Function at 0x40d620
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, 0x41f2bd
mov dword [esp], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d633
push ebx
push ebp
push esi
sub eax, edx
mov esi, eax
push edi
push esi
call fcn.00401db0
mov edi, dword [eax + 0x10]
mov ebx, dword [esp + 0x30]
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, 0x41f2bd
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebx]
add esp, 4
cmp cl, 0x2f
mov dword [esp + 0x18], eax
je 0x40d6a8
cmp cl, 0x5c
je 0x40d6a8
mov ecx, dword [0x42b61c]
test ecx, ecx
je 0x40d6a8
mov edx, dword [ecx + 0x10]
test edx, edx
je 0x40d6a8
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d690
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x20]
call fcn.00404730
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40d70a
mov esi, dword [eax + 8]
test esi, esi
je 0x40d70a
mov ecx, 0x421fa4
lea edi, [ecx + 1]
jmp 0x40d6c0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40d6c0
sub ecx, edi
cmp esi, ecx
jl 0x40d6ed
mov eax, dword [eax + 0x10]
push ecx
sub eax, ecx
add eax, esi
push 0x421fa4
push eax
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
jne 0x40d70a
push 0x422aec
lea ecx, [esp + 0x1c]
call fcn.0040d010
test al, al
jne 0x40d70a
push 0x2f
lea ecx, [esp + 0x1c]
call fcn.00405be0
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d710
sub eax, edx
push eax
push ebx
lea ecx, [esp + 0x20]
call fcn.00404730
push 0x422aec
push 0x421fa4
lea ecx, [esp + 0x20]
call fcn.00401f10
mov eax, 0x422aec
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d740
mov edi, dword [esp + 0x18]
sub eax, edx
test edi, edi
je 0x40d795
cmp dword [edi + 8], eax
jl 0x40d78d
mov ecx, dword [edi + 0x10]
push eax
push 0x422aec
push ecx
call fcn.00412bc0
add esp, 0xc
neg eax
sbb al, al
inc al
test al, al
je 0x40d78d
mov eax, dword [edi + 0x10]
mov edx, dword [edi + 8]
push edx
lea ecx, [eax + 1]
push ecx
push eax
call fcn.00412880
mov eax, dword [edi + 8]
add esp, 0xc
dec eax
mov dword [edi + 8], eax
mov esi, dword [edi + 8]
mov eax, dword [edi + 0x10]
jmp 0x40d799
xor esi, esi
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
inc esi
push esi
push eax
push 0
push 0xfde9
call ebx
mov edi, eax
lea edx, [edi + edi]
push edx
call fcn.004121c0
mov ebp, eax
mov eax, dword [esp + 0x1c]
add esp, 4
test eax, eax
je 0x40d7cc
mov eax, dword [eax + 0x10]
jmp 0x40d7ce
xor eax, eax
push edi
push ebp
push esi
push eax
push 0
push 0xfde9
call ebx
push 0x5c
push ebp
call fcn.0041322b
add esp, 8
mov esi, eax
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push ebp
mov word [esi], 0
push 0x80000001
add esi, 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d9bd
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x2c]
push esi
push eax
call ebx
test eax, eax
jne 0x40d9ac
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x40d8f9
cmp eax, 2
je 0x40d8f9
cmp eax, 3
jne 0x40d8a9
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040d0e0
mov edi, dword [esp + 0x10]
test edi, edi
je 0x40d868
mov eax, dword [edi + 0x10]
jmp 0x40d86a
xor eax, eax
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push eax
lea eax, [esp + 0x28]
push eax
push 0
push esi
push ecx
call ebx
test eax, eax
je 0x40d9b0
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
call fcn.0040ccb0
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d9c1
cmp eax, 4
jne 0x40d9ac
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push esi
push eax
call ebx
test eax, eax
jne 0x40d9ac
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x14]
call fcn.00404630
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d9c1
mov edx, dword [esp + 0x14]
shr edx, 1
lea eax, [edx + edx + 4]
push eax
call fcn.004121c0
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov edi, eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esp + 0x28]
push edx
push 0
push esi
push eax
call ebx
test eax, eax
jne 0x40d9a3
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
shr ecx, 1
mov word [edi + ecx*2], ax
mov edx, dword [esp + 0x20]
push eax
shr edx, 1
push edx
push edi
push eax
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
lea ecx, [esp + 0x14]
call fcn.0040d0e0
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x40d962
mov eax, dword [ebx + 0x10]
jmp 0x40d964
xor eax, eax
push 0
push 0
push esi
push eax
mov eax, dword [esp + 0x24]
shr eax, 1
push eax
push edi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test ebx, ebx
je 0x40d988
mov eax, dword [ebx + 0x10]
jmp 0x40d98a
xor eax, eax
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d990
sub eax, edx
push eax
lea ecx, [esp + 0x14]
call fcn.0040d0e0
push edi
call fcn.0041249e
add esp, 4
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d9c1
mov edi, dword [esp + 0x10]
push ebp
call fcn.0041249e
mov esi, dword [esp + 0x2c]
add esp, 4
test edi, edi
mov dword [esi], edi
je 0x40d9df
mov eax, dword [edi + 4]
test eax, eax
js 0x40d9df
inc eax
mov dword [edi + 4], eax
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x40d9fc
mov eax, dword [ecx + 4]
test eax, eax
js 0x40d9fc
dec eax
test eax, eax
mov dword [ecx + 4], eax
jne 0x40d9fc
mov edx, dword [ecx]
push 1
call dword [edx]
test edi, edi
je 0x40da17
mov eax, dword [edi + 4]
test eax, eax
js 0x40da17
dec eax
test eax, eax
mov dword [edi + 4], eax
jne 0x40da17
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret