Function at 0x4135fd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x148
mov eax, 0x4ae6ed
call fcn.0048f48f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x144], eax
call fcn.0042f326
push str.success
lea ecx, [ebp - 0x130]
mov dword [ebp - 4], ebx
call fcn.0042f2f7
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x130]
push eax
push 0x4c0c00
lea ecx, [ebp - 0x154]
call fcn.0042f5f2
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], bl
call fcn.0042f451
call fcn.00411527
test al, al
jne 0x4136d1
mov esi, ebx
lea edi, [ebp - 0xd8]
mov dword [ebp - 0x118], ebx
mov ebx, dword [0x507340]
mov eax, ebx
inc esi
cdq
idiv esi
mov dword [ebp - 0x140], esi
mov esi, dword [ebp - 0x118]
mov dword [ebp - 0x13c], edx
mov eax, ebx
cdq
lea ecx, [esi + 1]
idiv ecx
imul byte [ebp - 0x13c]
imul bl
mov byte [edi + esi], al
mov esi, ecx
cmp esi, 0xe
jl 0x4136a6
mov esi, dword [ebp - 0x140]
add edi, 0xe
push 0
pop ebx
cmp esi, 0xe
jl 0x413682
mov ecx, dword [0x507340]
push 0x12
lea esi, [ecx + 1]
mov eax, esi
imul eax, ecx
cdq
pop edi
idiv edi
push 0x4c20d0
mov byte [ebp - 4], 2
cmp edx, 0xd
cmove ecx, esi
mov dword [0x507340], ecx
mov ecx, dword [ebp - 0x138]
call fcn.0042f676
sub esp, 0x18
mov ecx, eax
push esp
call fcn.0042fc5e
lea eax, [ebp - 0x138]
push eax
call fcn.00437fc7
add esp, 0x1c
mov byte [ebp - 4], 3
call fcn.004113ad
test al, al
jne 0x413736
call fcn.0048f9e0
mov dword [0x507340], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x134]
push eax
mov edi, 0x20019
push edi
push ebx
push dword [ebp - 0x138]
mov dword [ebp - 0x134], ebx
push VariantInit
call esi
test eax, eax
je 0x41382a
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042c341
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x118]
push str.specialFoldersFromReg_sid_error_RegOpenKeyEx_
push eax
mov byte [ebp - 4], 4
call fcn.00409288
add esp, 0xc
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 6
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 7
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 8
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 7
call fcn.0042f451
lea ecx, [ebp - 0xf0]
call fcn.00401056
mov ecx, dword [ebp - 0x118]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x138]
lea ecx, [ecx - 0x10]
call fcn.00407864
push 0x13
pop esi
push 8
mov byte [ebp - 4], bl
pop edi
jmp 0x413f5f
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x134], ebx
call fcn.00409229
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
push edi
push ebx
push dword [ebp - 0x13c]
mov byte [ebp - 4], 9
push VariantInit
call esi
mov edx, dword [0x507340]
mov esi, eax
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
push 0xf
cdq
pop ecx
idiv ecx
cmp edx, 0xe
jne 0x4138a7
push 0xb4
push 0xb3
push str._d__d_n
call fcn.0049172d
add esp, 0xc
test esi, esi
je 0x41397c
lea eax, [ebp - 0x11c]
push esi
push eax
call fcn.0042c341
pop ecx
pop ecx
push eax
lea eax, [ebp - 0x118]
push str.specialFoldersFromReg_RegOpenKeyEx_
push eax
mov byte [ebp - 4], 0xa
call fcn.00409288
add esp, 0xc
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0xc
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xd
call fcn.0042f275
push 0x4c0c00
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0xe
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xd
call fcn.0042f451
lea ecx, [ebp - 0xf0]
call fcn.00401056
mov ecx, dword [ebp - 0x118]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x13c]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x138]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov byte [ebp - 4], bl
jmp 0x413f59
push 0x505ab0
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0x410
mov dword [ebp - 0x140], ebx
call fcn.00408fd9
mov eax, dword [ebp - 0x120]
shr eax, 1
push eax
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0xf
call fcn.00406eed
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push str.AppData
push dword [ebp - 0x134]
call esi
test eax, eax
jne 0x413a4d
push 0xffffffffffffffff
lea ecx, [ebp - 0x114]
call fcn.00409a5b
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x10
call fcn.0042f275
push str.AppDataFolder
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x11
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x10
call fcn.0042f451
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xf
call fcn.00401056
push 0x11
pop edi
lea ecx, [ebp - 0x114]
call fcn.00404b74
push 0x208
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0x410
call fcn.00406eed
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push str.Local_AppData
push dword [ebp - 0x134]
call esi
test eax, eax
jne 0x413b9c
push 0xffffffffffffffff
lea ecx, [ebp - 0x114]
call fcn.00409a5b
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00438012
pop ecx
pop ecx
push 0x12
pop ecx
mov byte [ebp - 4], cl
push eax
lea ecx, [ebp - 0x130]
call fcn.0042f275
push str.LocalAppDataFolder
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x13
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
push 0x12
pop eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], al
call fcn.0042f451
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xf
call fcn.00401056
push str._temp
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00409229
add esp, 0xc
push eax
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x14
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x15
call fcn.0042f275
push str.temp
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x16
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x15
call fcn.0042f451
lea ecx, [ebp - 0xf0]
call fcn.00401056
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0xf
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x114]
call fcn.00404b74
push 0x208
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0x410
call fcn.00406eed
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x134]
call esi
test eax, eax
jne 0x413c54
push 0xffffffffffffffff
lea ecx, [ebp - 0x114]
call fcn.00409a5b
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x17
call fcn.0042f275
push str.LocalLowAppDataFolder
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x18
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x17
call fcn.0042f451
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xf
call fcn.00401056
lea ecx, [ebp - 0x114]
call fcn.00404b74
push 0x208
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x120], 0x410
call fcn.00406eed
lea ecx, [ebp - 0x120]
push ecx
push eax
lea eax, [ebp - 0x140]
push eax
push ebx
push str.Personal
push dword [ebp - 0x134]
call esi
test eax, eax
jne 0x413d0c
push 0xffffffffffffffff
lea ecx, [ebp - 0x114]
call fcn.00409a5b
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x19
call fcn.0042f275
push str.MyDocumentsFolder
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x1a
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x19
call fcn.0042f451
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0xf
call fcn.00401056
lea ecx, [ebp - 0x114]
call fcn.00404b74
lea eax, [ebp - 0x11c]
push eax
call fcn.0042439c
pop ecx
push eax
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x1b
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x1c
call fcn.0042f275
push str.ProgFiles32Folder
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x1d
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x1c
call fcn.0042f451
lea ecx, [ebp - 0xf0]
call fcn.00401056
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0xf
lea ecx, [ecx - 0x10]
call fcn.00407864
lea eax, [ebp - 0x11c]
push eax
call fcn.004244c5
pop ecx
push eax
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00438012
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x1f
call fcn.0042f275
push str.ProgFiles64Folder
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x20
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x1f
call fcn.0042f451
lea ecx, [ebp - 0xf0]
call fcn.00401056
mov ecx, dword [ebp - 0x11c]
mov byte [ebp - 4], 0xf
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [0x507340]
mov eax, ecx
imul eax, ecx
cdq
idiv edi
cmp edx, 0xb
jne 0x413e34
push 1
test ecx, ecx
pop eax
cmove ecx, eax
mov dword [0x507340], ecx
call fcn.0042bd20
lea ecx, [ebp - 0x130]
push eax
call fcn.0042f3a9
push str.is64bitos
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 0x21
call fcn.0042f5f2
lea ecx, [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0xf
call fcn.0042f451
call fcn.0041d95c
test al, al
jne 0x413e9c
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x507340]
push 7
pop edx
test eax, eax
cmove ecx, edx
mov dword [0x507340], ecx
mov ecx, dword [ebp - 0x114]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x13c]
lea ecx, [ecx - 0x10]
call fcn.00407864
mov ecx, dword [ebp - 0x138]
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x413f56
mov dword [ebp - 4], ebx
push 8
pop edi
push 0x13
pop esi
mov edx, dword [0x507340]
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
idiv esi
cmp edx, 0xf
jne 0x413f86
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea ecx, [ebp - 0x110]
call fcn.00430a82
mov ecx, dword [0x507340]
push 0x17
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
mov byte [ebp - 4], 0x26
cmp edx, 9
jne 0x413fca
push 0x5c
pop eax
push 0x70
pop esi
test esi, esi
je 0x413fc3
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x413fb2
add eax, esi
mov dword [0x507340], eax
push 0x505ab0
lea ecx, [ebp - 0x118]
call fcn.00408fd9
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x27
call fcn.00432bf9
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 0x28
jb 0x414003
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401027
lea eax, [ebp - 0x11c]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x29
call fcn.00402394
mov ecx, dword [ebp - 0x11c]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x27
call fcn.00401056
mov eax, dword [ebp - 0x144]
mov esi, dword [ebp - 0x118]
mov word [eax], di
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41406c
call fcn.00409bd9
mov ecx, dword [ebp - 0x144]
mov dword [ecx + 8], eax
lea ecx, [esi - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], bl
call fcn.004090f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.0042f451
call fcn.0048f3e1
ret