jmp 0x401db6
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x424]
cmp edx, dword [ebp + 0x18]
jge 0x401e00
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401dfe
mov byte [ebp - 0x41d], 1
jmp 0x401e00
jmp 0x401da7
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401e1c
mov dword [ebp - 4], 0xffffffff
jmp 0x401e2c
mov dword [ebp - 0x434], str.m8uktgpJ2m2AebdHKtXKEEUD3jtCQ5BjPqgR1ezvOeExDMEvPnXXhWd9N2enm07iGhbUI0e7bBEoVw9FbtavuwfdaMUyJ901eG5VHGMN8bhUGBHCYYDeFz1oOgR5wAI11DPJ49qWt9pHVxEtAbzs98qp7EVNJJ0rKbqAS1a4Dcsi75HXAkfRcW957HCoNdW8nkU68GTOPzq5dgOtLKYw3yHnBCVvEVYv18piMkh0T1Uoymm28JdTSfrr4bxBD4PG2E9AKRPxrM5p2VWjPBpPQ5yxEDB5z4AoVYnKSYTxIDFd
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004136d5
mov esp, ebp
pop ebp
ret 0x14