Function at 0x401100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
call fcn.00401000
mov bl, al
mov al, byte [0x407030]
cmp bl, al
je 0x40112b
cmp bl, byte [0x407031]
je 0x40112b
cmp bl, byte [0x407032]
je 0x40112b
push 0x407660
jmp 0x4017d7
push edi
push 0x407644
call fcn.00401800
add esp, 4
mov edi, 1
push 0x408478
push edi
push 0
push 0x407040
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401743
push esi
push 0x407040
push 0x407620
call fcn.00401800
push 0x407600
call fcn.00401800
mov eax, dword [0x408478]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x407038
push 0x40847c
push 0x407034
push 0
push 0x4075f8
push eax
call esi
test eax, eax
jne 0x4011ff
mov ecx, dword [0x40706c]
mov eax, dword [0x40847c]
cmp ecx, eax
jne 0x4011c6
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x4011de
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov edx, dword [0x40706c]
mov eax, dword [0x40847c]
push 0x408450
push edx
push eax
push 0x4075b4
call fcn.00401800
add esp, 0x10
jmp 0x40120c
push 0x407594
call fcn.00401800
add esp, 4
mov ecx, dword [0x408478]
push 0x407038
push 0x408444
push 0x407034
push 0
push 0x40758c
push ecx
call esi
test eax, eax
jne 0x4012e8
cmp bl, byte [0x407030]
jne 0x401297
mov edx, dword [0x407070]
mov eax, dword [0x408444]
cmp edx, eax
jne 0x40125e
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x401276
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov eax, dword [0x407070]
push 0x408450
mov ecx, dword [0x408444]
push eax
push ecx
push 0x407558
call fcn.00401800
add esp, 0x10
jmp 0x4012f5
mov edx, dword [0x407074]
mov eax, dword [0x408444]
cmp edx, eax
jne 0x4012c4
push 0x4075f4
push 0x408450
call fcn.00401933
mov eax, dword [0x407074]
add esp, 8
push 0x408450
jmp 0x401280
push 0x4075ec
push 0x408450
call fcn.00401933
mov eax, dword [0x407074]
add esp, 8
mov dword [0x408278], edi
push 0x408450
jmp 0x401280
push 0x407538
call fcn.00401800
add esp, 4
mov edx, dword [0x408478]
push 0x40703c
push 0x4084a0
push 0
push 0
push 0x407530
push edx
call esi
test eax, eax
jne 0x401373
push 0x4084a0
push 0x407078
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40133d
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x401355
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
push 0x408450
push 0x407078
push 0x4084a0
push 0x407500
call fcn.00401800
add esp, 0x10
jmp 0x401380
push 0x4074e0
call fcn.00401800
add esp, 4
mov eax, dword [0x408478]
push 0x407038
push 0x408480
push 0x407034
push 0
push 0x4074d0
push eax
call esi
test eax, eax
jne 0x4013fe
mov ecx, dword [0x408280]
mov eax, dword [0x408480]
cmp ecx, eax
jne 0x4013c5
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x4013dd
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov edx, dword [0x408280]
mov eax, dword [0x408480]
push 0x408450
push edx
push eax
push 0x40749c
call fcn.00401800
add esp, 0x10
jmp 0x40140b
push 0x407478
call fcn.00401800
add esp, 4
mov ecx, dword [0x408478]
push 0x407038
push 0x408468
push 0x407034
push 0
push 0x407474
push ecx
call esi
test eax, eax
jne 0x40148a
mov edx, dword [0x407088]
mov eax, dword [0x408468]
cmp edx, eax
jne 0x401451
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x401469
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov eax, dword [0x407088]
mov ecx, dword [0x408468]
push 0x408450
push eax
push ecx
push 0x407440
call fcn.00401800
add esp, 0x10
jmp 0x401497
push 0x407424
call fcn.00401800
add esp, 4
mov edx, dword [0x408478]
push 0x407038
push 0x408474
push 0x407034
push 0
push 0x407414
push edx
call esi
test eax, eax
jne 0x401517
mov eax, dword [0x40708c]
mov ecx, dword [0x408474]
cmp eax, ecx
jne 0x4014dd
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x4014f5
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov ecx, dword [0x40708c]
mov edx, dword [0x408474]
push 0x408450
push ecx
push edx
push 0x4073e0
call fcn.00401800
add esp, 0x10
jmp 0x401524
push 0x4073b8
call fcn.00401800
add esp, 4
mov eax, dword [0x408478]
push 0x407038
push 0x408460
push 0x407034
push 0
push 0x4073b0
push eax
call esi
test eax, eax
jne 0x4015a2
mov ecx, dword [0x407090]
mov eax, dword [0x408460]
cmp ecx, eax
jne 0x401569
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x401581
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov edx, dword [0x407090]
mov eax, dword [0x408460]
push 0x408450
push edx
push eax
push 0x40737c
call fcn.00401800
add esp, 0x10
jmp 0x4015af
push 0x40735c
call fcn.00401800
add esp, 4
mov ecx, dword [0x408478]
push 0x407038
push 0x40846c
push 0x407034
push 0
push 0x407130
push ecx
call esi
test eax, eax
jne 0x40161b
mov edx, dword [0x407094]
mov eax, dword [0x40846c]
cmp edx, eax
jne 0x4015f5
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x4015fa
call fcn.00401090
mov eax, dword [0x407094]
mov ecx, dword [0x40846c]
push 0x408450
push eax
push ecx
push 0x407328
call fcn.00401800
add esp, 0x10
jmp 0x401628
push 0x407308
call fcn.00401800
add esp, 4
mov edx, dword [0x408478]
push 0x407038
push 0x408470
push 0x407034
push 0
push 0x4072fc
push edx
call esi
test eax, eax
jne 0x4016a8
mov eax, dword [0x408284]
mov ecx, dword [0x408470]
cmp eax, ecx
jne 0x40166e
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x401686
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov ecx, dword [0x408284]
mov edx, dword [0x408470]
push 0x408450
push ecx
push edx
push 0x4072c8
call fcn.00401800
add esp, 0x10
jmp 0x4016b5
push 0x4072a4
call fcn.00401800
add esp, 4
mov eax, dword [0x408478]
push 0x407038
push 0x408464
push 0x407034
push 0
push 0x40729c
push eax
call esi
test eax, eax
pop esi
jne 0x401734
mov ecx, dword [0x408288]
mov eax, dword [0x408464]
cmp ecx, eax
jne 0x4016fb
push 0x4075f4
push 0x408450
call fcn.00401933
add esp, 8
jmp 0x401713
push 0x4075ec
push 0x408450
call fcn.00401933
add esp, 8
mov dword [0x408278], edi
mov edx, dword [0x408288]
mov eax, dword [0x408464]
push 0x408450
push edx
push eax
push 0x407268
call fcn.00401800
add esp, 0x10
jmp 0x401760
push 0x407248
call fcn.00401800
add esp, 4
jmp 0x401760
push 0x407040
push 0x407228
call fcn.00401800
add esp, 8
mov dword [0x40827c], edi
call fcn.00401090
mov ecx, dword [0x408478]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x408278], edi
jne 0x401782
push 0x4071dc
call fcn.00401800
add esp, 4
cmp dword [0x408274], edi
jne 0x401797
push 0x4071a4
call fcn.00401800
add esp, 4
mov eax, dword [0x408270]
cmp eax, edi
pop edi
jne 0x4017ae
push 0x407164
call fcn.00401800
add esp, 4
mov eax, dword [0x408278]
test eax, eax
jne 0x4017df
mov eax, dword [0x408274]
test eax, eax
jne 0x4017df
mov eax, dword [0x408270]
test eax, eax
jne 0x4017df
mov eax, dword [0x40827c]
test eax, eax
jne 0x4017df
push 0x407158
call fcn.00401800
add esp, 4
push 0x407138
call fcn.00401800
add esp, 4
call fcn.00405396
pop ebx
ret