Function at 0x405080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416009
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x3c
mov eax, dword [0x479010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 4
lea ecx, [ebp - 0x18]
call fcn.00402a60
lea ecx, [ebp - 0x18]
call fcn.00403760
mov byte [ebp - 4], 3
mov byte [ebp - 4], 4
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x48], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00403600
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40515a
push 0x44c2cc
mov ecx, dword [ebp + 8]
call fcn.004036e0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ab0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ab0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ab0
mov eax, dword [ebp + 8]
jmp 0x4052fa
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00403dc0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404f00
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00403dc0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004062a0
mov dword [ebp - 0x40], str.OYXyLcoyTx5nmAsvLvy0LcDMKR8B9VTlf2jUnwP44W2Dl91phU92DJ6i7IMpsIQXuwuUXnWRzf6aKLxJOvz0PeFBfavpPqwS5lypuUoEG7BVunDPNGLYBghv2ceCdbsjOVPb0HLRvnBt3NlgXwT3hOJBgXAy91HIPrO7BFFIW0NQvM9PnGjlgiQevLTgHPHMDCb4t9AaK8EAwWYGrwwW1tmtb2ekCtox2TQTUP1XvYiKiLgbP1j17vWevmiN8C8d8iTvfSmCBXyXEEPVELCGcWj8Aqxi4QLjpvFPSK1ohB0iWT0Rf3C9WK0Ah68TSGzDEQELmmjlABQnbFw8kKFzcgCKlnTgzshfYkygfXwfrJ5kR3CbVpkbMbEzippvGr4qQujhdgUGw0lO7XWGpcn9GEAJxrUjpMBL1D2MXjEYosY0DiCCsWKIUaPJiUnOsyX8BD3MlySgqm5xHKdd67FazDKMznrI9EHB22RgeQImO5nE90KWENuHQlFRewvfnVOA3XefBqdUA9m2qwHBOJME0XSM0cB5A6KHLh4KwTllCccVwK1cAjlhnAA3mnxuRKqRApvQ6j6Mz4J42Y31iyaUnF1VGbKcOocgfsTCy3mbXFAH7qEBB7qQv3gwaSsuDqRjP9M7aT1da51Bw88OtjwskXqDKRv876IJJQTsi5Slix06z6cIf435w5zSlFvqBAtuGBcJnaHNopeV9b4FxYN5MoFAy0Ic2YhOJ2O6V6ezgb6tI8nhliMRWkHSTFaJWcMdhs8Fzh8pyvGxnBfrWPeOTHxGFCwVp53s1MGCXp2QLaNtJ8djY9umzG3B3Yb76nCAYDf9RFvac5WaY8iipmeV3S26Y0gbhHtSzcLp6A6o0kjXVVV5uffXqggki3xuKz4UskpCz4jo76NNWJ5BQhxWTdsgAExXWnfwGwz2hryImJ14YD46qtmmKshBlut3PppMAVNPhofIlKiHwEJ1tz6FlblPOmfEYSj5QlSkI3JxwKCaICm7BVqq7TedbesewPe2ubNJPQj1bvIodlDpJw88yysKj9sKcgQwPtIoUIfPpV2RgsNb8Ygkgtxe2ngIg0lIyW2ykSIna5EAJxrVlA4zTmRbUhA7CNj2DWlzx2UPb9q411EwigXseiRUnmQrJjNbqspK6cVa5rSj6dYYdxCy4OPwHgcLB3n5x5gsANR3gsfRznpFGCRujL7PXNsBQrWYY653IHGYYMsNyBpbzkKQVrTt4Tb3FMYm3pgTg6pcjc9FNTQo8axj1vrMKCADOikXnzqp4CWG9zFyAb6rReGvE1QVBcDvD4kOULmY2gbffW34OcWHGhP67ogOYXXe33LcXN53coVo9w4jWEFRMIQMDvI69rVWz9RF9bN3BO0rez9W27YRGzNfDzfd8ezif6j1pYWqrH7sJzs6D11ShxWdxdMnO8FrLzgl1X9GWCYhH8Rr1JqoIUMpRqhwU3F3l7j0zvciqveuYXT9Tug7xGXzfBzqY3IjMatz1F8KgIstiXQTEq43AqmtlzwylkIUu1iWB6bzW0ela9GWeyMr1o5TUtTbded6rUGiV6Mk2s21WE4Y5MRQmsnDNTplBdtAaX5YTDyw8Ck8POmglUc2qaLuWNLOoVtCM9lHLjnKWox9P3ExFE73nDThjxAbd7UY0mLo5leAi42dMVI5hzofHIIP0QtJBF9W7n8gLBpD1k6kld3H19ibdPh38RWBSEhjYSDL2Clv2g2c3JPFgJvJ34TKX8xDef5o1pYFsxFOol3jbvVP0Ba1F94RMxGrBK30frhWTahdcqjVUEYvMSToTrvg0oLpQEnuhh7SAUbnALY5euezJDJxPX7R3pbIAyYJgbu04SFWP06xVpImAKcmXl0CuEcgkbq6WgV6bMcEiaJRF07MC5f23SuuWB5Ikr2sGxleaYrblGQnSXQdGji0cv6o7a5zKlOemT9Kusfgtmq9U91Af3d0QMxmLxl1y5tlsaag4RHCgoj3PwpkjMj0LUJlLqY3vUpd30GA3t62mpnFDeAnuTme5LPo2P5oflLOLYuRVdSfsmqp4xIcXDCcaP9vAcFzbVlCPzLwzEK3oCdoJRLKtdJHNedJvmISCpEB39ab8YAg10qy7KkynCQL4IK9YvbmDDWgLVNL63uFiBKzpRJBzPyImKJNffVNaE9CX4ftjkK8g1MSK51qyGS6qliOBzONXAQcaAvLTVQu297G4lU4pTlLjdLguSBGBJr3tp3nlFuBNleX4LQ3K4QOqGHhmV5zwwVJzlMgsUzlOkDslBYtPIPCuJQ0MTUlVx3kJ68FnHcBsdJFjg8Urf8OxYczolMBUugqNfR9yKFj7tUScfQuYV3jWGQbTcgMneI9chjsNmwnk1v74goMoVlfrJdY6MV41Kf6UzbFcvrKE8MbL6HXeme42FPcRRjmobprxnE4eOmoKu1E5JrEA8nt6Fu29xQmTOtNeRofEvogm9nQugX2b7Sqjy8HWkXyJ4noG4t4zuQmjy0TpTkLg2laGMWup72bVuNRhTtCphhFuz0C23j4HxLaAtkDHcndnL6rQemhV4ofQqqGmdmDV8DbGlOp5firJLmPSJAHfD85tIhth4EGVfSgXLf7SlYnxrkhq36MJtDgtwvatn50k9SGLNy4wXDj9Vuw6DdIaDeP3c2Dq8cMf4t1J5XzvVpjHt2P6UKVBSsSuyIDwmiPr4W4SURXpvncguP0ea08rA4vaLoBTklsf83UvgPDRjAzCwsiPxEgpJ0PvsMLyn2rx7XWfGGVDo2NsfeyP6TBz1qX3yF7l1L6NLmK5qqeu8EYft67MMnDiIF5mrGoSRCh6JkeilfWlmn1jcMMJt88jLki9Qu8FKok3zpwwVyv9h3yOuGWoQH7EJ7O9VDB2yA6RHD3InYkWrt1HCStYz6SGQ2PbdFS4np0lqsubqkRRQpBNXcKk8J17YeybC6MMpKUPWMNuwBA6SAfJ38HRVvkXB4b7ulSWYegio0bBK3XUhEF
cmp dword [ebp - 0x38], 0
je 0x405225
push 0x44ceac
mov ecx, dword [ebp + 8]
call fcn.004036e0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ab0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ab0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ab0
mov eax, dword [ebp + 8]
jmp 0x4052fa
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403600
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403ab0
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403ab0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403ab0
mov eax, dword [ebp + 8]
jmp 0x4052fa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a57e
mov esp, ebp
pop ebp
ret 0x10