Function at 0x40e940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, 0x4ed404
mov eax, esi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e986
test dx, dx
je 0x40e982
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e986
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e960
xor eax, eax
jmp 0x40e98b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40ebb3
mov ecx, 0x4ed404
mov eax, edi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e9c6
test dx, dx
je 0x40e9c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e9c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e9a0
xor eax, eax
jmp 0x40e9cb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40ebb3
mov ecx, str.HKLM
mov eax, esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ea06
test dx, dx
je 0x40ea02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ea06
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e9e0
xor eax, eax
jmp 0x40ea0b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ea19
mov esi, 0x80000002
jmp 0x40eb18
mov ecx, str.HKCR
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ea46
test dx, dx
je 0x40ea42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ea46
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ea20
xor eax, eax
jmp 0x40ea4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ea59
mov esi, 0x80000000
jmp 0x40eb18
mov ecx, str.HKCU
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ea86
test dx, dx
je 0x40ea82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ea86
add eax, 4
add ecx, 4
test dx, dx
jne 0x40ea60
xor eax, eax
jmp 0x40ea8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ea99
mov esi, 0x80000001
jmp 0x40eb18
mov ecx, str.HKUS
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40eac6
test dx, dx
je 0x40eac2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40eac6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40eaa0
xor eax, eax
jmp 0x40eacb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ead6
mov esi, 0x80000003
jmp 0x40eb18
mov ecx, str.HKCC
mov eax, esi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40eb06
test dx, dx
je 0x40eb02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40eb06
add eax, 4
add ecx, 4
test dx, dx
jne 0x40eae0
xor eax, eax
jmp 0x40eb0b
sbb eax, eax
sbb eax, 0xffffffff
neg eax
sbb eax, eax
and eax, 0xfffffffd
lea esi, [eax - 0x7ffffffb]
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov dword [ebp - 0x210], esi
mov word [ebp - 0x20c], ax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0x20019
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ebb3
mov edx, dword [ebp - 0x210]
test ebx, ebx
je 0x40ebc4
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 0
push ebx
push edx
mov dword [ebp - 0x214], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40eba6
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7299
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7299
mov esp, ebp
pop ebp
ret
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.004b7299
mov esp, ebp
pop ebp
ret