Function at 0x4033c0
Capabilities:
Delete registry value
Query or enumerate registry value
Read file on windows
Read from mailslot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x535008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5384f4]
push ebx
push esi
push edi
cmp eax, 0xffffffff
jne 0x403420
push ecx
mov ecx, 0x537ba0
call fcn.00401ce0
add esp, 4
mov dword [0x5384f4], eax
cmp eax, 0xffffffff
jne 0x40340c
push str.CIUMonSelfCheck_failed_to_open_mailslot_to_receive_of_CIUMon_messages
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [ebp - 0x610]
mov dword [ebp - 0x618], 0
push ecx
lea ecx, [ebp - 0x614]
mov dword [ebp - 0x610], 0
push ecx
push 0
push eax
mov dword [ebp - 0x614], 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
test eax, eax
je 0x403752
mov eax, dword [ebp - 0x614]
cmp eax, 0xffffffff
je 0x403752
xor edi, edi
cmp dword [ebp - 0x610], edi
jbe 0x403752
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push 0
lea ecx, [ebp - 0x618]
push ecx
push eax
lea eax, [ebp - 0x608]
push eax
push dword [0x5384f4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40373e
movsx eax, byte [ebp - 0x608]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isdigit]
add esp, 4
test eax, eax
lea eax, [ebp - 0x608]
jne 0x4036e2
push str.connected
push eax
call ebx
add esp, 8
test eax, eax
jne 0x403504
mov dword [0x537ca4], 1
cmp byte [0x53851b], al
je 0x4034fa
push str.Mailslot_message:__connected_
push eax
push 0x537ba0
call fcn.00401e80
add esp, 0xc
call fcn.004038b0
jmp 0x40373e
lea eax, [ebp - 0x608]
push str.disconnected
push eax
call ebx
add esp, 8
test eax, eax
jne 0x403547
mov dword [0x537ca4], eax
mov byte [0x538518], al
cmp byte [0x53851b], al
je 0x40373e
push str.Mailslot_message:__disconnected_
push eax
push 0x537ba0
call fcn.00401e80
add esp, 0xc
jmp 0x40373e
lea eax, [ebp - 0x608]
push str.config
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40373e
lea eax, [ebp - 0x60c]
mov dword [0x537cb0], 1
push eax
push 0x2001f
push 0
push str.SoftwareG._Michaels_Consulting_Ltd.DBDOC_CIUMon
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4036c3
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x61c], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x537ba0
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4036b7
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x537ba0]
mov byte [ebp + ecx - 0x208], al
inc ecx
test al, al
jne 0x4035d0
mov eax, dword [0x5384f4]
cmp eax, 0xffffffff
je 0x4035f3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x108]
mov dword [0x5384f4], 0
push str._Default_
push eax
call dword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
add esp, 8
test eax, eax
je 0x403690
push ecx
lea ecx, [ebp - 0x108]
call fcn.00401ce0
add esp, 4
mov dword [0x5384f4], eax
cmp eax, 0xffffffff
lea eax, [ebp - 0x108]
push eax
je 0x403670
push str.CIUMonSelfCheck_is_changing_log_name_as_user_has_loaded_a_different_configuration___s_.
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0x10
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x108]
lea ecx, [ecx + 1]
mov byte [ecx + 0x537b9f], al
test al, al
jne 0x403650
mov dword [0x537cb0], 0
jmp 0x4036a4
push str.CIUMonSelfCheck_failed_to_open_mailslot_for_new_configuration___s_
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0x10
mov dword [0x537cb0], 0
jmp 0x4036a4
push str.CIUMonSelfCheck_is_stopping_as_user_has_changed_configuration_and_loaded_the_defaults.
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x537cb0], 0
je 0x40373e
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051023c
mov esp, ebp
pop ebp
ret
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov esi, eax
lea eax, [ebp - 0x608]
push str._Working_Timer_
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, dword [0x537cb4]
add esp, 8
test eax, eax
je 0x403711
add ecx, esi
jmp 0x40371a
test esi, esi
je 0x403720
test ecx, ecx
cmove ecx, esi
mov dword [0x537cb4], ecx
cmp byte [0x53851b], 0
je 0x40373e
push ecx
push str.Mailslot_message:_Connected_with_nReplyCount___d
push 0
push 0x537ba0
call fcn.00401e80
add esp, 0x10
inc edi
cmp edi, dword [ebp - 0x610]
jae 0x403752
mov eax, dword [ebp - 0x614]
jmp 0x403482
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051023c
mov esp, ebp
pop ebp
ret