Function at 0x408070
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x53c
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x544]
push ebp
mov ebp, dword [esp + 0x54c]
push 0x2ee0
push ebp
push eax
push 0x52c
push ecx
push ebx
call fcn.00408c70
add esp, 0x18
test al, al
jne 0x4080b1
pop ebp
pop ebx
add esp, 0x53c
ret
lea edx, [esp + 0x18]
push edx
call fcn.00407f20
add esp, 4
test eax, eax
jne 0x4080cd
pop ebp
xor al, al
pop ebx
add esp, 0x53c
ret
lea ecx, [esp + 0xc]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4080ed
pop ebp
xor al, al
pop ebx
add esp, 0x53c
ret
push esi
push edi
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x240]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x344]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push 0x432af0
push eax
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x408182
mov edi, 0x42e5d4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x344]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42e5d4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x544], ecx
mov dword [esp + 0x240], 1
jmp 0x40818d
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x544], ecx
mov edi, 0x42e5cc
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x244]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x2ee0
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
push 0x52c
push edx
push ebx
call fcn.00408be0
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x38]
add esp, 0x18
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x344]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push eax
lea edx, [esp + 0x244]
xor esi, esi
push ecx
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push esi
lea ecx, [esp + 0x254]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x30], 0x200
call ebx
cmp eax, 0x103
je 0x4082d4
mov eax, dword [esp + 0x10]
lea edi, [esp + 0x244]
mov dword [esp + 0x544], eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40827f
mov eax, dword [esp + 0x550]
push 0x2ee0
lea ecx, [esp + 0x20]
push ebp
push ecx
lea edx, [esp + 0x2c]
push 0x52c
push edx
push eax
call fcn.00408be0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xf5555555
je 0x4082d4
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x344]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x240]
push ecx
push edx
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x254]
inc esi
push ecx
push edx
push esi
push eax
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x30], 0x200
call ebx
cmp eax, 0x103
jne 0x40822f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x53c
ret