Function at 0x40f3a1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe30
mov eax, dword [0x415884]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0xe1c], 0
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x208
mov dword [ebp - 0xe20], eax
mov edi, ecx
lea eax, [ebp - 0x60c]
mov dword [ebp - 0xe2c], edx
push 0
push eax
call sub.msvcrt.dll_memset
push 0x404184
push esi
xor bl, bl
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x40f3fe
inc bl
push ecx
lea eax, [ebp - 0xe24]
push eax
lea eax, [ebp - 0xe1c]
push eax
push ecx
lea ecx, [ebp - 0x60c]
call fcn.0040bfb6
test eax, eax
je 0x40f425
movzx eax, ax
jmp 0x40f76c
test bl, bl
je 0x40f443
mov edx, dword [ebp - 0xe24]
mov ecx, dword [ebp - 0xe1c]
push 0x403aec
call fcn.0040bf80
test eax, eax
jne 0x40f41d
lea eax, [ebp - 0xe28]
mov dl, bl
push eax
lea ecx, [ebp - 0x60c]
call fcn.0040d5a7
test eax, eax
jne 0x40f76c
mov ecx, dword [ebp - 0xe28]
mov eax, 0x104
cmp ecx, eax
jbe 0x40f476
push 0x7a
pop eax
jmp 0x40f76c
push esi
sub eax, ecx
push 0x408f90
push eax
lea eax, [ebp + ecx*2 - 0x60e]
push eax
call fcn.0040c045
add esp, 0x10
test eax, eax
jne 0x40f41d
mov eax, dword [ebp - 0xe20]
and dword [eax], 0
lea eax, [ebp - 0xe18]
push eax
push 3
push 0
lea eax, [ebp - 0x60c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40f763
mov eax, 0x400
mov dword [ebp - 0xe14], eax
mov dword [ebp - 0xe10], eax
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xe30]
push eax
push esi
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0xe0c]
push eax
push esi
jmp 0x40f741
lea eax, [ebp - 0xe0c]
inc esi
push 0x401154
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f538
mov eax, dword [ebp - 0xe10]
cmp eax, 4
jbe 0x40f525
push 4
pop eax
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0xe20]
jmp 0x40f6b8
lea eax, [ebp - 0xe0c]
push 0x401160
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f565
push dword [ebp - 0xe10]
lea eax, [ebp - 0x404]
push eax
lea eax, [edi + 0x30]
jmp 0x40f6b7
lea eax, [ebp - 0xe0c]
push 0x401178
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f592
push dword [ebp - 0xe10]
lea eax, [ebp - 0x404]
push eax
lea eax, [edi + 0x38]
jmp 0x40f6b7
lea eax, [ebp - 0xe0c]
push 0x401198
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f5bf
push dword [ebp - 0xe10]
lea eax, [ebp - 0x404]
push eax
lea eax, [edi + 0x34]
jmp 0x40f6b7
lea eax, [ebp - 0xe0c]
push 0x4011b8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f5ec
push dword [ebp - 0xe10]
lea eax, [ebp - 0x404]
push eax
lea eax, [edi + 0x44]
jmp 0x40f6b7
lea eax, [ebp - 0xe0c]
push 0x4011e4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f62d
mov eax, dword [ebp - 0xe10]
cmp eax, 0x20
jbe 0x40f612
push 0x20
pop eax
push eax
test eax, eax
lea eax, [ebp - 0x404]
push eax
setne byte [0x415bdc]
push 0x416660
jmp 0x40f6b8
lea eax, [ebp - 0xe0c]
push 0x401208
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f663
mov eax, dword [ebp - 0xe10]
cmp eax, 4
jbe 0x40f653
push 4
pop eax
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0xe2c]
jmp 0x40f6b8
lea eax, [ebp - 0xe0c]
push 0x4011d0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f68f
push dword [ebp - 0xe10]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [edi + 0x6c]
add eax, edi
jmp 0x40f6b7
lea eax, [ebp - 0xe0c]
push 0x40122c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x40f6c2
push dword [ebp - 0xe10]
lea eax, [ebp - 0x404]
push eax
lea eax, [edi + 0x40]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40f70a
test bl, bl
jne 0x40f70a
lea eax, [ebp - 0xe0c]
push 0x401404
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40f70a
lea eax, [ebp - 0xe0c]
push 0x40121c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40f70a
lea eax, [ebp - 0xe0c]
push eax
push 0x409030
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
mov eax, 0x400
mov dword [ebp - 0xe14], eax
mov dword [ebp - 0xe10], eax
lea eax, [ebp - 0xe10]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xe30]
push eax
push 0
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0xe0c]
push eax
push esi
push dword [ebp - 0xe18]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40f4fe
push dword [ebp - 0xe18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov ecx, edi
call fcn.0040f2d9
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413fa0
leave
ret 8