Function at 0x405090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415ff9
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x50
mov eax, dword [0x478010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 2
push 4
lea ecx, [ebp - 0x18]
call fcn.00406d30
lea ecx, [ebp - 0x18]
call fcn.004037a0
mov byte [ebp - 4], 3
mov dword [ebp - 0x3c], str.5rLkfVTiLODkISAvXHjwcpF0z1rH9mxNdMdo2YGNRA8BYzhibCJS5FM2aHzCbgArC85PjEIf58A4zlAibroIJtVROoSIggD8G3HkVdGXxY1w64hbL0NqnGOSQzhf4Cbj97fqWCOUg8FaMO6H86dakRE2vbRMSKLy6OzuuyOz9Y5vwTRIPqFY4ibSSE4hHiWt4BnFQoW32q2mOLn9PHWHdWDxXOyV55iMXU31vcXYzNASR9tWuyC2xvNJD1imganh57Ol1K8DmU4zrTYfxy0rVlXIH0rq8MMO8uDl6xfOSY3eQGRSch3B9kEJDLdAhYzibSnE3od1gznQAa42MPsJu8VMQTjCSU3mFIDACWHJBQonzBqH7yrYSNNLUjUemSKK4w3VVMrefDz98tIM1yJUDQ847jO8VMxHW8h0Wya0YInpRBonkVs6RC0KgKFA4QUGWvp4oLJe9wcRC9yMVX80qhyDE42fuC4jFFTkJJ9Mv1fFvxUvJVG5UL9c7hlfe0KsMHD0gDyirJHpUBPgBeqKJXeC1XXavbqbWMPbXrf1MQAavskVuk3n3upNbj81TIbKObaXDWDYU2Ppby2EjKCfLNqm14WictHB6cEnQNhRHAf78FfI18ECAeaAoyqWrEnqugHqUtT5xoyIMWTFyaYIWSEuHFumYMc5IRa3TglKmRl4SMycWDSJ4I5MUUTnpHLDxzc8FhAFA36toYrg9o0KUyIRqmniAAqoF1qvQtLmaxdJyBnXcmnRhX2RcBtRDX3MUVP1MD92xwV4S6RE6yq6CqBAITFhWFex26MnEm9BHJs98d3PU50rgcbzW3idcR9vPq4km6iHaxN7n1GhH6iNemB2ooCLi2DN9PNvz5iESPVxTUcTwPU6kQUT4TMuq1dHMozwJrXvq7EuiEDQtDP99rfNv7Nq3VYHBciX44jWOrJrmjHuETtL1HT5L8B2SiHvtrjlxIptBsKkffIld5zF43iLoD0eVTM1gnk7SXwbRqdzicFbfMkA8I1BtTFoqRikRntJCe3Uc6w19caVUBgaSML2AKelSFSJcQey1IweFTXXGEtNpglYH8pdRD9n66TMbkuV6vCnVMJa7ft7TzTCMtWXUxMd7giaKly9Gt9i6gRQP1HrAoEB3ouRT3r3fCHMSA5pkl5EPtlEyjnxGEKnbglbriew5WlMxN8WnEuNh7YJePgqqpFnGgTQJ3dJrl8tHMbTUMCN8rzC6BQd3KjWLtJxtAjfteAnnr2lOUQqzkGnEXfkOSYqqIxBQOn1wnSfAJXlH7I8kbTsEzbk02m7HW1w6ANosXP0SazssH34UaCNWtPgPaQ8w0zc9hTKjmzJcngOU5iHKpRWkbMcyN0IrkuuvOoqD5flQ8NDV8M54nI53Jl7xIzooWN1F9P9CeX7kF2gSKqYu0R9r9iPYM9Nta27dLNLUNKzQGcyHaLp5EgabUJBNakCWiMcvETE0ImIdyfh8RVHM2BCDrz9E9vLqn77HHDvlIsrABFoUXmphJREd4kx1tsljQ4psJUlKeWAfyXECJbBLipCDKKWslQdPimb3r7nmiX5wvxzEyeS557aW8OwBim16ps1kq3aDAMORYMpgW4kAohaxsGqbhzbX3v1H92smsVHLQ1dtCVzepEN5CHPXD4QbdlNa0KkEQ7IOoxLdmLJzcrvDbrWQ5lXh3wwjfr5XngMFiAE
mov byte [ebp - 4], 4
