Function at 0x403ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413bb0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x5c
mov eax, dword [0x48a198]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x18]
call fcn.004057d0
lea ecx, [ebp - 0x18]
call fcn.00402430
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [ebp - 0x68], str.bfwkUJdMMwWs76oLStD932O9LsRGpDlCM28TeKBmoybuKpE3o7EeqE5IaIkYUMMpYTOueIfFnAW3OOlNAgCWPWT12pfFqRwgTpP00Xd4KAtWIhvWfDxlUM4QMqmpC7XisXu7brvkOPybTNuiSPA9KEeu4X46aOYyiMjaRBYF7WFXMr7CPc7QYz0DPypLMlM3SUUcIzqNrTVJPnwG8YxzLaMsh43Ga9YKpg6YS0sRSU56vPiaDctbLBYyQGll3KBAPuKX25DrNEwRj8oIWJEf9HN2iUdpbK2qSaWkmEpAN0h6sCT9TrQ9KNVywRDBANAgEPIWNo1XzHsraAlBEz2DNAGtKTQbUOB3AzLfompIefHXCIJlBVSzgSRp55Cl8DxkaFHs7ilkcWjucEE87iqUvkcEim1itl2iuDvkV2i8Mk1Ftnk0zr6DEqsdJf0ErimgI5wxEeTgOquCmaB8ogGDAuELeQnuOeuO1GvHKmXuEQgS1E0WXIoMXFQIaPUkCbYIxbBpxJqlbQKsONF5LRMQdWkaorebav4Uupld4uj0KciPuSpidORDu6sTjvOrYTAA5hDy9BPmhe4SXwCELL0PMLLrg75aF9O5DdBL1mQ3W4VFKuCjFDq5rdVAyo25NlJYgG39QoVlnWAVhEaMMl2UeYccl06jl1lOJMRQ81zUPHzMDdqvhN9RqPK6hCGnSynzXfHhSAl4O02qCmeWwsQKWF5R6mdBRrfKpIAap628QQ6MNr7byFHC23N6DI04wl6q4J3qlbDsxIQACTjHUCGQf9KoNzmBW3L7zG4iH4npzqhjjmJAKrf1tP0nydvO4uMR6U3fKFBnIbmaVA4pOah0VyNGXiF6AKpiqCS4azYJPC2bpsBeoD9VbrAYbQYz72ysSRSJwusYEQsqCtARq86REoSMmiv7IAzmBh4qVWgMe9ahFIx7QS9tSExJrzPj1Y7Fxr6JYO19IfYHC4McogQso5ubXVeWlGewcUxjzQwv0RAqI0p0rFRq4GwncdFqG4Ms7S8f8K3ufrP5ejuceyxvqjSULRpe8UxNGEjaH6i320Noxh2dNAUkxJezD1OLOqgA8FfdUjrndcJ56tYg2wL44CIs4oyy17BFtxM5YK6UWn8RqWijDhxnfuXTEop31XfECYuVDGkrLuDu74O5aVpsRMYvl3rLekKSgUCsfdETx98HRCn55lUqenGG5E7jLRqkpoNeiWHCfKKQQ9cL2Sj8eqkD6XJeCfeGQ0kOPKI2swLw3puWd3vS7JbFiodtuLBqjIfqEd3Obubb9BCCGbwG6aFGFPjMrtapAmVTx0kePKSbvpbGt4CO0GcHB7zHC626nb6tRXgwhoxLC9iFpUmSiweNT0iDm8PxdTEFFbx6KoB09SBDhqyP55e8IhxM8GImyFMmETSoPKhKOnhfJKhW70DUCA9duDmIM7YI7C1VzmvIA6XJjuSPL6XvzBILcyVq7iWg10Gkl52subRTsF0q6oHhTUBbvS0Adjy5kc4o2JPgnKwcD7xH7mN1heEetRypCUIxwLQ4HzNq3Vw0ztQkUkWeNtlDaL51Psfu4URG73f5Q7P4XmpCkrbosG1LkG0QRsNMRCUD84r0d23CYNr6L5es20fMFvwvt2F6j980SvKgAcz4sqKa5S94rzDdPRJF7LF1dYYrEhzomSCWVjI6yKhsRzU1qaxdTKg2RWfiYjqfP7gVE6k4XPmwGaTx1yD8HDov044vzyS9jHnPzS49wApOqzqv60Bx4xGINEQIkWCJ2dGCmm6jTHNwS0s1acOJg8hOUjp9QU4y0jSRpMPFYWxlYTz4xFBeuzvslG7uFob8QBx4VvobxAKMslLLz8UyDOgzun2sVlsax4sXT6Fz7U4hA7PKuDrBfJfg3zEzmP50DMYJ0oMOlJt3pIctvDax2mxo8biPKlbHvYd2t7i9hw8m16eaFFJ3kCG5aItg2FRbl3R5dTf3fnqrBuePQrvk2mGFTmVRa5b2bvrzDi5hV2WBqBvfHMz7zh1PqTBGbd9ER16JJFLRlSs7PviUNFHC2YysbOCKd3Ge6mIk7lF7MVXieFKasfmC2XFJScjau1KFnvRzUwCydNszbW3Qx10xGnu32sbiA6hB1U0tRmfuip1nsfxImBtRNnzhMAF0t8F9BLcGR07SLjzYVnWeIJqeYAaiUTn5BdAQzghgxRd9gri9K6