Function at 0x40f290
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1020c]
mov eax, 0x1020c
call fcn.004110f0
push 0xffffffffffffffff
push 0x42067b
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x42a42c]
xor eax, ebp
mov dword [ebp + 0x10208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x10214]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], ebx
mov eax, dword [0x42b8d0]
mov edx, dword [eax + 0xc]
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, 0x42b8d0
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], esi
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x20], edi
mov byte [ebp - 4], 2
jmp 0x40f310
mov edx, dword [ebx]
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x40f578
mov eax, dword [edi - 8]
mov edx, dword [ebp - 0x34]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x40f355
push edx
lea ecx, [ebp - 0x20]
call fcn.004026e0
mov edi, dword [ebp - 0x20]
mov edx, dword [ebx]
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push edi
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40f565
mov eax, dword [edi - 8]
push eax
push edi
call fcn.004113ca
xor esi, esi
add esp, 8
cmp eax, esi
jl 0x40f56e
cmp eax, dword [edi - 8]
jg 0x40f56e
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov eax, dword [ebx]
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x14]
push ecx
push esi
push 0x2001f
push esi
push esi
push esi
push edi
push eax
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x40f3de
mov eax, dword [ebp - 0x2c]
cmp eax, esi
je 0x40f3d5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], esi
mov ecx, dword [0x429014]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0x10218]
mov byte [ebp - 4], 4
cmp ecx, eax
je 0x40f481
cmp dword [ecx - 0xc], 0
lea esi, [ecx - 0xc]
jge 0x40f40d
lea edx, [ecx - 0xc]
cmp edx, dword [0x429010]
jne 0x40f413
cmp dword [eax - 0xc], 0
jge 0x40f44f
mov ebx, dword [eax - 8]
push ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.00408520
test eax, eax
je 0x40f481
lea esi, [ebx + ebx]
lea eax, [esi + 2]
cmp eax, esi
jb 0x40f441
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
push esi
push ecx
push edx
call fcn.00411da0
add esp, 0xc
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov dword [eax - 8], ebx
mov word [esi + eax], cx
jmp 0x40f481
add ecx, 0xfffffff4
cmp ecx, dword [0x429010]
je 0x40f474
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f46e
push esi
call fcn.00410a7b
add esp, 4
mov eax, dword [ebp + 0x10218]
mov dword [ebp - 0x14], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
call esi
push edi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
push 0x422268
push 0x422268
call esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
mov edi, dword [ebp - 0x14]
cmp dword [edi - 0xc], 0
lea ebx, [edi - 0xc]
push ecx
mov dword [ebp - 0x38], esp
mov esi, esp
mov dword [ebp - 0x18], ebx
jl 0x40f4c9
push ebx
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x40f513
mov edx, dword [0x429014]
push edi
mov dword [esi], edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push ebx
mov ecx, esi
call fcn.00408520
test eax, eax
je 0x40f510
mov eax, dword [esi]
lea edi, [ebx + ebx]
lea ecx, [edi + 2]
cmp ecx, edi
jb 0x40f500
mov edx, dword [ebp - 0x14]
push edi
push edx
push eax
call fcn.00411da0
add esp, 0xc
mov eax, dword [esi]
mov dword [eax - 8], ebx
mov ecx, dword [esi]
xor edx, edx
mov word [edi + ecx], dx
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040f290
add edi, 0xfffffff4
mov byte [ebp - 4], 3
cmp edi, dword [0x429010]
je 0x40f542
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f542
push ebx
call fcn.00410a7b
add esp, 4
mov eax, dword [ebp - 0x2c]
xor esi, esi
mov byte [ebp - 4], 2
cmp eax, esi
je 0x40f559
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c], esi
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x28], esi
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x40f310
push 0x80070057
call fcn.00401180
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp + 0x10002]
push edx
mov word [ebp + 0x10000], cx
call fcn.004109b0
add esp, 0xc
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x7c]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebx]
push 0
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp + 0x10000]
push eax
push ecx
mov dword [ebp - 0x5c], 0x104
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x3c], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x40], 0
je 0x40f96a
xor eax, eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x40]
jae 0x40f96a
xor edx, edx
push edx
push edx
lea ecx, [ebp - 0x58]
push ecx
push edx
mov word [ebp], dx
lea edx, [ebp - 0x3c]
push edx
mov edx, dword [ebx]
lea ecx, [ebp]
push ecx
push eax
push edx
mov dword [ebp - 0x3c], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40f951
