Function at 0x401bf1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 8], edi
mov ebx, dword [ebp + 0x10]
push 1
push 0x401508
push ebx
call fcn.004015ba
test eax, eax
je 0x401c27
xor esi, esi
inc esi
mov dword [ebp - 8], esi
jmp 0x401c0b
push 1
push 0x401500
push ebx
call fcn.004015ba
test eax, eax
je 0x401c3d
xor esi, esi
inc esi
jmp 0x401c0b
push 1
push 0x4014f8
push ebx
call fcn.004015ba
test eax, eax
je 0x401c57
mov dword [ebp - 4], 1
jmp 0x401c0b
push 0x4014e8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401c6c
xor esi, esi
inc esi
mov dword [ebp - 8], esi
cmp esi, edi
jne 0x401e01
push edi
push edi
push 0x401184
push 0x401140
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueA]
test eax, eax
jne 0x401e01
call dword [sym.imp.SHLWAPI.dll_WhichPlatform]
cmp eax, 2
jne 0x401e01
call dword [sym.imp.USER32.dll_GetShellWindow]
mov esi, eax
cmp esi, edi
je 0x401e01
mov eax, dword [ebp + 0x14]
push 0x109c
push 0x40
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp + 0x14], eax
je 0x401ed0
push 0x824
push eax
push 0xffffffffffffffff
push ebx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp + 0x14]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
call fcn.00401544
cmp eax, edi
mov dword [ebp - 8], eax
je 0x401dea
cmp byte [ebx], 0
mov dword [ebp + 0x10], edi
jne 0x401d15
call fcn.00401615
test eax, eax
je 0x401d26
cmp dword [ebp - 4], edi
jne 0x401d26
lea eax, [ebp - 0x18]
push eax
call fcn.00401544
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], edi
jne 0x401d39
cmp byte [ebx], 0
je 0x401d39
cmp dword [ebp - 4], edi
je 0x401de1
lea eax, [ebp - 0x18]
push eax
push esi
push 0x4a
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0x14]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, edi
mov dword [ebp + 0x14], edi
je 0x401dd3
push 0x2710
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], edi
je 0x401de1
push dword [ebp + 8]
call fcn.00401650
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 8], eax
push 0xff
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x10]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, eax
cmp ebx, edi
jne 0x401dbc
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x401dbc
cmp dword [ebp - 0x30], 0x12
je 0x401dcd
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push edi
push edi
lea eax, [ebp - 0x34]
push edi
push eax
call esi
test eax, eax
jne 0x401da2
jmp 0x401dcf
xor ebx, ebx
cmp ebx, edi
jne 0x401d7d
cmp dword [ebp + 0x10], edi
je 0x401de1
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], edi
je 0x401ed0
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401ed0
call fcn.0040176e
cmp dword [ebp - 8], edi
je 0x401e51
push dword [ebp + 8]
call fcn.004016c9
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x4014d8
call esi
push 0x4014c8
call esi
push 0x4014bc
call esi
push 0x4014b0
call esi
push 0x4014a4
call esi
push 0x401498
call esi
push 0x40148c
call esi
push 0x401480
call esi
push 0x12
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x401ec4
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov ebx, 0x401470
push ebx
mov edi, 0x401350
push edi
push 0x80000002
mov dword [ebp - 8], 1
mov dword [ebp + 8], 4
call esi
test eax, eax
je 0x401eb0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push edi
push 0x80000001
mov dword [ebp + 8], 4
call esi
cmp dword [ebp - 8], 0
je 0x401ec1
push 0x4018ab
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ebx, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ebx
call sub.SHDOCVW.dll_Ordinal_101
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x10