Function at 0x403de9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45de35
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x334
push edi
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x310], 0
lea ecx, [ebp - 0x114]
call fcn.00402210
mov dword [ebp - 4], 0
mov al, byte [0x47964c]
mov byte [ebp - 0x308], al
mov ecx, 0x7c
xor eax, eax
lea edi, [ebp - 0x307]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1f4
lea ecx, [ebp - 0x308]
push ecx
push 0x14b
mov ecx, 0x479934
call fcn.0041c0a1
lea edx, [ebp - 0x308]
push edx
push 0x47130c
lea eax, [ebp - 0x114]
push eax
call fcn.0044fdfe
add esp, 0xc
lea ecx, [ebp - 0x30c]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x114]
call fcn.00402270
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4040a7
mov dword [ebp - 0x110], 0x100
mov dword [ebp - 0x31c], 0
jmp 0x403ecf
mov edx, dword [ebp - 0x31c]
add edx, 1
mov dword [ebp - 0x31c], edx
cmp dword [ebp - 0x31c], 3
jge 0x403f0c
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
jne 0x403f0a
jmp 0x403f0c
jmp 0x403ec0
mov eax, dword [ebp - 0x30c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x338]
add ecx, 0xc
call fcn.00407170
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x314], 0
jne 0x404096
lea ecx, [ebp - 0x10c]
push ecx
lea ecx, [ebp - 0x324]
call fcn.0045518e
mov byte [ebp - 4], 1
mov dword [ebp - 0x320], 0
mov dword [ebp - 0x328], 0
jmp 0x403f75
mov edx, dword [ebp - 0x328]
add edx, 1
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x328]
cmp eax, dword [ebp - 0x318]
jge 0x40406d
mov ecx, dword [ebp - 0x328]
push ecx
lea edx, [ebp - 0x330]
push edx
mov ecx, dword [ebp - 0x338]
add ecx, 0xc
call fcn.004071b0
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x340]
call fcn.00402270
push eax
lea ecx, [ebp - 0x324]
call fcn.00402280
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x32c], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x330]
call fcn.00455120
mov ecx, dword [ebp - 0x32c]
and ecx, 0xff
test ecx, ecx
je 0x404068
cmp dword [ebp + 8], 0
je 0x404029
mov ecx, 0x479910
call fcn.00402270
push eax
lea ecx, [ebp - 0x324]
call fcn.00402270
push eax
push 0x471310
push 0x471320
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x404050
mov ecx, 0x479910
call fcn.00402270
push eax
lea ecx, [ebp - 0x324]
call fcn.00402270
push eax
push 0x47132c
push 0x47133c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp - 0x328]
mov dword [ebp - 0x310], edx
mov dword [ebp - 0x320], 1
jmp 0x40406d
jmp 0x403f66
cmp dword [ebp - 0x320], 0
jne 0x404085
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x338]
call fcn.004040eb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x324]
call fcn.00455120
jmp 0x4040a5
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x338]
call fcn.004040eb
jmp 0x4040b6
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x338]
call fcn.004040eb
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x334], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.00455120
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 4