Function at 0x409bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46c5d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersion]
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
xor ebx, ebx
push eax
push 0x20019
push ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409dad
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
lea eax, [esp + 0x3c]
push edx
push eax
push ebx
push ebx
push str.CommonFilesDir
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409dad
mov dl, byte [esp + 0x13]
push ebx
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], dl
call fcn.00409470
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x20]
push ebp
call fcn.00409600
test al, al
je 0x409c9e
mov edi, dword [esp + 0x20]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x3c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x20]
call fcn.004095e0
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x150], ebx
call fcn.00409e90
add esp, 8
mov eax, dword [esp + 0x34]
mov byte [esp + 0x148], 1
cmp eax, ebx
je 0x409d41
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x409cd6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x150]
mov al, byte [esp + 0x2c]
push ebx
mov ecx, esi
mov byte [esi], al
call fcn.00409470
mov ecx, dword [0x471338]
lea edx, [esp + 0x2c]
push ecx
push ebx
push edx
mov ecx, esi
call fcn.00409830
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], bl
call fcn.00409470
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x409e67
mov al, byte [ecx - 1]
cmp al, bl
je 0x409d32
cmp al, 0xff
je 0x409d32
dec al
mov byte [ecx - 1], al
jmp 0x409e67
dec ecx
push ecx
call fcn.00453071
add esp, 4
jmp 0x409e67
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x409d66
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x409d5d
cmp al, 0xff
je 0x409d5d
dec al
mov byte [ecx], al
jmp 0x409d66
push ecx
call fcn.00453071
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ebx
cmp ecx, ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x148], 0xffffffff
je 0x409da1
mov al, byte [ecx - 1]
cmp al, bl
je 0x409d97
cmp al, 0xff
je 0x409d97
dec al
mov byte [ecx - 1], al
jmp 0x409da1
dec ecx
push ecx
call fcn.00453071
add esp, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x409dbc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [0x48c768]
test al, 1
jne 0x409e3c
mov cl, al
mov al, byte [esp + 0x13]
or cl, 1
push ebx
mov byte [0x48c768], cl
mov ecx, 0x48c750
mov byte [0x48c750], al
call fcn.00409470
mov edi, str.Program_FilesCommon_Files
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
mov ecx, 0x48c750
push ebp
call fcn.00409600
test al, al
je 0x409e2f
mov edi, dword [0x48c754]
mov ecx, ebp
mov edx, ecx
mov esi, str.Program_FilesCommon_Files
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x48c754]
mov dword [0x48c758], ebp
mov byte [eax + ebp], bl
push 0x409fe0
call fcn.00431d88
add esp, 4
mov esi, dword [esp + 0x150]
mov cl, byte [0x48c750]
push ebx
mov byte [esi], cl
mov ecx, esi
call fcn.00409470
mov edx, dword [0x471338]
mov ecx, esi
push edx
push ebx
push 0x48c750
call fcn.00409830
mov ecx, dword [esp + 0x140]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x13c
ret