mov eax, dword [ebp - 0x58]
cmp eax, 1
jne 0x40f7eb
xor eax, eax
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x24]
lea edx, [ebp + 0x8000]
mov word [ebp + 0x8000], ax
push edx
lea eax, [ebp]
push eax
mov dword [ebp - 0x18], 0x3fff
call fcn.0040d640
test eax, eax
jne 0x40f951
mov ecx, dword [ebp + 0x10218]
cmp dword [ecx - 0xc], 0
lea eax, [ecx - 0xc]
jl 0x40f683
push eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x40f695
mov edx, dword [0x429014]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edx
call fcn.004096e0
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov byte [ebp - 4], 5
test esi, esi
jne 0x40f6aa
xor eax, eax
jmp 0x40f6ad
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0
je 0x40f6d5
push 0x422268
push 0x422268
call edi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
lea ecx, [ebp]
push ecx
mov edx, ecx
push edx
call edi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea eax, [ebp + 0x8000]
push eax
call edi
mov esi, eax
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x40f709
push 0x8007000e
call fcn.00401180
lea edx, [ebp - 0x54]
xor ecx, ecx
push edx
mov byte [ebp - 4], 6
mov word [ebp - 0x54], cx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, 8
push esi
mov word [ebp - 0x54], ax
call dword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x40f756
mov ecx, 0xa
push 0x8007000e
mov word [ebp - 0x54], cx
mov dword [ebp - 0x4c], 0x8007000e
call fcn.00401180
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 7
test eax, eax
jne 0x40f7a1
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x18]
push edx
add ecx, 0x18
mov byte [ebp - 4], 8
call fcn.0040e7e0
mov ebx, eax
lea eax, [ebp - 0x54]
cmp ebx, eax
je 0x40f7b7
mov ecx, eax
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
jge 0x40f7b7
mov edx, 0xa
push eax
mov word [ebx], dx
mov dword [ebx + 8], eax
call fcn.00401180
push eax
call edi
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40f766
push 0x8007000e
call fcn.00401180
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push esi
call edi
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 2
cmp ecx, dword [0x429010]
je 0x40f951
lea esi, [eax - 0xc]
jmp 0x40f93d
cmp eax, 4
jne 0x40f951
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [eax]
push 0
lea edx, [ebp]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f951
cmp dword [ebp - 0x38], 4
jne 0x40f951
mov ecx, dword [ebp + 0x10218]
cmp dword [ecx - 0xc], 0
lea eax, [ecx - 0xc]
jl 0x40f842
push eax
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x40f854
mov edx, dword [0x429014]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edx
call fcn.004096e0
mov esi, dword [ebp - 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov byte [ebp - 4], 9
test esi, esi
jne 0x40f869
xor eax, eax
jmp 0x40f86c
push esi
call edi
push esi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0
je 0x40f894
push 0x422268
push 0x422268
call edi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
lea ecx, [ebp]
push ecx
mov edx, ecx
push edx
call edi
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ec0
mov ecx, dword [ebp - 0x44]
mov eax, 0x13
mov word [ebp - 0x70], ax
mov dword [ebp - 0x68], ecx
mov ebx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xa
test ebx, ebx
jne 0x40f900
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x18]
push edx
add ecx, 0x18
mov byte [ebp - 4], 0xb
call fcn.0040e7e0
mov esi, eax
lea eax, [ebp - 0x70]
cmp esi, eax
je 0x40f91a
mov ecx, eax
push ecx
push esi
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
jge 0x40f91a
mov edx, 0xa
push eax
mov word [esi], dx
mov dword [esi + 8], eax
call fcn.00401180
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
jne 0x40f8c5
push 0x8007000e
call fcn.00401180
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebx - 0xc]
mov byte [ebp - 4], 2
cmp ecx, dword [0x429010]
je 0x40f951
lea esi, [ebx - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f951
push esi
call fcn.00410a7b
add esp, 4
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
jmp 0x40f5f6
mov eax, dword [ebx]
test eax, eax
je 0x40f97d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebx], 0
add edi, 0xfffffff0
mov dword [ebx + 4], 0
mov byte [ebp - 4], 1
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40f9a4
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov eax, dword [ebp + 0x10218]
lea ecx, [eax - 0xc]
mov dword [ebp - 4], 0xffffffff
cmp ecx, dword [0x429010]
je 0x40f9dc
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40f9dc
mov edx, dword [ebp + 0x10218]
add edx, 0xfffffff4
push edx
call fcn.00410a7b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x10208]
xor ecx, ebp
call fcn.00410992
add ebp, 0x1020c
mov esp, ebp
pop ebp
ret 8