Function at 0x4087b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b60d6
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x504e20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x838], eax
mov ecx, dword [0x506280]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0x15
idiv ecx
mov dword [ebp - 4], 0
cmp edx, 3
jne 0x408829
lea eax, [ecx + 0x63]
mov esi, 0x4c
test esi, esi
je 0x408822
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x408811
add eax, esi
mov dword [0x506280], eax
mov eax, dword [0x5049f8]
xor ebx, ebx
cmp byte [0x5062f8], bl
mov ecx, 0x5049f8
sete bl
add ebx, 0x80000001
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x81c], eax
or edi, 0xffffffff
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], 1
je 0x4088c9
cmp byte [0x50002c], 0
jne 0x4088c9
mov eax, dword [0x506398]
cmp dword [eax - 0xc], 0
jne 0x408878
mov ebx, SysReAllocStringLen
jmp 0x4088c9
push 0x4c2064
lea eax, [ebp - 0x818]
push 0x506398
push eax
mov ebx, VariantInit
call fcn.00402930
add esp, 0xc
push eax
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], 2
call fcn.00402500
mov edx, dword [ebp - 0x818]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4088c9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 0
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
mov byte [ebp - 4], 3
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
mov eax, 0x4c20cc
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x408932
movzx esi, ax
push 0
push esi
call fcn.00402da0
add esp, 8
test eax, eax
je 0x408942
push esi
push eax
lea ecx, [ebp - 0x814]
call fcn.00406900
jmp 0x408942
push 0x4c20cc
lea ecx, [ebp - 0x814]
call fcn.00402600
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x83c]
push eax
mov byte [ebp - 4], 5
call fcn.00402870
push 0x50639c
push eax
lea eax, [ebp - 0x834]
push eax
mov byte [ebp - 4], 6
call fcn.00402870
push 0x4c2064
push eax
lea eax, [ebp - 0x830]
push eax
mov byte [ebp - 4], 7
call fcn.00402930
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x818]
push eax
mov byte [ebp - 4], 8
call fcn.00402870
add esp, 0x30
lea ecx, [ebp - 0x82c]
push 1
push dword [eax]
push ebx
call fcn.00409620
mov edx, dword [ebp - 0x818]
test eax, eax
setne bl
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4089d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x830]
add edx, 0xfffffff0
mov byte [ebp - 4], 7
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4089fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x834]
add edx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408a1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x83c]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408a41
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x814]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408a64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x408a75
mov esi, dword [ebp - 0x82c]
xor bl, bl
jmp 0x408c7f
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x80e]
push eax
mov dword [ebp - 0x820], 0x400
call fcn.004980c0
mov esi, dword [ebp - 0x82c]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x818], eax
jmp 0x408ab0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x820]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
mov eax, dword [ebp - 0x818]
inc eax
mov dword [ebp - 0x818], eax
test ebx, ebx
je 0x408aed
cmp ebx, 0x103
jne 0x408c68
mov eax, dword [0x5049f8]
mov ecx, 0x5049f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x814], eax
lea eax, [ebp - 0x810]
mov byte [ebp - 4], 9
test eax, 0xffff0000
jne 0x408b35
movzx esi, ax
push 0
push esi
call fcn.00402da0
add esp, 8
test eax, eax
je 0x408b62
push esi
push eax
lea ecx, [ebp - 0x814]
call fcn.00406900
jmp 0x408b62
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408b40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.00407df0
mov eax, dword [ebp - 0x814]
mov byte [ebp - 4], 0xa
cmp dword [eax - 0xc], 0
je 0x408ba5
mov ecx, dword [ebp - 0x838]
lea eax, [ebp - 0x814]
push eax
call fcn.0040a2e0
mov esi, dword [0x506280]
mov ecx, 0x18
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
cmp edx, 4
jne 0x408bab
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, dword [0x506280]
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
mov dword [ebp - 0x820], 0x400
call fcn.004980c0
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0xd
idiv ecx
add esp, 0xc
cmp edx, 8
jne 0x408c39
mov eax, 0x487ede05
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x71
mov eax, esi
sub eax, ecx
xor edi, edi
cmp eax, 0xa1
je 0x408c30
nop
mov eax, esi
or eax, 0xffffffd1
add esi, eax
mov eax, esi
imul eax, esi
inc edi
cmp edi, eax
jg 0x408c30
mov eax, 0x487ede05
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x71
mov eax, esi
sub eax, ecx
cmp eax, 0xa1
jne 0x408c00
mov dword [0x506280], edi
or edi, 0xffffffff
mov edx, dword [ebp - 0x814]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408c5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x818]
mov esi, dword [ebp - 0x82c]
test ebx, ebx
je 0x408ab0
test esi, esi
je 0x408c7d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov bl, 1
test esi, esi
je 0x408c8a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x81c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x408cad
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x408cce
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00496d64
mov esp, ebp
pop ebp
ret