Function at 0x40ba3b5d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x40bb1020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x20]
xor ebx, ebx
and eax, 7
push edi
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x13c], ebx
cmp al, 1
jne 0x40ba3dbb
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x134]
push eax
push 0x40ba2c28
push 0x80000002
call edi
test eax, eax
jne 0x40ba4b13
lea eax, [esi + 0x4c]
push eax
push 0x90
lea eax, [ebp - 0x124]
push eax
call fcn.40ba2f04
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x124]
push eax
push dword [ebp - 0x134]
call edi
test eax, eax
jne 0x40ba4b2b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x40bb1344
push dword [ebp - 0x130]
mov dword [ebp - 0x128], ebx
call edi
test eax, eax
jne 0x40ba4b21
cmp dword [ebp - 0x12c], ebx
jne 0x40ba4b21
cmp dword [ebp - 0x128], ebx
jne 0x40ba4b21
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x40bb135c
push dword [ebp - 0x130]
mov dword [ebp - 0x128], ebx
call edi
test eax, eax
jne 0x40ba4b2b
cmp dword [ebp - 0x12c], ebx
jne 0x40ba4b2b
cmp dword [ebp - 0x128], ebx
jne 0x40ba4b2b
mov eax, dword [ebp - 0x140]
test eax, eax
je 0x40ba3cff
mov ebx, eax
shl ebx, 3
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x138], eax
test eax, eax
je 0x40ba4ded
lea ecx, [ebp - 0x128]
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x40bb138c
push dword [ebp - 0x130]
mov dword [ebp - 0x128], ebx
call edi
test eax, eax
jne 0x40ba4b21
cmp dword [ebp - 0x12c], 3
jne 0x40ba4b21
cmp ebx, dword [ebp - 0x128]
jne 0x40ba4b21
push 4
pop ebx
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x40bb1374
push dword [ebp - 0x130]
mov dword [ebp - 0x128], ebx
call edi
test eax, eax
jne 0x40ba4b21
cmp dword [ebp - 0x12c], ebx
jne 0x40ba4b21
cmp dword [ebp - 0x128], ebx
jne 0x40ba4b21
mov eax, dword [ebp - 0x144]
test eax, eax
jne 0x40ba4df2
mov ecx, dword [ebp - 0x148]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 0x140]
mov dword [esi + 0x2c], ecx
mov ecx, dword [ebp - 0x138]
mov dword [esi + 0x34], eax
mov eax, dword [ebp - 0x13c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x38], eax
xor edi, edi
cmp dword [ebp - 0x130], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40ba3d97
push dword [ebp - 0x130]
call esi
cmp dword [ebp - 0x134], 0
je 0x40ba3da8
push dword [ebp - 0x134]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.40ba1e8c
leave
ret 4
push 8
pop edi
jmp 0x40ba3da8
push 7
mov dword [ebp - 0x134], ebx
pop edi
jmp 0x40ba3d80
mov edi, 0x200
jmp 0x40ba4e5a
mov edi, 0x200
jmp 0x40ba3d80
push 7
pop edi
jmp 0x40ba4e5a
mov ebx, eax
shl ebx, 3
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x13c], eax
test eax, eax
je 0x40ba4ded
lea ecx, [ebp - 0x128]
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x40bb13b4
push dword [ebp - 0x130]
mov dword [ebp - 0x128], ebx
call edi
test eax, eax
jne 0x40ba4b21
cmp dword [ebp - 0x12c], 3
jne 0x40ba4b21
cmp ebx, dword [ebp - 0x128]
jne 0x40ba4b21
mov eax, dword [ebp - 0x144]
jmp 0x40ba3d57
cmp dword [ebp - 0x138], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x40ba4e71
push dword [ebp - 0x138]
call esi
cmp dword [ebp - 0x13c], 0
je 0x40ba3d80
push dword [ebp - 0x13c]
call esi
jmp 0x40ba3d80