Function at 0x4010f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x417c2c]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, dword [ebp + 0x1c0]
mov ecx, dword [ebp + 0x1c4]
push ebx
push esi
mov esi, dword [ebp + 0x1bc]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x59], bl
mov dword [ebp - 0x6c], 1
je 0x4013cb
cmp eax, ebx
je 0x4013cb
cmp ecx, ebx
je 0x4013cb
mov byte [eax], bl
push edi
mov byte [ecx], bl
call fcn.004010a7
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x60]
push ecx
push eax
push ebx
push esi
mov esi, 0x80000001
push esi
mov dword [ebp - 0x74], eax
call edi
test eax, eax
jne 0x40125a
cmp dword [ebp - 0x60], ebx
je 0x40125a
push 0x206
lea eax, [ebp - 0x56]
push ebx
push eax
mov word [ebp - 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x68], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401245
cmp dword [ebp - 0x6c], 1
jne 0x401245
mov ecx, 0x415a58
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4011f4
cmp dx, bx
je 0x4011f0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4011f4
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4011ce
xor eax, eax
jmp 0x4011f9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401205
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x401241
mov ecx, 0x415a5c
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401233
cmp dx, bx
je 0x40122f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401233
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x40120d
xor eax, eax
jmp 0x401238
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401245
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x59], bl
mov dword [ebp - 0x60], ebx
jne 0x4013be
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
push ebx
push str.SoftwarePoliciesMicrosoftVisualStudioSQM
push esi
call edi
test eax, eax
jne 0x4012d2
cmp dword [ebp - 0x60], ebx
je 0x4012d2
or dword [ebp - 0x68], 0xffffffff
push 4
pop esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x41586c
push dword [ebp - 0x60]
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4012bb
cmp dword [ebp - 0x68], 1
jne 0x4012ad
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x4012b7
cmp dword [ebp - 0x68], ebx
jne 0x4012bb
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x59], bl
mov dword [ebp - 0x60], ebx
jne 0x4013be
jmp 0x4012d5
push 4
pop esi
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
push ebx
push dword [ebp - 0x70]
push 0x80000002
call edi
test eax, eax
jne 0x4013be
cmp dword [ebp - 0x60], ebx
je 0x4013be
push 0x206
lea eax, [ebp - 0x56]
push ebx
push eax
mov word [ebp - 0x58], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push dword [ebp - 0x60]
mov dword [ebp - 0x70], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4013b5
cmp dword [ebp - 0x6c], 1
jne 0x4013b5
mov ecx, 0x415a58
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401366
cmp dx, bx
je 0x401362
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401366
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x401342
xor eax, eax
jmp 0x40136b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401377
mov eax, dword [ebp - 0x64]
mov byte [eax], 1
jmp 0x4013b1
mov ecx, 0x415a5c
lea eax, [ebp - 0x58]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4013a3
cmp dx, bx
je 0x40139f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4013a3
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x40137f
xor eax, eax
jmp 0x4013a8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4013b5
mov eax, dword [ebp - 0x64]
mov byte [eax], bl
mov byte [ebp - 0x59], 1
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp - 0x59]
mov byte [eax], cl
xor eax, eax
pop edi
jmp 0x4013d0
mov eax, 0x80004005
mov ecx, dword [ebp + 0x1b0]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bb82
add ebp, 0x1b4
leave
ret 0xc