Function at 0x40bf12
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2820
call fcn.0041128b
mov eax, dword [0x42104c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x2820], eax
mov eax, dword [ebp + 0x14]
xor edi, edi
push 0x25f8
mov dword [ebp - 0x281c], eax
mov dword [eax], edi
lea eax, [ebp - 0x2810]
push edi
push eax
mov dword [ebp - 0x2818], edi
call fcn.00411211
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x2808]
push 0x80
push eax
mov dword [ebp - 0x2810], 0x25f8
mov dword [ebp - 0x280c], 0x2f
call fcn.00411144
add esp, 0x1c
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2708]
push eax
push edi
push edi
push 0x401ec0
push ebx
mov dword [ebp - 0x2814], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40bfc3
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40bfe3
push 0x208
lea eax, [ebp - 0x2708]
push edi
push eax
call fcn.00411211
xor esi, esi
add esp, 0xc
inc esi
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2500]
push eax
push edi
push edi
push 0x401ee4
push ebx
mov dword [ebp - 0x2814], 0x1048
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c023
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40c043
push 0x1048
lea eax, [ebp - 0x2500]
push edi
push eax
call fcn.00411211
xor esi, esi
add esp, 0xc
inc esi
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x14a8]
push eax
push edi
push edi
push 0x4017a8
push ebx
mov dword [ebp - 0x2814], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c083
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40c096
xor eax, eax
inc eax
mov dword [ebp - 0x14a8], eax
mov esi, eax
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x14b8]
push eax
push edi
push edi
push 0x401f0c
push ebx
mov dword [ebp - 0x2814], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c0d6
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40c0e7
xor esi, esi
mov dword [ebp - 0x14b8], edi
inc esi
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x14b4]
push eax
push edi
push edi
push 0x401f1c
push ebx
mov dword [ebp - 0x2814], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c127
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40c13c
mov eax, edi
xor esi, esi
mov dword [ebp - 0x14b4], eax
inc esi
jmp 0x40c142
mov eax, dword [ebp - 0x14b4]
test esi, esi
js 0x40c2da
cmp eax, 0x8003
je 0x40c158
cmp eax, 0x8004
jne 0x40c1c8
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push 0x401f30
push ebx
mov dword [ebp - 0x2814], 0x14
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c18f
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jne 0x40c1af
or dword [ebp - 0x280c], 0x10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14ac], eax
mov eax, dword [ebp - 0x2814]
mov dword [ebp - 0x14b0], eax
jmp 0x40c1c8
cmp esi, 0x80070002
jne 0x40c1c0
xor esi, esi
mov dword [ebp - 0x14ac], edi
inc esi
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x118]
push eax
push edi
push edi
push 0x401f3c
push ebx
mov dword [ebp - 0x2814], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c200
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40c220
push pe_nt_image_headers32
lea eax, [ebp - 0x118]
push edi
push eax
call fcn.00411211
xor esi, esi
add esp, 0xc
inc esi
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x401f5c
push ebx
mov dword [ebp - 0x2814], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0x40c260
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x40c280
push pe_nt_image_headers32
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00411211
xor esi, esi
add esp, 0xc
inc esi
test esi, esi
js 0x40c2da
lea eax, [ebp - 0x2818]
push eax
push edi
lea eax, [ebp - 0x2810]
push eax
push dword [ebp - 0x2820]
call fcn.0040be9b
mov esi, eax
test esi, esi
js 0x40c2da
mov eax, dword [ebp - 0x2818]
mov ecx, dword [eax]
lea edx, [ebp - 0x218]
push edx
lea edx, [ebp - 0x118]
push edx
push eax
call dword [ecx + 0x78]
mov esi, eax
test esi, esi
js 0x40c2da
mov eax, dword [ebp - 0x2818]
mov ecx, dword [ebp - 0x281c]
mov dword [ecx], eax
mov dword [ebp - 0x2818], edi
jmp 0x40c2e0
mov edi, dword [ebp - 0x2818]
test edi, edi
je 0x40c2f5
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
add eax, 4
add eax, edi
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410f5c
leave
ret 0x10