Function at 0x405110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416059
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x478010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 4
lea ecx, [ebp - 0x18]
call fcn.00406d60
lea ecx, [ebp - 0x18]
call fcn.00403770
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x48], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00403610
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4051ea
push 0x446b1c
mov ecx, dword [ebp + 8]
call fcn.004036f0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ac0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ac0
mov eax, dword [ebp + 8]
jmp 0x40538a
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x40], str.nSVsw1zcF3nQqOk71d0TOsmG1FM2G3Wuhkp3bl6JWjQegtVjPE3MLNa54wBBdiCBjtJgVUO0Ck2q1KFjK3owDW9Y3i6I2q6T0PLgWw3rgMD0Qi97dExrqN7md8lSR0gFgR82zEB3iNFPyX1Q7BJGhVoLJDKR5F1joWdogwQr5Xo9zNVFG41ftDQlDRXNGoih6sa1B0DLQjmuY5zPA69VrVPLPkT9lf07sGTlmGkNIilHugCFOKGnJvfn9YKGkz7sXT7GpTPQHRr0s0NAP0X45Ls0jfWxyQz0tkfbMDxOHrWUCtiAWEocqoa4BYvCfy9yC6cpjnjYAk41qTiozaqLsl9pHk2LAkA0G5hhuAnY0suJ9kf5XDEhC2TpHhvOB1wEH4MNIduNseSlL2qnF4T6B9xfsENyYwn4iA219jIbHGs2e2V8SVxtvABM5gQ8ovqWMBVRkbsxGVqooaGnyhvxSySwRVI4rsK8dG0bjotVx37r80tfkCljKvxxjwvkHxhyiPiGAMN4C7WxdRP3v1aJA93D5TofHKJntDs17sQguhntoSdd80DBjudc7VFwTOJNT8IDiMkuRFYpnUOjXG2CjKbiuvFhJgEgpVSXXpinIsoTOCK3rEdnotozwxO1zlIhx7liqd7bdLjSinThH0AmPqEoIXCCK71wyj2NsmvNIOxHpnX1Bm9UoF6IOJEnzmpNoEvwgjuKLNX6DxwnGRulgv89HLAXfDC6HMTsuJrfaVvatzVEecJL3xyVu4aqYjdtQSRqhB25RqcqjVqfavEgRAtXxBbfUtwcTBIbb8hI3xaMwR2IbuxIhLjMlpwfaXMDCahleQxh5xzwsnBLCki0gtOxEsdEKr1itgYrTtutxHFjndQezLnNgk63oPf8Hi4QC8QS847HekPfvTh6M2PJdfyLFyLEXGC5WvsXjTKY7HrK2KftLRhitpWNRG0FsxcX1EXTfw4Xpa1I6NVDFyWSPfkRvldV2x8x7l8JfL2Yt38nNUkYnQAKys7lkAMFwaB3fRft3JXXVHpmaDi3u5y6o21fhx8rFDBR41eXRKvtAwBGcmsvg1OXuc7ewlMdeVXtX8yYksDLpSwMQckcI2SjurKAp8llQNlv32g9wJDHDa3r12d5xVOXsyGgt4tBcNcM74103IaMEO9Qywhf87kFVyVOvkW7NbRdE7YYRP8a6gQCi6tXzqC2TJRts6zqf0sPRyYotLQCKWiIXUCBGgzAMGb7uAhr06XTEinsLtVAEkFwjXlGYwyIudTdY13tu3aIDJ6g88i82TfLXV6TDDyILo5bzjESaAy6AyMPFi2xLeOVRINrauaUQ0hbUOgo4QYed1DE0s3tmAia6CcvUeR4zonDPSdduLYKLRGjHXvYlvOGYNS8yYET9tk2NfAVSfv28Bxy9z7BCpXmAXGFfiF8ITElmJTMuevrCSEcylTu2IjSBNxx4tXvFbpMLth7FaJ419SeMco2KtpP78ShpD10fq2cc8qxWz1GF2IeXL5EdCs3L5PjCrx9rI7lNsxECIeOsICbx17XOe2l0DDJB8aVyoPbNh6YJMtDJ2Ry9dhL2p7uXBElIyoNcb5Row416HW4rjHhLY16kl4cEArDS6DC94mMM9JdjiYHXwdHBfn9alE7K5DPwKbKvrMvefOWHa6QfaoE9i6n3I2TKl5Rz5e0FW9NXVpzpKSyHm6p
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00403dd0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404f80
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00403dd0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004062f0
mov dword [ebp - 0x44], str.LyAqKSE4f33EYM5ntaW1OAzgoe5YzjdaD61xVOMPprVmAcgdnt2C1eATHYsV9ngG9xPKjUkL6cjP4w0GPkfre4PhJYmiRKtjAkxsoCTU0C9TJilVNhTYu3EXxqkHlfkl3IMNfX3N5o4wV8I0YKtulNgWsUy2aKI6mLnBoxanxtlV3IXTR1zTPqLE7jShWhUO8peqUzA5SaSwsQjDF8YPxGbYmRMKlQAHKnqumMvNQ7dSxkm7p1yFxQpjl6nR0DMSlfbKPx1PtgxOI76cQnlqrPdqrTqiAOWvNoPQXL501UGmpcVKxMxQm5izltkTLIVAP4T8QWAu2H7H3EDxMCqqUCduXm6JgGWbPi1Faaj1lyVh7EojD8tgh6pkwpr6MbCd1YVc15RI2KTG3qLKVkhf6FgHsNEq4JWDmOAa8VPcqSpLniHwi5zUy9YHv4IqPVmiAl2LDwDu9TsxzExc38fylQIPE3dVRtB2dVtQieB653KeaY2kmXj9GIu4cVp4W7SBsLe0i3VYnVAhHNhr6WVkihcPBca6QGLLoRNsmvJxprUjILOYWhotqAE3IF0vo7ecN6NeKJ2CRPkbLzymkX9FOkw1yx5YppBve7YYgrGzHG4Tt1MVqQLILIqwsgeqICDk2qg58Tu87T0JoVc2dBY43BOP2ERUcTtbgnFDaX6wzFE8aiRUpHEUXn5D5R5MGuCyO8opG55pNBaJp7gNuvMal0r4LnCv7H1UhFJUwgSWOxlqKtfSJ9wnv23JtXONlUVE5Ncl26QGSIBdSy5h9B8SkBWHOMHzkA69lcmz2KdFxG3otBn5wG3E9r5tKgUVXhAF0jXeV05nyhopcYcjp3QpSPf1qbKbeASvIrUAC9uK3IXVL4WX89exTC9JjF8R4dPRYJdFu6kbiwNQUmsYLh2a8gou79BGtXIU093bslnvUxxdmpUgazg50MsCNpqzsEbNIrIxYWl2LWqjSSUEWX2OrMKTDwpE0fgyVhGR1yNvYhpCfvsWueBAVsvw7U4g8Joe73vX0nd8Wl3Nd3UUV0ojrwUd1mwUUenNA4VmVcUzkkxLBp2fcGWAtm25nUxmpRsdmoPikpbU3IIBeyYBXyYM1PLHwYxyEUdlfYeFcW8Khk5AUukBFHiUBuY90kzCMGD2QAf83mN4ujKewmYPw4RHhmnSEYlTRA84tMb1WK7mo9udUkhLumOAA6ARAmbX36scgYumtOSx0DGrWFWVlboIBV6uba3xsMM84qISFNMYwVq1yK6IxU0VUGkC4szBfgEwwcB49yrwvtlgBYevoO9LBHxx8B2jAg2X4aY20viqJ4OF3ReDUWxtkYV1ykh0Ezg1O3QCSDKrfPLWOYnpVaX1b3yhLDShE42dJrlqUy4KmcQ3R0l3Ydo2P0nWsU1RMGuYxGKEKoo0DWh3cDdJqCUSryfcAPuLjt9MF0ujzSKhWcWiKJpClLLEGYSyopL9rvTWnr714l78pmojyaNOBQl4K7V4m0Xns01PDPiarFhyncMODUBmQT9CnpVcghN3DbcHfUTOolY2uNWK12tgtMPtKQgR7eFVgpwMHaUKanNqGAjfKDouCaeuE2eudcA2E7qhjXrqwpg86jYDTWMVfzehj83S6Pew8KMi9tJ2IDJWd1Gtzfrs1lW5wQMlC8RN2VPV1HdrxQv8G8NvPSzSpDBTyypBQoutHjdgvuqfgpJqwmlENjI0Dtyqe7NR8gEjxzUf0t2JJguYWMX6C3SvGFj2Q1GL6IAlUzpQBbQTgSIqtKXbqGp5lRuOgjKrD4aLebsXcTRqGpgQQ1hsnT4n6yTAODupSTS0SlgtsMcHnuQL7AtHDrXWf2sPobnGhdTDl8q9MO3Qcn7bzQMQq9ElPsfKlLFKtg0v3EUMnMOFxSywLu35VV42GNrfAJCurEABr765bl3EkszFzxMLoMvuoPoVx3kjnlMb2LJGUUp2X2t03m8u1KF6jbC78dKYKBfEj0Yg4OFGodrhzBQ150EbwjIONkNOl1mDLdnmR9Og47xLKjnkQIX5WttJv5ex8u7XWVPwkQV4XsJauNLACfs1cOLjJJHkpj7FoLHcgHf6xxTCXJJdFWodHfHFs8LMH3E0EmFQbi68PeLLy8BLkhrOEwpCdES2OADoksQRp42yk0YF0in3UKEXXggH0kmBQbCtXSIz1hHv4R4OeRF4N1sImQIamHqt6oN7dycgPYSPBrrcsPJYkKG5jynTmVd7d71lErwcv7v40TpdbwufTHy23s1AzJHp2yJqWAnznpErO2bL9wtqRKGvBsvy4qNHGh4NK9NwArwUaaQanPSkGN4nJhTPrRjNA9M9Ilha3Au7DdncaJxYKQ6tXtmdPySYpohjxrBzp63pnGE62QUAw0zACrc6Qu5W4vAnTP1J90PQ1ErzO76zsoCsKpSFFkoQLnnAxX9CqcBbHMoJANRx1iQLcp0LWe9kYcYqal0bdnhQ8j3bGwAkGYdazjiYQXAqptnzxAXeh5V4s2PYJcjWYR1fdODy5UPG527TpoPD4FKDql5BB7GEpq2zgs3sP0U6e5utzvNbSm6bdd12sP2QwdmEDBHlRHK4o7lBNLpyJ9pWzcIFEgjbQPxUXpRCp98tlVdLU6EtrTkTKpemUF7uY1tNGU1ldXKFaIhDJuRzxhCJwyopaCEOtxrE1WIiypcraXj861NqmMbPaT0BA1PpWg9OSbGXdiV2VsMkQPAAYL3htlJaG49H08Fw27Mxv2k8knKxTaKyioqQKh9KbmKlhat1V41SgzDSr9Yg6kcMTCB3PJFu4JrdpsqtQcxCNv0UHBNclGeEbi434jFXDrFm3bK1PuC2XVtfJRefzJzyj4pLibndo1v1SA9JCKH79AXqsnUxI0hLconMU6TH9jEFB1AFNCkzdJin3U9oJ7QywzRrOmfoXxu0VSwMFydNzgbxWBRjzK99JJTHoTkDbd0PyEL3kRdV8BcLTSB1dHpH5RDiycWkocPifTvlCEiKjMRn
cmp dword [ebp - 0x38], 0
je 0x4052b5
push 0x4476fc
mov ecx, dword [ebp + 8]
call fcn.004036f0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ac0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ac0
mov eax, dword [ebp + 8]
jmp 0x40538a
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403610
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ac0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ac0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ac0
mov eax, dword [ebp + 8]
jmp 0x40538a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a5ce
mov esp, ebp
pop ebp
ret 0x10