Function at 0x402960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433c58
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x40
mov eax, dword [0x48e868]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x18]
call fcn.004087c0
lea ecx, [ebp - 0x18]
call fcn.004016e0
mov byte [ebp - 4], 2
mov byte [ebp - 4], 3
mov dword [ebp - 0x44], str.JFmBxwOwpK4haHkvf2qJYIFqdCziY2OTybgeUlHic1NkaFk0oyJvOUCSNusv407MNntB3wuV90AuL6SGS1W5z603HqHtL93ursKVCXxE311YGXQeHKLwofwStIB0Xjzb0tkBGeqBKMAIupKKr4p9HV7kM3nDmpltBnQmBsU3fsMpxISUf5uxjrSlmteKwyIzW2r74uXcSQoknk4qvKdYzpFVtuWu4OatsbDqrsOWN88XfYKKiaHW7Bu2gDeK1sbGuuRSE3n8nHrvIdo176dKpb6BMrmJSdu3OKUySgzr98lWea5JLGFUF4uo6V4Vw8MVym9ftEIdavMMwjBza7pXSYKNJLWh0DpRQOlGwEdtYwxUyums9D9oMxa0MbxcGpkCNEGBUvEXGrlIBNnt22q3c9ilBLmFX81lHVtf8TDwIKHzTTP0340IzCNdpjCA3xD58IH0e0Jtauhge7EuW2ppoSi74dP03hkxHQLndjY3V47DYm7oRNWYQlCOvmjPFa8yu6lkD23YE0GuX0QfkxfXlpMxyqddiyKR2tuphkHqTzjJGT5smFfuwvNR3Ovo2lr6kiAP5oLTeQ8sjrznqRfka6NLcdsL2XxfHLvmmPlLVnY0c08zYkLHnkP2i0RsTgRFvsweYuN80NcfqwihQvGDOaUQwlnj4zbc2krfGnxsBhb2wqt23ojI6sElztx1swaTe3XKEgMISgDILVj2JDeJtl0huAH9buWvXJ2sH8KVlb3wz20XXlhNP9WsJOW3txfhXYRnh9IcRpCutmdbF2zjHnvLah9WHpd3louuQLMaNME4LxGbaPvLg5BCfTPQPLP5xWKdeTU9BArRUqXaQSFvD4Q4wv61odbc6FlcJf5h0q4uksKnvGAFQwX2aIvNdybii9934IHYXIBFDmqShqU7TPz4PhLYYG8jECaj0A8tm4PH6HK0DSAEQJiv26fQ0oNr7XDCqyGFRafnwX0ipwF9RlFs7e2a6kqbTG3yfIDluzwdGA14TMMKaf2Boh2wlb6FutTYicQ7MSCWyyXBIJmvRm7dIXaKQApRdvvoXgsyFYk6pVYmXxGJXyYjq70kaDs2h2ISkEIf0OJ5FTf4HpgBCt53FBdv1JQ7UUjfu2hlOECuPFiqLnEWvhK3VB8L9qB46RdT9DFru7lbnA85LlBmLLhoWDHNgj7Jxpt1ugmzD6WaN23CIXak4oV8O7iHKpjfWymQoXAPqGvNawxO4lpfl8zbT2XzXi4ktUG93snHeeXDTTRhpeaeOlw85Stad2ygFVB7MoKdzCkKllzXjUKkDWdJQrtmETk1iHwhgpEsRd7h1Cq0cRc7sKAY06S2AEPkUuBIFYuMOX6lsT7fjBgDzt06FTO5lowHWFF2Pw7Qtwd7iKhlITowNGjC5WAxGJ4viIbzxEi2kQKctbcRQd20NneVcFIBrlYt2FwdOAmdTWIJDxKYCgIxh1P2qdgHbTpIS8HNVKHXL0Kjiu26BqpBOeyq7Lgpz6Dapb9Tp8f72Q5lcgQQPfrjOjyqCnzp19zCBeCEYKWTJaIjPwFKLsvmQv7HcLTxxJGPVScSyDQXTkwSmxudm5BaG8zk5vKNW81pyq2Xv2JwVigeDxXG4mNE10ztMaTVNQTeztCvIoX99oEyVbhs9wGJXGckKAjOIiXFCkx9xz8EBIMKhTF8EtwtzrDNTSqN2kjfxY9vwf1H2Xy7EhqKc1Cg45sGtjPF2qHR9wbb1VuHIqJrednymYEnmintgFYElpCDi5MI6WBItWYUuV41KmI7dzhkAmgrMp9PRTsCCtyyAQCFvWAkwFpBBoQzUcOKcyxuIyPhWWAzn1cH7kq0kx9cxxXQgnkhHn33jH4kwA4BYh0mVMXISnSyixB9ksUmCvgnGc90BCDeCmnIuk563VkuJS9DX8YjrNs95yw2J9QtjshPJcVoV1ccBQMGKBum9peHVjKyr65tFicC8U0sNnldEtxKWD0B7JtWQ1s5a6tx77dRxj9P
