Function at 0x404830
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
push ebx
push esi
test edx, edx
push edi
mov dword [ebp - 0x10], ecx
mov dword [eax], 0
jne 0x40485a
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea esi, [ecx + 0x10]
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ebx + ecx + 2]
push ecx
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x404896
pop edi
pop esi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret 0xc
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
mov dword [ebp - 0xc], ecx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], 0
mov edx, ecx
mov esi, edi
shr ecx, 2
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40b164
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 8]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x10]
push ebx
mov edx, dword [ecx + 0x210]
neg edx
sbb edx, edx
add edx, 0x80000001
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4049d1
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4049c7
mov eax, dword [ebp - 4]
test eax, eax
jle 0x4049c7
push 0x18
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x40496a
mov ecx, eax
call fcn.004021e0
jmp 0x40496c
xor eax, eax
mov esi, dword [ebp + 0x10]
test eax, eax
mov dword [esi], eax
jne 0x404996
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.PNCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 0x8007000e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esi]
lea edx, [ebp - 4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov edx, dword [ebp - 8]
push eax
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.PNCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc