Function at 0x401d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b290
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x424
mov eax, dword [0x48a870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x434], ecx
mov byte [ebp - 0x41d], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x418], 0x400
lea eax, [ebp - 0x41c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x401e43
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x401e36
mov dword [ebp - 0x424], 0
jmp 0x401dec
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x424], ecx
mov edx, dword [ebp - 0x424]
cmp edx, dword [ebp + 0x18]
jge 0x401e36
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x42c], edx
mov eax, dword [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x401e2a
mov byte [ebp - 0x41d], 1
jmp 0x401e36
mov dword [ebp - 0x430], str.jcXcEIKYv0pI1pgs2IA7jdNdnG01kFXzsEMBO6TbvDnqEAuTCG4sjTTCXoHBYcVNhfunnwBXiMJXU4KHnCHBypF0WaFieoNJreKHIPyBIw9xgdap7K6axXvq8LbsnFcnvlv8T8suYQ3fl5m3DL25mXU3GXjjReglVIVvAE04JJEUWqvjAOBCL2k7bqTTkSFQ4Yv16SVRmSXHiAsgr3nC6sT0TWsKWFvH9QIpquXqt83NXUniBHIlle2zGdAiLlomT6gCv53hFqhj36EGkyvTVK9atCvj5FObOPU3BiykxxXIk29yna4MLpy25VpHKSn2ynFnsAknyJIOhNH2R6tkTi229lKIhrGPeYe5VaDQ6HnMWIcllQAHucTCfyiTOYnDhS6w1UjIoA446hvMspjik71KrJI8XJMaezRMI1O249eoYwD2S6vwvG2vH8AQsDqnFBMAaazr6fqpHGxn7YMTnoYdlLfBPeOqcrQEdd5D6J9TTAgHvjiJheIxJPyf7TGuv63cVNn7xkPo2YsJEmlGsWVmV32sJi9nzDqQjkiyBgui1SbQkqfOc69EIEFSBjAww57DkWxJ9gHSgAH6wNpCCXHvrrDEaG2BhtTQvmWtdYCG4JmNu2oDbWjr4CmGQD8mMuTCjKdPQq1sNSGtx5JPQ8RAnp6xHAsmqD808iEe6PA3xT1h8YrrsHbIRIfIdqlo1sk1YuzqwhIPbJXLQfX5bVB4DlI4cGehtUbrHUVDdMhvXYowsMHe1idnlYQAPxQONokQ1noETfz0tTk6GT32NmNWfepCBK4RpDCXACdg3xGXhKT9J0OefAjIKMLjUaj8PE1lND16SuGPK6796pCRxf79KuqtkQObzsFvm5EJx34DxyedqpMMhiPEJ2JQ7pbWmF4IODYcB4wy1KHu3s4vtFrWCPoFQqJ3A7Gh8XzmQ7dmpLgxUebEvfDzs5zJXW6piP2zCDNV7rPqQ6UbEBUTcPXRsCYqLu9h92D64eNrnQBg2yoTPBu549POg01LrqgD0x9XEnjOBFFYLDUPXut3br1tkodghBxOXU77MzLLKufu1zQ7Dt1gWOMbJ0Yw1HE1l43hL7cbPCSHqQC0dGH632OzzDocKCT7npPfxTS2xSEu3eTseifi6BBrDF6O3vTBsmrfUBYqfFezqKK4rul0GOrIqXhNTLBEdmUOJDtC4QQzxIx1jdfu4PJly1SB4kxRlBFVupDG6aK4WoEMWe77kIBs48JGd22GDx9c6Ah8USbXyylISa6N1nLHMr17vh5ksMDC9Om8xSmzwphCs7zGG4gL7ikpg1cNCOpV4yeOAEAIJU1Frscx92gKqN8avFv0po4tsljJCpWkQuHX7N0NlxW8YQIaWcEExwvfbH7Pcbqt983ra4iwuSFNhqeNvLUYk6FJQItxRCRtFfABmU8IGCEuIfKLhIvc98wTDnV0RwJAPWIN8iRB1hij5cFMFRX4SRWKUxDjLmPmSdbuaVF0b7hQV4nFihTzIUwWiikS90KBlvGYme1iqoaEoeaL4iAPM0a5cvPT7PXC0ByMDGOPN9AY4EbN9EUgiTeJMUbbiSQ9SDKBWUmS7goM5Sw0WnpncMR2x3gq4v4gQTbAWdwDIeWErwJNYDYs5NcTQMdOeMMxFXWdbEGvEWs76hWrNgQgdQw6EFRE2PWBs0Vsu9vr2lTAmK0jUqmiyy4EzuykCw8fvgH7cbLlEs1GysLLCoijjMHOa6W80u4WByJrSzVipsXUNJlUI2jwVMW24r7kQgAT4io7qs5A9ygNVJRxvLXBc6XWTxxa8avgzlARMUsMQ5SD1OaNLcjIx9lTgDjpqlE2pQTqkq3bGxYptMDruWcr3g1izgqelwnqEtMfaNWs0seBcUaxasBHyAjBFJsJa3KDPHd5x8KyIe5lfmM5XplnLHwePoqWdmgRhTjpc0XO1CDYFiUWOin3XMQ0DU23OUIg0ekppCW4kFC4x2k2quL0UyncUhxrijpTQIFW
jmp 0x401ddd
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401e52
mov dword [ebp - 4], 0xffffffff
jmp 0x401e62
mov al, byte [ebp - 0x41d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00413725
mov esp, ebp
pop ebp
ret 0x14