aINaeeoIfW5pEh1s1sQ0wsHPlfSng5moINOLBlXlXNnGNL1kxPrCzvTCtOjcprrFOcYvD3pPA6uSXcczq9hSwDuLIeGCBmXzfTwpSLcowNAKbEpjyHmBOWyEixHTAob9u5GydRx5mymAmGLXt1GEizXuzvyUYAxJE8IaVGsIKL0hmiDikPi1bymh5CW4joQ0rAVtHuzFRBmAdPGfaqpNqK61MvDvVXygtto2nuUqQC5RxmMIxx4apL7Pzeo8pJzH9OfCbkBgGNjHrtxmbTQfgjgHTqIMJ7SMkf39KJa3viQpkICVGCqH2QJ685viRmGCvvhtoE1pkrcOfybqTwEaNfJionmXmDxCtWEwumAIXHxhKjL733ziJKniHyyHlYwpmA5bvAe92GLD4eqwGgrL70KTP37Oyi9UB5FpXofB39thSqDsESKgf1SErsJffplk1HK9whTMhV06zVlYbg8vxfLTYrNlj2y4GnPmQ5o8R7ju2CVpLpUIUz9AxBLOWHm18PHaQny40uUtbUsuPL7WumiymTcs5ETbm9veO0oLtXhds9WxR8nP4W1jEWnx0MQ75v0GT7e5L6N6o8C2oxbcBrCIwFKHyNDo4TVMhW27zNWUNrnErH7e0EeKMulp4F3cbkab3tzdkwNn1XmEkqMw5dLyWnL2jEaoBNDTjrtO8d02LO6XwrW5Gv3ofLcRwfouDllo5nbvNlKmgnq9GxpfxFEEAEn4nevAOYotmxW2SSQHakvoIw0OmC2UBwEF0EAuSNWm3YTezmGlzAQzIdIWN3qQBnVCYO
lea eax, [ebp - 0x2c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x6c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00402310
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x403ba4
push 0x4282ec
mov ecx, dword [ebp + 8]
call fcn.004023b0
mov ecx, dword [ebp - 0x34]
or ecx, 1
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402780
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00402780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00402780
mov eax, dword [ebp + 8]
jmp 0x403dc8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x30]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00401dc0
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call fcn.00403940
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x40]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00401dc0
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x38], edx
jmp 0x403c4b
mov dword [ebp - 4], 3
jmp 0x403c86
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00404b80
cmp dword [ebp - 0x38], 0
je 0x403cec
push 0x42dc84
mov ecx, dword [ebp + 8]
call fcn.004023b0
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402780
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00402780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00402780
mov eax, dword [ebp + 8]
jmp 0x403dc8
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402310
mov ecx, dword [ebp - 0x34]
or ecx, 1
mov dword [ebp - 0x34], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402780
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.00402780
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.00402780
mov eax, dword [ebp + 8]
jmp 0x403dc8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004076b4
mov esp, ebp
pop ebp
ret 0x10