Function at 0x40f8a5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebp
add dword [esp], 0xffffffe4
push ebp
add dword [esp], 0xffffffe8
push 0
push 0x4001f
push 0
push 0
push 0
push 0x41aa83
push 0x80000001
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x40f8d9
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x1c], 1
jne 0x40f8eb
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 4
push ebp
add dword [esp], 0xfffffffc
push 0x41e350
push 0
push 0
push 0x41ab20
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x40f97f
mov edi, 0x41a6f0
mov ecx, 8
mov eax, 0
rep stosd dword es:[edi], eax
mov eax, dword [0x41e350]
bt eax, 0
setb byte [0x41a6f4]
bt eax, 1
setb byte [0x41a6f0]
bt eax, 2
setb byte [0x41a6f8]
bt eax, 3
setb byte [0x41a6fc]
bt eax, 4
setb byte [0x41a700]
bt eax, 5
setb byte [0x41a704]
bt eax, 6
setb byte [0x41a708]
bt eax, 7
setb byte [0x41a70c]
cmp dword [0x41a704], 1
jne 0x40f9b2
mov dword [ebp - 4], 4
push ebp
add dword [esp], 0xfffffffc
push 0x41a6d4
push 0
push 0
push 0x41ab04
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x40f9bc
mov dword [0x41a6d4], 0x28
cmp dword [0x41a6fc], 1
jne 0x40f9ff
mov dword [ebp - 4], 4
push ebp
add dword [esp], 0xfffffffc
push ebp
add dword [esp], 0xffffffb0
push 0
push 0
push 0x41ab0c
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x40f9ff
push dword [ebp - 0x50]
push 0xfffffffffffffff0
push dword [0x41a678]
call sub.USER32.dll_SetWindowLongA
cmp dword [0x41a700], 1
jne 0x40fac2
mov dword [ebp - 0x48], 0x81
push 0
push 0
push 0x1200
push dword [0x41a680]
call sub.USER32.dll_SendMessageA
mov edi, eax
shl eax, 3
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], eax
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
push ebp
add dword [esp], 0xfffffffc
push esi
push 0
push 0
push 0x41aaf2
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x40fa6f
mov edi, dword [ebp - 4]
shr edi, 2
push esi
push edi
push 0x1212
push dword [0x41a680]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], eax
push ebp
add dword [esp], 0xfffffffc
push esi
push 0
push 0
push 0x41aaf9
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x40fabc
mov dword [ebp - 0x48], 1
xor ebx, ebx
jmp 0x40fab8
mov eax, dword [esi + ebx*4]
mov dword [ebp - 0x44], eax
push ebp
add dword [esp], 0xffffffb8
push ebx
push 0x1204
push dword [0x41a680]
call sub.USER32.dll_SendMessageA
inc ebx
cmp ebx, edi
jl 0x40fa9b
push esi
call sub.KERNEL32.dll_GlobalFree
mov dword [0x41e340], 0x41a49c
mov dword [ebp - 4], 0x3f
push ebp
add dword [esp], 0xfffffffc
push dword [0x41e340]
push 0
push 0
push 0x41ab28
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
cmp dword [ebp - 4], 0
jne 0x40faff
mov dword [0x41e340], 0
mov dword [0x41e344], 0x41a4e8
mov dword [ebp - 4], 0x3f
push ebp
add dword [esp], 0xfffffffc
push dword [0x41e344]
push 0
push 0
push 0x41ab34
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
cmp dword [ebp - 4], 0
jne 0x40fb3c
mov dword [0x41e340], 0
cmp dword [0x41a6f8], 1
jne 0x40fb8a
mov dword [ebp - 4], 0x10
push ebp
add dword [esp], 0xfffffffc
push ebp
add dword [esp], 0xffffffec
push 0
push 0
push 0x41aae9
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
jne 0x40fb8a
push 4
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push dword [0x41a668]
call sub.USER32.dll_SetWindowPos
cmp dword [0x41a710], 1
je 0x40fba0
cmp dword [0x41a708], 0
jne 0x40fbbe
mov dword [0x41a708], 0
push 0
push 4
push 0x101c
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
mov dword [0x41e694], 0
mov dword [ebp - 4], 0x104
push ebp
add dword [esp], 0xfffffffc
push 0x41e694
push 0
push 0
push 0x41ab40
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegQueryValueExA
push 0x41e694
call fcn.00401b1b
test eax, eax
jne 0x40fc07
push 0x41ab4c
push 0x41e694
call fcn.00401bb4
push dword [ebp - 0x18]
call sub.ADVAPI32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret