Function at 0x40d510
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
mov ebx, eax
mov eax, 1
sub esp, 0x8ac
mov dword [ebp - 0x840], eax
lea edi, [ebp - 0x818]
mov eax, 0x400
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x840]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x113e
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [ebp - 0x86c], ecx
mov dword [ebp - 0x83c], edx
mov dword [ebp - 0x830], edi
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
je 0x40d582
test byte [ebp + 8], 2
jne 0x40d590
test byte [ebp + 8], 0xc
jne 0x40d5b8
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, edi
mov edx, dword [ebp - 0x86c]
call sym._match_string
test eax, eax
je 0x40d57c
mov eax, dword [ebp + 0xc]
mov esi, 1
mov dword [eax], 0xffffffff
jmp 0x40d584
mov dword [esp], ebx
lea eax, [ebp - 0x858]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call sym._GetItemPath
test eax, eax
mov ebx, eax
je 0x40d582
mov eax, dword [ebp - 0x858]
test eax, eax
je 0x40d582
lea edx, [ebp - 0x85c]
xor edi, edi
mov dword [esp + 0x10], edx
mov esi, 0x20019
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne 0x40d900
mov dword [esp + 8], ebx
xor ecx, ecx
xor esi, esi
mov dword [esp + 4], ecx
xor ebx, ebx
xor edi, edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebp - 0x878], eax
call eax
lea eax, [ebp - 0x84c]
xor edx, edx
sub esp, 0xc
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x850]
mov dword [esp + 0x20], eax
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x85c]
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._RegQueryInfoKeyW_48
sub esp, 0x30
test eax, eax
mov esi, eax
jne 0x40d582
mov eax, dword [ebp - 0x850]
xor ebx, ebx
inc eax
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x854], eax
add eax, eax
mov dword [esp], eax
call sym._heap_xalloc
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
mov edi, eax
xor eax, eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x854]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x85c]
mov dword [esp + 8], edi
mov dword [esp], eax
call sym._RegEnumValueW_32
xor edx, edx
mov dword [ebp - 0x87c], edx
sub esp, 0x20
test eax, eax
jne 0x40d713
xor eax, eax
cmp word [edi], 0
setne al
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x880], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
mov ebx, eax
mov eax, 0
sub ebx, dword [ebp - 0x87c]
cmovs ebx, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x874], edx
and ecx, 8
mov dword [ebp - 0x870], ecx
and eax, 4
mov esi, eax
lea esi, [esi]
mov dword [esp + 8], edi
xor eax, eax
mov dword [ebp - 0x848], eax
xor eax, eax
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x850]
mov dword [esp + 4], ebx
mov dword [ebp - 0x854], eax
xor eax, eax
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x844]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x854]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x85c]
mov dword [esp], eax
call sym._RegEnumValueW_32
sub esp, 0x20
test eax, eax
jne 0x40d950
test esi, esi
jne 0x40d8e0
mov ecx, dword [ebp - 0x870]
test ecx, ecx
je 0x40d7d1
mov eax, dword [ebp - 0x844]
dec eax
cmp eax, 1
jbe 0x40d7e0
inc ebx
jmp 0x40d750
mov edx, dword [ebp - 0x874]
mov eax, dword [ebp - 0x84c]
test edx, edx
je 0x40d930
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0x848]
mov edx, dword [ebp - 0x850]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x874]
lea ecx, [ebp - 0x844]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], edi
mov dword [ebp - 0x854], edx
lea edx, [ebp - 0x854]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x85c]
mov dword [esp + 0xc], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._RegEnumValueW_32
sub esp, 0x20
test eax, eax
jne 0x40d950
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x86c]
mov eax, dword [ebp - 0x874]
call sym._match_string
test eax, eax
je 0x40d7d1
mov dword [esp + 8], edi
xor ecx, ecx
mov edi, dword [ebp - 0x878]
mov dword [esp + 4], ecx
mov esi, dword fs:[0x18]
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x874]
sub esp, 0xc
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esi + 0x30]
mov esi, 1
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x85c]
sub esp, 0xc
mov dword [esp], eax
call sym._RegCloseKey_4
mov eax, dword [ebp - 0x87c]
add ebx, eax
mov eax, dword [ebp + 0xc]
sub esp, 4
mov dword [eax], ebx
jmp 0x40d584
mov ecx, dword [ebp + 8]
mov eax, edi
mov edx, dword [ebp - 0x86c]
call sym._match_string
test eax, eax
je 0x40d7bb
jmp 0x40d871
mov dword [esp + 8], ebx
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x40d582
mov dword [esp], eax
call sym._heap_xalloc
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x84c]
jmp 0x40d7f4
mov dword [esp + 8], edi
xor eax, eax
mov edi, dword [ebp - 0x878]
mov dword [esp + 4], eax
mov esi, dword [ebp - 0x880]
mov ebx, dword fs:[0x18]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x874]
xor edx, edx
sub esp, 0xc
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call edi
mov eax, dword [ebp - 0x85c]
sub esp, 0xc
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x40d584