Function at 0x41603b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x828
mov eax, 0x437ce5
call fcn.004220d8
mov edi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0x1c], 8
mov dword [ebp - 4], ebx
jae 0x41605d
lea eax, [ebp + 8]
cmp eax, ebx
jne 0x4161b4
mov dword [ebp - 0x818], ebx
mov esi, 0x400
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.00422690
push esi
lea eax, [ebp - 0x810]
push ebx
push eax
call fcn.00422690
add esp, 0x18
lea eax, [ebp - 0x824]
push eax
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlLockGUID
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x834], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x416312
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push ebx
push str.GUID
push dword [ebp - 0x824]
call esi
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push ebx
push str.BASKET
push dword [ebp - 0x824]
call esi
push dword [ebp - 0x818]
lea ecx, [ebp - 0x82c]
call fcn.00402f3c
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 2
call fcn.0040144c
lea eax, [ebp - 0x820]
push eax
mov byte [ebp - 4], 3
call fcn.00415c2d
pop ecx
push dword [ebp - 0x820]
lea ecx, [ebp - 0x81c]
call fcn.00402f3c
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.00414f8f
lea ecx, [ebp - 0x81c]
mov byte [ebp - 0x811], al
call fcn.0040147e
cmp byte [ebp - 0x811], 0
je 0x4161d3
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x820]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi + 0x1b78], 1
mov dword [edi + 0x1b74], 0xfffffffe
call esi
lea ecx, [ebp - 0x82c]
call fcn.0040147e
push dword [ebp - 0x818]
call esi
jmp 0x416332
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x818], eax
cmp eax, ebx
jne 0x41606b
push 0x8007000e
call fcn.00401000
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x830]
push eax
mov ecx, edi
call fcn.0041518e
push ecx
lea eax, [ebp - 0x410]
mov ecx, esp
mov dword [ebp - 0x81c], esp
push eax
mov byte [ebp - 4], 4
call fcn.0040144c
lea eax, [ebp - 0x830]
push eax
call fcn.00415f94
pop ecx
pop ecx
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x818]
call fcn.00415031
mov esi, dword [ebp - 0x818]
push esi
lea ecx, [ebp - 0x81c]
call fcn.00402f3c
push 2
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x81c]
mov byte [ebp - 4], 5
call fcn.00412e01
mov eax, dword [eax]
push 0x43c844
push eax
call fcn.0042251a
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0x828]
sbb bl, bl
call fcn.0040147e
inc bl
je 0x4162c2
and dword [ebp - 0x828], 0
test esi, esi
je 0x416289
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x41628d
xor eax, eax
jmp 0x4162a3
lea ebx, [eax + eax]
mov eax, ebx
call fcn.004230b0
mov eax, esp
push 3
push ebx
push esi
push eax
call fcn.0040590f
lea ecx, [ebp - 0x828]
push ecx
push ecx
add edi, 0x1b74
push edi
push str.c_03dc_03xc_04d
push eax
call fcn.00424ab3
add esp, 0x14
jmp 0x4162d6
mov dword [edi + 0x1b78], 1
mov dword [edi + 0x1b74], 0xfffffffe
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x81c]
call fcn.0040147e
push dword [ebp - 0x830]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
push dword [ebp - 0x820]
call esi
lea ecx, [ebp - 0x82c]
call fcn.0040147e
xor ebx, ebx
jmp 0x416326
mov dword [edi + 0x1b78], 1
mov dword [edi + 0x1b74], 0xfffffffe
push dword [ebp - 0x818]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.0040a270
lea esp, [ebp - 0x844]
call fcn.0042215b
ret 0x1c