Function at 0x408e00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43e9e6
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x453d48]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x453d48]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x140]
mov edi, dword [esp + 0x144]
xor ebx, ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], ebx
call fcn.00415084
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x408e6d
push 0x80004005
call fcn.00401060
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push SysReAllocStringLen
mov dword [esp + 0x148], ebx
mov dword [esp + 0x2c], 0x104
call edi
test eax, eax
je 0x408ee5
add esi, 0xfffffff0
push esi
call fcn.00401fe0
add eax, 0x10
mov dword [ebp], eax
add esp, 4
mov dword [esp + 0x138], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408ede
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, ebp
jmp 0x409028
call fcn.00415084
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x408eff
push 0x80004005
call fcn.00401060
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push str._s_shellopencommand
push edx
mov byte [esp + 0x144], 1
call fcn.00401480
mov ebp, dword [esp + 0x24]
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebp
push SysReAllocStringLen
mov dword [esp + 0x2c], 0x104
call edi
test eax, eax
je 0x408f7e
add esi, 0xfffffff0
push esi
call fcn.00401fe0
mov edi, dword [esp + 0x24]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x10]
add esp, 4
mov byte [esp + 0x138], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x408ffa
lea eax, [esp + 0x28]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408f85
sub eax, edx
push eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c]
call fcn.004025d0
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], ebx
jl 0x408fbc
push 0x442b18
push esi
call fcn.0042a0a5
add esp, 8
cmp eax, ebx
je 0x408fbc
sub eax, esi
jns 0x408fce
push 0x442b14
lea ecx, [esp + 0x18]
call fcn.00404160
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
push esi
call fcn.00401fe0
mov edi, dword [esp + 0x24]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x10]
add esp, 4
mov byte [esp + 0x138], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409006
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or edx, 0xffffffff
lea ecx, [esi + 0xc]
mov dword [esp + 0x138], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409026
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, edi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0042997e
add esp, 0x128
ret