Function at 0x40aa20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b808
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x60
mov eax, dword [0x48d870]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x18]
call fcn.00409590
lea ecx, [ebp - 0x18]
call fcn.0040b840
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [ebp - 0x5c], str.L9vEDwwrLt4gctR6JAnmAxenfFNnN2blIlHmXVbjWwa1Fa2eXEHWQteagGGNNP0FdqAxBudwVD4QRnadnyMuEl4DM5eMTMmWlq683R0gmqEBXkiywlTDfNMDDfrGPNM6BXk3NbQqHEyFH9U5fKt6YRsFsL0pRIfiKmAgvT0Hhb2VqPXPK9czfY46HlklTd8XTwoHRSHyc38M1kO9zvVMxVyWGPwolTkQv2toDo6bpqxbYnkCyuKtqWN8wdp0fh8Uk6LiH6jAJCGwmHN8SmWnxBEd9Bu6bIlqrxnqX0quL4EL
mov dword [ebp - 0x44], str.IiWOoCLtWhSXet28oYU9Jb3hfzoeJH83fOa9XLNbX1UsiFDkn72PRlHbdh3itIygBAEiMwJOGfmBQbWdjXsWvfDlIHVCU3kPsJxGdxkV91Lb4I7kuO92t7iNeNdPvG3yff4p86auDGo89aEfWP8fcIY0nRFJFMGc7UBfT0LXIW4EinwrwYCvxqTR8vImSxCs4oGJsFzdfQi6Jn0mM3YrVcbKIFsUCdB2L6X5d5PAhJe2GeNn5DHkjxLtAByPobMvJmib6MKTchDeq41Syend7zykvTpJGQGucgzFzWooDtWGd79836OLiWk2svYs3KhubLTQBgJKtHezkF3pflTtkWKLKET12tQ0sDwJG3DaSA9i580UwSGpeolaTVsFaF8rzsN5NaPdg85pLUEN5vmptGAiJfyQ36ddPGfit4YYkF1IKA4cQNg17QMIjPJcgAAEkyvvJMzY2QxdnLE9ybRrFrbqWgdzo193S9ny8V4azDW7Y7hGESLEdBRQipO06o9D8oMXJGJXsm9NWq8Mp0Jgi3RUcu1JYKhDp1O16OOgqCFSHwPnMqEC074WL5VgIfAcSAFBlGnovpHaCmnlBTzLWEfKr3kdX4vprvIp4bo7X05E9UbumYDtf97BRAzsoxTlK0rLnOKFn2gzHi0Cn3caxBcd0eJ4J0X1h6tJWGdKwpmkLC0uIjG0WGYI0PuhFVlocHA4Upqwws7xNbLKeQHQaxMLlC9BXP2nswIeWgWxGKV3jfg5uuYgmXSqL4FHkkqRP6Unf1bQDdPQLeN5SXpvdkodg2Erx5kENLmnv6u0h8udIB8gwN1yWwk55GlUoRUxCKqMVr4SH5ewGUobjlV4j4AvKxCoDwKel3yTiC1WlXXsdN5fVMtqv41l5q1n8WNrJwoFNKl3S2kOSW6TL85Hj9gV6uGyFbpNmQGNgwVtgRwFhaLv4dkF0AU49dqN5glSzxmEUez2ElsgYiLnJJVPmctXNqGeglIfqUqjzJUTzIB1BibKwaMlGmhnVgy92E3nN95zztwLIx9BNatTUPQ8O4AoDcK2kwhJkcDUHrQK7GSRb1uYcTjK5QyEj1EA1jGHnVzykffs1neRr2u7llpwjSdcBQfK2vYF6Wunj4VSX8hSer8oaYBrUPuxradCiCgUqK8X1D2wKPJlfArPcrrcJ1cDYINwLjYI3DnDkiyksHYWcSOsMbCdbh3TGEXWpf1ipJfpFVqGodYxOO6b0w1zb5DdhogCdeCNI0VYX4oq9gpcOWuTGyB69rtSIHTu95smXdIKDIbRB1wdYVzttguj3XTFgFKFfLy4T14RDxmJSYf33tkHIpYqjOdPpJhuxhmU3Nz7sLngoY9oPo9kAAslVLy2WDDu3IFTETV23cB5Kdr77xN50gtIp90pTtAoPfIXMm3PVahjT9VkJTqABFIQJRtxACx90660g8Vt7Fxv3B8kuuzuRU2NsqOsAPySBBMPDYHy9dqGDKazfrcmYTngzTKGIcjYLbcfhtGq3UQln4MMSUBGVoSHGUT963bWBi51g1i7osCmgkoRfdxXsXLfOHJe5a6zgvCOuR7ng7q9xG3UfE6C41tJA5HOkyGMSsmkz5QDfHSvJCrfNGM12MuI6q3bHCeKCQf7Wzl4sGrJDSSmPNuvnjvrWGX7p3AQHtCLK2Cuv2vyhDlXhzunUvmQhqvNQRkChddNW2NtykjbYir05FtPd5XCJJEUKsCPA17FdXagfJ2ekDpyePu6Bzs6ujez3vitRTSM217PKYHMaMaYIS0jbl3lds0lX1MHlYnwDeePLnfqBadMxGPzOC876Yzf2lcUiqTd0tbEuNv90vIGIffV9qdSRltMX9iGYv88UrPkDKcn2VwEiBQnzAXOJx8QPrrLIz9vTEaDsfT2zQ3MiSFSePaMs9OQTyFcN1owgsh5FU9uOYprNh6m4EMohlJCI9C8ymKk22rOzYjxdqkaU6WELnSSYRYr7dCXjar04n4IVdFtqzbFHGqBRs36Mj6YlKJQtk3D37CRhYMyoEzQcIrJTi2HcNoTEvtmOlNoAlA9ONNQ3MTj0JbKfl22WMBHS4uwV6xzOJ1JRWxqNAwWgOela3wgiCRRK3iK0kmwOwkwkUUSUeCBwDhG1SnvktqAzFfOr7YMDXipU42u9qiyC9Bc8qNSRlGI5HE10QN6pq7b5x7eNxvzDGbsQkrpu5cSqqwIMwiD8iYiSSqa9QkrfqUJO0MvyN8dwxyaFEWVMiapaelYEtvzS4jfUpmWvcshDBvrjxc0w0pMSEldvDoPWKtWlGutb7JwcCOnfKcyrRqFHnNHpFOi7JUadj3i9bpaDEeLMFg6cVKLyVKv3U3XO3gXaoO7dlBCrSVl0wRKVOSfCbSU9PEMhAi5mxp4rR3v3xuNHlAnjI8JoiwoqWGHq4V1t2pKdn9DXVRNw0axupKhANCBDSvz20dSHFed6LU3GsnUOcuvceSrbyLqwiVeyKmAIOdW0k3XJBMHGtzfC7xasIeWTW8rixHFLtxV4COPDTcG4czpvACSUNQswHFWgnIqzbmxFAegXY9iBvNo5HVunCcrdswqg62Oo3DDwsO7hywWIsFg79bkSlpzNc3wPoowYMhyxNRp8pD2CRMNRaVbKrhK82XOjKIUCF33WxepaobPgqQu8xGhAKh535qQNw268zClcRpxXtdDlCJvdILkeosQpzV8aRxPMUy62mzuaDeEoLsKVDstMRzz8Qr60LxDrIjrsSv5o145E29ODSTkFVYW6gdaH3vHqzeXIGFnlK028o50az7VvJGSeiXFrm3TBFwGoh7DF7DACEHiRp3NeJlusuNW79TRmIk6fxzk5r2MGtyoFGvS0Ie6JraeqKXRz6E8lEp7g8CCDimHVgcCiLhc2SVKOhgVEFob1aARWFc3zqWmABIRNm4xkzoGwGWLwVm6SUNFRCWVjYl84IzVveM1Bn99uMkLBWeaL6hMMDv8uUCyid8BEuiMSdhduaR5Sny9PcXGssQst06RKgE6Ky5ab6cT3g9vNpQfr4r4GQkEqQ9WpCj6zbiFz7IbpnTzmPq6hSROgHJrgTlrLDaKarG45s41EAYu24yPf7701YdsDpmFOd9CPKGiMlPiyPqcR1n1xAEVKIjk0t2F5P5LaQktN62OIQmknfTECtB6k1XDA1lbCAHFWNkWc91quf6dBP3eceKcC5vSlLoBX7ChlY1i8WAPWp3S8uDDhFu8vaFx1jq7dDl0G7lfH4TK0BN61tng5VR1QCy274RxUWgFDgWL68vPfR5iQDQWasy8BSEKTfdrdsFB4M61tRlG78IBLowYh4T0FrQ2qUa2G7Ky9pEl03LRL6HSnIM4tRQk0Ss9uXwiurxJk9ckSzvSajdGOeSq5i33xS8kD6fSgz2OimRImnFcXatiJ40EF8Hhg9VMfSr8ac3T1KvwCtKfERVCkW9T6tIkavkFnFl8SzlAHkzRVYFnus8mgdhFtLDJfR83UFjBCAxRRraaz6IVqMMRKJcY9LCdwcC0uUS45DaegK2YM3zbfyIewYEiNytI2wovugHEtKCBUgw6ScimuiVbM0evjxEmP1sy5nAgzudo7kHvbXmErlveipqXRuguYPf2bNtsC29pqzcpYPBbaSJxlqCvTr1EyiyNuQrvn8tVE0lbEni4tT10GP7n8PjAFJyHuIGq95dJTU3pwf2jYgSbCY4jvm8fqDOtnnCRJNb0vYVUXbRW1A1oXMxti6aKWtmR9FHesKan69dHo0dUJpfB3NtuXpFvoRuxxfACa0MXzHJXbyQ701wvI6Hri2C2UuY87A5NbbAj4i26KP1otzYwkmYRk0z7G6Yd905jnt2r0SeKxRgyA2PIKOUImFKGTv0kECEk9HnO2I8H1NzovetVoj2tVJ1VLDYWvr2LoeRk9raYBNkBcKrE8eI1UfRdvueyfdxewXBmxYoOPahQm5o5pAhEnxq7m7svfAF1ttyJGBvD9eAKvv89aVSeFjupzEKaB03aFPCJlUT46rLTQ9BsPoCYsxt4pkBPeJrn6Jy4vOxTckLNqVVkpHsABzrhbsRLJUK4dr2Trz3e0rUX1DiMm9efg66paoPays3n
mov dword [ebp - 0x3c], str.FxJW8W1m2dUUJEhRtbPKpYcf2etzPbDxvMSI1RHEi3ePkc0X4mvGgSYJeBiu7kPUcB0MmUtxxCkV2eWLQU32DoenvoaCax8T9hlGHcHj5QzsYRQdrflFEClC9nTjvI0qFPW5hklaFSHkxluDow8ycdkRTCAvQN2J56IM4qX9wbJ4iPKMdFXRMhLmVpHQ6LTwABmLGaFe91bnVeGnFM0zPxWwdGScVOzQWamvODjPRzMDjTGkqKlbrMUdjVtGA3q5mVTLyCXypIieIzctgdpSnmUVKoNcVlP4MQcNnDRJyueLEl4RHCYGd12QCoSAwsWsMrhFIP9RcYyQi7gfM5O7NNVi1l4DIY2AoP3NlHxFbpBXBET25ew6e7XO4Ha6DkxtaHl8d3t2m14BmwdmBuCNKvmoim4eVrCcVcVEtDWsS7erO608fnGxAVFYyttxxnPryvrGUcSqugv30T6cBQzF5eVpYNtOIvT6DRzmdisL5je0zICyYH8RBurqkpoUradtMxpvoixiqvE2WXhkI8bCiUbkUhVT3gmWDa1HgKJiS3w5PB3BgIt9aROTDhk79paRUJmkunkAoY0pjk3x9qLr3RKv9DKnm6IP3fV4zML6zw6QiduM9kEwIX0Sr91tEQ2TGTD2tuvVFMHD46Ht7slTOC15WIkpMieUEhrjNgqUIXpOHNh1ccdqACdW9OhYdCM4kdWBkTSOTGAkc7p6agpC62qsjHCIVD21nQjMRiGj7oOL3l8Q3KGdo2RxvscRrJfSIHoWdnX62lMtfqoRb5ubyS94x22jKPxeB7cNbnoQFN0IFGrKj39jP3Ro4gwsIqGbOVUoWS1zOCKnA5qbUmFDof9NfMWbgU9I9QBQ9WXQmRwg9po5CraY0KTHuEfCNIXLy2b5aLaCW0lPz34r5P7f4V1VNkMYkazTPQevVrW6u3qz7K8XJdKPz7PzxYavSVntBL530WaLgLcY9Fb9SnYI6saYpm9rEaIAjrK9qb5m4AEe0E4Qjn4nMz8p3ycKnRe00cpoISmtcJPieV0fVlRJGFlp9VDDHpA9n7xsHchmmXThvBHM5sBduymgvUV8hGvpL7hO0NHAYf5b7UwazMK4Ncf5fYE9VLCLqoblxhImmYQhWeQbBgxmmdyCl2GT7Sxi2cDMnPSpH5Xexa5DOOY05WobJpbWXvW6DEMIKri66QsY7xCvDy7R1Sgv6UkOc8vW9iUklknbqxC34W3VO0lKGMyh58yM3xS1d3y4LE6xfK17dDzSKenGSmi4Jowss7aTcOifmusUjcflV6dM0Omi43QRgASYvfGgP8aVHzC3JuB2aPQPYLHxpqGGfw3it2kmLYrs1SLK39alY2RP1x7HGlgFEVdfHht1tOIyaz9XcFHeyCa8i3vnkN100xx5DepSzwdFYntIwAjFrwYdQ49fHOI3WkE7M0XAcL7qTPbTD5ADmJtOEMK2AKxDLdtaeVaEwDL6bPjAiSssRAINl1kcp0cfOFRn1chhNlyvhtBmziIYEqOrHwV4Xw0goh5PWOGkPELUR8qVAFy3bqXI1CzmnDShSHJAEBVpUUz4VwNgrtzpFAwk6d6hW0r7EERDtfIMt1Yvrv5Td6ik5haog7m7XmlOM01bHhplk8y152WfkueM1q69SEyDGTUaM7mj23FhYkKAAATAfeP3wYhLbmdCaxlvCtloC6W4eSLtXlEOq8XJvBM0JrfTwgqhlAkqcD9HUqGBXBApXQSH7zRAcuu8IdFrvQ3ERxodY1CLdORitYm5RN1jhvLExCjrkvJy3h1Cr4zt9AgVVurVgNKUPFmYbbP30CpzvbIrHWS6GJ5DGUsUm4VUsdm8711n7ewD03mvUrXAukNUcr32WfDwWOU0R8gV5PYLrtWdUVnAOcGSE5EyTu1n3UmXJKWDUALOn618XEHMpLharzjoXpvu530um2ifOjqcfYna04vVmrTa5kvXL3Ma12a7M6el8wXSoF6yxMoP9yA8dthjPWO5
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x4c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.0040b860
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x40ab04
push 0x442d54
mov ecx, dword [ebp + 8]
call fcn.0040b880
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b820
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b820
mov eax, dword [ebp + 8]
jmp 0x40ace9
mov dword [ebp - 0x54], str.8HwJw5KXPlbxW7jXmxj2tY9Tu8EVDkceduCfGSSXRrssNBcSVREaPmK0geiTCDUjVLohUV7SLJyzO50fbdrpNeS6PNl0eN5mGj1sAaquEVhC84K7UwT277wXAwupHHsfeMndiai8C8CFujvElK79Dda0LvFCQrSVITbNGgKHzVVakKk84MSDouP8vi2tahbrHePjBwiHnnKNHxkR5tMjvz3UPV35MJcT8mzF2EYcJWWEi0BfMA9HjLRsEQsWsuMukOnC56mPgCA8rGhKVT5gd9QqN0eRBsQt04XK0YuQtK5V
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x64], str.d4tGmmpnOKruK0syYwECPdDrtPp3mO6qWPQ4XmVAKuXCqeeN6m5x9uTLuRsY79idw8yNW7C40s68zAgKcg0OO6KzKC5bG6L1yoFBJ4Jl7SQmKen2d6GiUP1oUveR6WHdIqbXxQcvfRDUR2Dg8aqBmDej8RjxCAvaMs55sdC69roE7ri5X7o5SyCSbTeVUzMhB7j0o2odDaEM1igsGFyurFqCQCsSxcANThvRoAKMHC3WdoxgNqT7Mze5oTDRoFCpwUCbTzG7DIHFfJ05wgXEba9Hl96upFFlh1GHS17RfChuElEm0kfYLlHHCjwNETcqfg2yLjPo3B5sy8XNHmsUItr4YwnlLXbLOYeQ1eBMv8a8CSQpsMtnifOv01Mc1n0JGa1IbU8VPJgA8lHr4NK9qU5ghAexLlRE8JWXV9nyE5BdVQLmEVKl6ukOVMuTtohdHDXoNtnopOBFE8q8MsgrVHsfgp6PEuP3DOj06kaL9gIMbHVTMn2zhu3RV65Xbb8vjsIKxJFMkYJNvWYvxxh4JrT5ERrEF8qmFCmUbk3ysXlHtmWexICyjM2ffa80EbJWegRYqpDg9xffHzVVOxcTioDNSQ26RC3QMn3GHEDdpHoEoCnc595Yp3qqmwnp5NgW00FfOVNVfnjpY2mio4cmGerzFBbafIeGuAjCIJ2TXnPtQjqMFf7EiqkcU4dxdILr5Eom6VulsErGWHsyjQKPP37Mjgauzmm7aCOjW2ysIvzB6x62f1s6gb1M8YIJNjf8JLVxEaMvOEDATjC71I4VOxrIHmvLclkrp0aFucphwgUwlYM732xQdcVvlmw5jUrayiGl9ICR8qPJL3tpmDAm8Ucl1g3dvXls0tVTWLwca4h6NuyI3tFWkPg2N774jjUB5bmDOQ655sW3XGaFzNCvLwkm4Buq08gUTPBAd6eOCcccL4RPcKoFS8tzqJCeOBPHmIrr5aF7Oc0nI9AJVh4JEnFoNPyH45yf6XMDTj69RUGPxL6yrPp7MSYOmxTt44sJVVptNTLgIy5JMHrFbHiNx9lOB2NahtBliKOdY770brNpT6c0Fk5piRHvMajgvGi4JJGIqCbeCR6w5808EUVTO6fcs1MWtzERWHYd8XorheUf3PYUfn8gTi700OhTqRhWW5SXe16Oa7Vf7aEtTfeutjpKBXyjdcaP50LdT5Ep9bwK9U2ahPiD5b3Co6PHEm9a3gfQF4kpdkFjUVPvHsCDzXoPtzHztaAuYhYC87JEDTPuYddAj7soJ1vBRGO6CVKNMBgNOfPxSrDM0u4Q2d32J2mAYl2pb67mf3qTHYxoX2MuzGy41rjVKMgj1fknND3UoIrEGT8wGw5vOnLqHPLF0bXiRVRxC9NEz5UWLEg9CGswoEDAMLBYF9z0LBaSxpz7nkJSRtztNb9PFNsuX2liQ6OkhcdyBSnKwdFdF2l19vPSb2P1aOeg95mKys4ym3rdlozbY7cp76qLBoYQfhdx1cfhsmUVkifGfNzvQNWJBfTjn20opsXob1GUq42Kp0YeN7pueEJr8ugnm3LO48GFgxc2zVFeSvGHHFf4VEUhQzwYLuSaHL6MNivhDA7Cq48Nf5BjmGf80SNxYmg8xGdidDP6SXedQzuCD08sSVmqEVNzLCggo5NSvchli9PxBnuoLAl0IHb94YD8kgaz1zbVTkAywJeJdiY6SzO1hrBfRAYI5W8nLoqefQBe3wlKo8PnWcExpNTjVjwht7a6JjcsTOtwxmaWKrGXFfyprICAgI25RW8jHBIdDxFhV3J4Tz5Mp0Os7pFVFbMp1C6cRNUxE3ecpM0yTCLsjpk2Sl9YoLjl7XY7HRI48XhyHCndKo00ld0KoNSiSauQ1lyaAMvFVP3w9shBtTvk39PhpdkWyNqTdIwfK2ol64r3bBgIYUNgnh9r4uXyiox2q4FBnNkilyXSBF8cj9qYes4g95MAoUDsBpQTz57N3KEJJv7kKm28rkxQaUpqECM3QI0a
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.004034c0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.0040b9f0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.004034c0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040ba40
cmp dword [ebp - 0x38], 0
je 0x40abdf
push 0x443544
mov ecx, dword [ebp + 8]
call fcn.0040b880
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b820
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b820
mov eax, dword [ebp + 8]
jmp 0x40ace9
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b860
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040b820
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040b820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040b820
mov eax, dword [ebp + 8]
jmp 0x40ace9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004136b5
mov esp, ebp
pop ebp
ret 0x10