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp + 0x10]
push edx
call fcn.004015c0
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 8]
call eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x402a3d
push 0x4355a4
mov ecx, dword [ebp + 8]
call fcn.00401660
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040bff0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040bff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040bff0
mov eax, dword [ebp + 8]
jmp 0x402be8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x20]
push edx
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp + 0x14]
call fcn.0040aff0
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.004028f0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
lea ecx, [ebp + 0x14]
call fcn.0040aff0
push eax
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.00403430
mov dword [ebp - 0x48], str.eweq9ol0roY0kmFerkWDaTANjcAwTAG7GTfKDzTXsQ18Ur5BFKvSAMpLVksy39EM0b2SJIaOCA8K2sH3VFhhjMc3Q5wPr0965q1gB1RCa6v1iQIL4JxxLxURVgzxKNg7eqOns1Ie8WYARXKehhJpu4tcTL2jd6Cc3xfHCFmemT8Dz4R85gyB6JKJgE5lDkhXrOlKuloYBOdSIhAukhSUglz1p8AmpNHgIUk3xJlCmHcugBSyazM7K6Hhvv8yuJSgq9C7k0J3YKKeGXbR71yYoxSyBjWFrfcmttSvsE2UFegk
mov dword [ebp - 0x50], str.XKqBAxI6PAVpEPfX7PdaUvBUspKgDRfkSUfTzIOgjXM0WEscvTM2SU0CtdOWYHMLSmadqdym8ogPd6VvmRWwKxPycxsNTTG6nwfl4YmX2WKePF4n8lKkRlV2atLLXMukkJ3mHxTGR8ze711SOSIqQYhpYqPyCOr0jdyBV717wP2H7VBx3SN1GI54mfEE6Dsbu6eHCvJQYlngJlnp1EqAHrHm48ehtXcqAmWu1dlziiNgJly5tquUvGNGVGssEHYPUU57ClgUAKtPG87EMgiY4F8tSWfWnTRYkypYmFbw7btUX3FIP9D6FdJ8WhoibIA2jVeKpyV78oS9OCApaWJMWLP6btINttCzSDdmk5Bn1DHXhsUnNrjSQrOQKGVwtD7LG7x0VSt1evUAemqK
cmp dword [ebp - 0x38], 0
je 0x402b0a
push 0x435d7c
mov ecx, dword [ebp + 8]
call fcn.00401660
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040bff0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040bff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040bff0
mov eax, dword [ebp + 8]
jmp 0x402be8
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.004015c0
mov ecx, dword [ebp - 0x28]
or ecx, 1
mov dword [ebp - 0x28], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.0040bff0
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0040bff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040bff0
mov eax, dword [ebp + 8]
jmp 0x402be8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e8f2
mov esp, ebp
pop ebp
ret 0x10