Function at 0x409a90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
lea eax, [ebp - 8]
mov dword [ebp - 0x274], esp
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x284], sym.___gxx_personality_sj0
mov dword [ebp - 0x280], 0x4f13a8
mov dword [ebp - 0x278], 0x409f77
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x250], eax
mov byte [esp + 8], 0
mov dword [esp + 4], 0x4f637d
mov dword [esp], str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov dword [ebp - 0x298], 0xffffffff
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char_const__char_const__char_const__std::forward_iterator_tag_
mov eax, dword [ebp + 8]
sub esp, 0xc
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
lea eax, [ebp - 0x260]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x250]
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x2a4], eax
call eax
sub esp, 0x14
test eax, eax
jne 0x409e04
mov dword [ebp - 0x2a0], 0
lea esi, [esi]
lea eax, [ebp - 0x208]
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2a0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
mov dword [ebp - 0x298], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
sub esp, 0x10
test eax, eax
jne 0x409de8
lea eax, [ebp - 0x100]
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x250]
mov byte [esp + 8], 0
mov edx, dword [ebp - 0x24c]
mov dword [esp], eax
add edx, eax
mov dword [esp + 4], edx
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char__char__char__std::forward_iterator_tag_
sub esp, 0xc
cmp dword [ebp - 0x104], 0x3fffffff
je 0x409f61
mov dword [esp + 4], 1
lea ecx, [ebp - 0x108]
mov dword [esp], 0x4f62f1
mov dword [ebp - 0x298], 5
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
sub esp, 8
lea edx, [ebp - 0x208]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x409c31
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
lea eax, [ebp - 0x208]
sbb edx, 3
sub edx, eax
mov eax, 0x3fffffff
sub eax, dword [ebp - 0x104]
cmp edx, eax
ja 0x409f4b
lea eax, [ebp - 0x208]
mov dword [esp + 4], edx
lea ecx, [ebp - 0x108]
mov dword [esp], eax
mov dword [ebp - 0x298], 2
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_append_char_const__unsigned_int_
lea ecx, [ebp - 0x230]
sub esp, 8
mov dword [ebp - 0x238], ecx
mov edx, dword [eax]
lea ecx, [eax + 8]
cmp edx, ecx
je 0x409e30
mov dword [ebp - 0x238], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x230], edx
mov edx, dword [eax + 4]
mov byte [eax + 8], 0
mov dword [ebp - 0x234], edx
mov dword [eax], ecx
lea ecx, [ebp - 0x100]
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x108]
cmp eax, ecx
je 0x409cf7
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x25c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x238]
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x298], 3
call eax
sub esp, 0x14
test eax, eax
je 0x409d68
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x230]
add dword [ebp - 0x2a0], 1
cmp eax, edx
je 0x409b80
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x409b80
lea eax, [ebp - 0x254]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Debugger
mov eax, dword [ebp - 0x25c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x2a8], eax
call eax
mov edx, dword [ebp - 0x25c]
sub esp, 0x18
test eax, eax
jne 0x409dc9
mov eax, dword [ebp - 0x258]
sub eax, 1
cmp eax, 1
jbe 0x409e60
mov dword [esp], edx
mov dword [ebp - 0x298], 3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x409d3b
mov eax, dword [ebp - 0x260]
mov dword [esp], eax
mov dword [ebp - 0x298], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x248]
cmp eax, ecx
je 0x409e1c
mov dword [esp], eax
call sym.operator_delete_void_
lea eax, [ebp - 0x29c]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp + 8]
leave
ret
mov edx, dword [eax + 8]
mov dword [ebp - 0x230], edx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x22c], edx
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x228], edx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x224], edx
jmp 0x409cc9
lea eax, [ebp - 0x254]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x108]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.Debugger
mov dword [esp], edx
mov eax, dword [ebp - 0x2a8]
call eax
sub esp, 0x18
test eax, eax
je 0x409eb0
mov edx, dword [ebp - 0x25c]
jmp 0x409dc9
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x220]
mov dword [esp], eax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const___clone_.isra.0_
mov eax, dword [ebp + 8]
sub esp, 4
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
je 0x409f27
lea eax, [ecx + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x220]
mov byte [esp + 8], 0
mov edx, dword [ebp - 0x21c]
mov dword [esp], eax
add edx, eax
mov dword [esp + 4], edx
mov dword [ebp - 0x298], 4
call method.void_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_construct_char__char__char__std::forward_iterator_tag_
mov eax, dword [ebp + 8]
sub esp, 0xc
add dword [eax + 4], 0x18
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x218]
cmp eax, edx
je 0x409e9e
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x409e9e
lea eax, [ebp - 0x220]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x298], 4
call sym.__ZNSt6vectorINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEESaIS5_EE17_M_realloc_insertIJRKS5_EEEvN9__gnu_cxx17__normal_
sub esp, 8
jmp 0x409f0a
mov dword [esp], 0x4f62d4
mov dword [ebp - 0x298], 2
call method.std.__throw_length_error_char_const_
mov dword [esp], 0x4f62d4
mov dword [ebp - 0x298], 5
call method.std.__throw_length_error_char_const_
add ebp, 8
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x298]
test eax, eax
jne 0x409fc8
mov ecx, dword [ebp + 8]
call method.std::vector_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::allocator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_______.vector__
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 0x248]
cmp eax, edx
je 0x409fb0
mov dword [esp], eax
call sym.operator_delete_void_
mov eax, dword [ebp - 0x2a0]
mov dword [esp], eax
mov dword [ebp - 0x298], 0xffffffff
call dbg._Unwind_SjLj_Resume
sub eax, 1
jne 0x409fe7
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x100]
cmp eax, edx
je 0x409f90
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x409f90
sub eax, 1
jne 0x409ffe
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x230]
cmp eax, edx
jne 0x409fdd
jmp 0x409f90
sub eax, 1
jne 0x40a01d
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x218]
cmp eax, edx
je 0x409fec
mov dword [esp], eax
call sym.operator_delete_void_
jmp 0x409fec
sub eax, 1
je 0x409fcd
ud2