mov dword [ebp - 0x44], str.bzEPhRsJlgevOGnm0Fg6aDcXY3Pu21Ufvnnj5nk1GjkqO12alQ0Y5vvYC2lu5McMXbTp1kKLSdKXdRen2zxjTcqJ47yWvudBTCWxtH4sCnSYGFq60mNMuUplmiRMeuiejzfdisjnMUDVRgkKMUOb7PFKEicu1E2wO7uXEunDkDqOdYT8Daxmp5dKgwY8yhiEJvtsbCQco3eg8Apjoe1fqIKYC6ckr6d9YfXoPG8PfouqSkmIwteRBMPQlOhj8laO61IB0plahyb5DSv7coghJgHD8eeSYDNQhGzWrvqB5bNyqmUy9JaG34rsRyxoe75JomknjE3qjAmLcnSuOs0j96PezIfO2kahUjNVasDJNNmcNWYBgGRu2dsHolQGoiwEX3RJWtqqxzRVVA319KRC4bFsBLq6ftRkjgmXXenhCkqBfdc4Of7b3JzVE2wKpOb7mQbSXcdOjc6rdgLvhSLI7C2k7SdTyFI89VdR3Ntu03ugexqn7DWSQsGJGK6niS0PmOnjHqpwdoGrAo42zFQobRW3fMhD7IN3lYAJOp4XDuiUtyPdAkD2soY0MQoEnUcR3bNHH1fH5jtgWfcWFbwEoxI7puA0kFsJ5iWT0uusvtRzY8Oz10If7NRNqWuQaCcrHt23N3bL0nCyokFMqKsO8ASffdiVSQg5N11WxOn2N4qsVpYBmCYskg1vqUFyrVJ6TsUx4SXpjitagngoVYxm19fqErQBFP2dbwJJCjzW1wt6QJfNSprNRxmILQwyh3Kyq9xDO7AwzWEf9pYPBGV6WDQSLUVsQrPw8tmlGebMOrLcqMJP5NnFJE3iK7QUVosRlPg5CzhhEy48TF6r1V324H060CvaRH2EPLl7q1zjbAjMEoQDGvjJbTwkTkHWWFhhX1FOinw5CvNtEF7L35wrIheN0NIElYbsJxoCNqlAk1l5KIesGu4TIOsbYlod8OVhOtB4UR2COug7IaNEOHhSzulXEV28eN67vbtI0omSI2nBc7KGjWCi6cKs0huvu1oFIeahNDOOOr3cI8cbGCt5uLnO8L81E0RY4lOusaIK3c95Iey55lhkk3B1gvOTlIOqJwFbvw7Osw34uQwEhUu7BMCQMiWY4DOHBUThRdNYhiEwhU3xInzEFFpXgCpGdCGPaTJJREn3P9on9OkEsV1eipEMjIEY61xay3qEcfcDCoa97lQhe1ibDBQDLvBqSDHny7caWlmbh1qX3Lm0lfUWdPfBAzIbFJPuz7mtCfKXyK9uHQRKOsr3XCPEPgWWpYOPHcaU4c27m2NXKJDLiFo4dsrxKzN1WzN5CLUPzqByKXngL5eD19kEFLySHegh36deFqWHN4E3VonKaWqhVjOArVx5dGPbmCKzPUz4Mg7bdOPshTkUyOsF2jqoU4AJnEnNKhavW3Gm5uiWlVf77uQOic6UCb2AxbhQGH3JatQR8mMmssNLqpCYwN7zfAgSaBY4wzDwBuRK72TpEpQ6XMpgnmS5RxOqqOd3PujIU2IUWSIqN8xDQ7QKU1x0GWOxr9YLLite5Yb7EVPgHpghQ2CHzSYK6tR9amBxcWz5uaMSpVnp1wGelpqnd0Syyt6JvHAXyI2kVnQCvlYSkbJ1njVa2nFrH09pbRMYXYjazlryrkMj6wCuD0RuF1xklO9NSYgRbmRNYLoHMJrSEdNQqWXU8NtSmmN99DmfzHdy8hiWh7anfh0CIPY1OBdEONhhnTG1c1QPkvv1MJC90gdC6wEvvhe2V0izWg8sHwi7kXaomz16W9H4P7L7nyNb1y3Y2FPapE4Ufbbt8i7LYl0pMS8G1dW8AHj5Kxb2g5JTCBdqph7eUKRvtjw9nUtJeriX7JSjQAQKlDEfDAN9sHow46NuNiWEHqLn0yQzrg1hHEKNo1qKaYSVn7LN4WFqV42ybLiJRkOjpYqKo3NSvQVxPukdgpKlWqSnkAH0FeRNxSpBuQeUSXpvxujXWc3AWiBh0IMVYCMMxydFIjvQvwoidDBm2Jbaeb4hEfyqCnemid37d30dy5iGdD9MNrxRgfAXCLiF1vQF2XYTelxa3ILPxpOHWFhmEq1v9jveekl0pTMQdcvpTWIbQ2yFBIj6ahKFlm1X0gnEt30BJjLdXIkvrPlicRkoE9FKeRR5FYE4CoWDu5IsUs3Vfm6hCjLna0bGGdq5gmVIFTJelCiBn1ASNiPo8fR1RAdVxeeOnuUaOrbufJUEOIV8lzxunKB43hcArecvkCm4GRUpmWwdCmkLIkdwoWHbbe5g0WqC2f48fYjIVuAs48gepSTtBPILPelbEBi122LaRxw4of59jJxgyMDsQpT8KOX8MQuQySk3jgtRgRuCpjbVVLtDkAilNdrvCNVCpRvIKMNogFOMiquEWKufDhIlYkMfi0N97iafIJ0IcGA9N83bETMBNiKSsOxSQuyzME9IbGfM4DRKFUHyJys9asJyv1JxcIUoaEjkq9wjWYbguJxbygCjwuLLAWXSaCRpGaxmdAyT8QBUMXWL4LpF27JJfmhbpyEJnjI8CrSWY4JuVuxmS20SfWgzcGhiznNRUoL6a6JG3cEofAemhewD8DK8j54C6l6yEVCJJRcaYu0yR1ar8HcI0IoaAphbndAWyDcEC32hDSTxS0NE01d2AI6c8c3xE9zudqtuuROKW2YtgdPm3WLu15ADfH2Q7NEVSop0oxT70jr1PJdf6s79MfjGlUpQLgFpsT0YNcmK3LVslbakBJt6OzvmYtQQz6IlsselxV5QtaFEqycWG98wnocyPJAKlhct5L93RNGsLYm2Ak3L4hmF9X6WMNj1MhJT6NM9oNzqCndAgqLO8TqTexM3LpgFw0e30GaL9TTqOeYUIgDpT1FC2iweW3cn3MSEQJo8w1AXj7VbbDdc3OqlsnnDxTnjKt8MowvukYmpajP8IQjbRFYCIRbjYQAfTkDP0LDfJEDUANX4jF2EjdJ6sNw4Mt8zF3qyGrTNlLEuYh8TOgIhWc3xHcLz
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
lea edx, [ebp + 0x10]
push edx
call fcn.00403640
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x405178
push 0x44a074
mov ecx, dword [ebp + 8]
call fcn.00403720
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403b00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403b00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403b00
mov eax, dword [ebp + 8]
jmp 0x405336
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x20]
push ecx
push 0
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.00401a10
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00404f20
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.00401a10
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.004062c0
cmp dword [ebp - 0x38], 0
je 0x405235
push 0x450b0c
mov ecx, dword [ebp + 8]
call fcn.00403720
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403b00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403b00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403b00
mov eax, dword [ebp + 8]
jmp 0x405336
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403640
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.00403b00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x10]
call fcn.00403b00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.00403b00
mov eax, dword [ebp + 8]
jmp 0x405336
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a56e
mov esp, ebp
pop ebp
ret 0x10