Function at 0x401a50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f867
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x55c380]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x28c], ebx
push 0x4f
xor eax, eax
mov dword [ebp - 0x64], 7
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x68], 0
mov word [ebp - 0x78], ax
call fcn.00402810
push 0x210
lea eax, [ebp - 0x288]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004f8b70
add esp, 0xc
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 8
cmovae eax, dword [ebp - 0x78]
push eax
push ecx
lea ecx, [ebp - 0x288]
call fcn.00406b90
mov byte [ebp - 4], 1
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [eax + eax]
cmp dword [ebp - 0x288], 0
je 0x401b09
cmp dword [ebp - 0x284], 0
jl 0x401b09
mov eax, 1
jmp 0x401b0b
xor eax, eax
test al, al
je 0x401ee7
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
push 0x5442c0
lea edx, [ebp - 0x78]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c0]
call fcn.00403810
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 3
push ecx
mov edx, eax
lea ecx, [ebp - 0x2a8]
call fcn.00403920
push 0x5442c0
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x30]
call fcn.00403920
push str.Connection
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x60]
call fcn.00403920
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x48]
cmp eax, esi
je 0x401bba
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x401b9d
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00403020
xor eax, eax
mov dword [ebp - 0x34], 7
push esi
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
call fcn.00402b60
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x401bcf
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.00403020
xor eax, eax
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0
cmp eax, 8
jb 0x401bf8
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00403020
xor eax, eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x20], 0
cmp eax, 8
jb 0x401c2a
inc eax
lea ecx, [ebp - 0x2a8]
push eax
push dword [ebp - 0x2a8]
call fcn.00403020
xor eax, eax
mov dword [ebp - 0x294], 7
mov word [ebp - 0x2a8], ax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x298], 0
cmp eax, 8
jb 0x401c65
inc eax
lea ecx, [ebp - 0x2c0]
push eax
push dword [ebp - 0x2c0]
call fcn.00403020
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x34], 8
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401d4e
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], eax
mov word [ebp - 0x30], ax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 8
push eax
push str.Name
lea ecx, [ebp - 0x18]
call fcn.00406a30
cmp dword [ebx + 0x14], 8
jb 0x401cd2
mov ecx, dword [ebx]
jmp 0x401cd4
mov ecx, ebx
cmp dword [ebp - 0x1c], 8
lea edx, [ebp - 0x30]
mov edi, dword [ebx + 0x10]
mov esi, edi
cmovae edx, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x20]
cmp ebx, edi
cmovb esi, ebx
test esi, esi
jne 0x401d00
xor eax, eax
test eax, eax
jne 0x401d2d
cmp edi, ebx
jbe 0x401d21
or eax, 0xffffffff
jmp 0x401d25
mov ax, word [edx]
cmp ax, word [ecx]
jne 0x401d13
add edx, 2
add ecx, 2
sub esi, 1
jmp 0x401cee
movzx eax, word [edx]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x401cf2
sbb eax, eax
neg eax
test eax, eax
je 0x401deb
mov eax, dword [ebp - 0x1c]
cmp eax, 8
jb 0x401d42
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00403020
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x284]
mov ecx, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x284], eax
test ecx, ecx
je 0x401d9a
test eax, eax
js 0x401d9a
lea edx, [ebp - 0x2c8]
mov dword [ebp - 0x290], 0x208
push edx
push 0
push 0
push 0
lea edx, [ebp - 0x290]
push edx
lea edx, [ebp - 0x280]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x401da3
xor eax, eax
mov word [ebp - 0x280], ax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x401db8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x401dc9
push eax
call edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x401af0
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00403020
jmp 0x401af0
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x28c], 0
push eax
push ecx
lea ecx, [ebp - 0x18]
call fcn.004069c0
xor eax, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 9
push eax
push str.PnpInstanceID
lea ecx, [ebp - 0x18]
call fcn.00406a30
cmp dword [ebp - 0x28c], 2
jne 0x401e50
push 7
sub esp, 8
lea ecx, [ebp - 0x60]
call fcn.00402720
cmp eax, 0xffffffff
jne 0x401e50
mov esi, 1
jmp 0x401e52
xor esi, esi
mov eax, dword [ebp - 0x4c]
cmp eax, 8
jb 0x401e67
inc eax
lea ecx, [ebp - 0x60]
push eax
push dword [ebp - 0x60]
call fcn.00403020
xor eax, eax
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0
cmp eax, 8
jb 0x401e90
inc eax
lea ecx, [ebp - 0x30]
push eax
push dword [ebp - 0x30]
call fcn.00403020
xor eax, eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x401eb9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x401ed0
push eax
call edi
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x401ee9
inc eax
lea ecx, [ebp - 0x48]
push eax
push dword [ebp - 0x48]
call fcn.00403020
jmp 0x401ee9
xor esi, esi
mov ecx, dword [ebp - 0x288]
test ecx, ecx
je 0x401ef6
push ecx
call edi
mov ecx, dword [ebp - 0x64]
cmp ecx, 8
jb 0x401f0b
inc ecx
push ecx
push dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
call fcn.00403020
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f5c8b
mov esp, ebp
pop ebp
ret