Function at 0x408370
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x408d70
push eax
mov dword fs:[0], esp
sub esp, 0x660
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
push str.KERNEL32.DLL
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x408481
push str.OpenThread
push edi
call esi
push str.CreateToolhelp32Snapshot
push edi
mov dword [0x40c6bc], eax
call esi
push str.Thread32First
push edi
mov dword [0x40c6d8], eax
call esi
push str.Thread32Next
push edi
mov dword [0x40c6d4], eax
call esi
push str.Module32First
push edi
mov dword [0x40c6d0], eax
call esi
push str.Module32Next
push edi
mov dword [0x40c6cc], eax
call esi
push str.Process32First
push edi
mov dword [0x40c6c8], eax
call esi
push str.Process32Next
push edi
mov dword [0x40c6c4], eax
call esi
push str.GetSystemWow64DirectoryA
push edi
mov dword [0x40c6c0], eax
call esi
push str.GetSystemWindowsDirectoryA
push edi
mov dword [0x40c668], eax
call esi
push str.GlobalMemoryStatusEx
push edi
mov dword [0x40c660], eax
call esi
push str.IsWow64Process
push edi
mov dword [0x40c6b8], eax
call esi
push str.GetProcessHandleCount
push edi
mov dword [0x40c678], eax
call esi
push str.ProcessIdToSessionId
push edi
mov dword [0x40c674], eax
call esi
push str.GetNativeSystemInfo
push edi
mov dword [0x40c670], eax
call esi
push 0x4096a0
push edi
mov dword [0x40c66c], eax
call esi
mov dword [0x40c664], eax
cmp dword [0x40c6d8], 0
je 0x4084c0
cmp dword [0x40c6d4], 0
je 0x4084c0
cmp dword [0x40c6d0], 0
je 0x4084c0
cmp dword [0x40c6cc], 0
je 0x4084c0
cmp dword [0x40c6c8], 0
je 0x4084c0
cmp dword [0x40c6c4], 0
je 0x4084c0
cmp dword [0x40c6c0], 0
jne 0x408506
mov dword [0x40c6d8], 0
mov dword [0x40c6d4], 0
mov dword [0x40c6d0], 0
mov dword [0x40c6cc], 0
mov dword [0x40c6c8], 0
mov dword [0x40c6c4], 0
mov dword [0x40c6c0], 0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.DBGHELP.DLL
call edi
mov dword [0x40c684], eax
test eax, eax
je 0x4085f3
push str.SymCleanup
push eax
call esi
push str.SymEnumSymbols
push dword [0x40c684]
mov dword [0x40c6b4], eax
call esi
push str.SymSetOptions
push dword [0x40c684]
mov dword [0x40c6b0], eax
call esi
push str.SymInitialize
push dword [0x40c684]
mov dword [0x40c6ac], eax
call esi
push str.SymSetContext
push dword [0x40c684]
mov dword [0x40c6a8], eax
call esi
push str.SymGetLineFromAddr64
push dword [0x40c684]
mov dword [0x40c6a4], eax
call esi
push str.SymFromAddr
push dword [0x40c684]
mov dword [0x40c6a0], eax
call esi
push str.StackWalk64
push dword [0x40c684]
mov dword [0x40c69c], eax
call esi
push str.SymFunctionTableAccess64
push dword [0x40c684]
mov dword [0x40c698], eax
call esi
push str.SymGetModuleBase64
push dword [0x40c684]
mov dword [0x40c694], eax
call esi
push str.SymGetTypeInfo
push dword [0x40c684]
mov dword [0x40c690], eax
call esi
push str.MiniDumpWriteDump
push dword [0x40c684]
mov dword [0x40c68c], eax
call esi
mov dword [0x40c640], eax
cmp dword [0x40c6b4], 0
je 0x408656
cmp dword [0x40c6b0], 0
je 0x408656
cmp dword [0x40c6ac], 0
je 0x408656
cmp dword [0x40c6a8], 0
je 0x408656
cmp dword [0x40c6a4], 0
je 0x408656
cmp dword [0x40c6a0], 0
je 0x408656
cmp dword [0x40c69c], 0
je 0x408656
cmp dword [0x40c698], 0
je 0x408656
cmp dword [0x40c694], 0
je 0x408656
cmp dword [0x40c690], 0
je 0x408656
cmp dword [0x40c68c], 0
jne 0x40865b
call fcn.00408240
push str.USER32.DLL
call ebx
test eax, eax
je 0x408675
push str.GetGuiResources
push eax
call esi
mov dword [0x40c688], eax
jmp 0x40867f
mov dword [0x40c688], 0
push str.PSAPI.DLL
call edi
mov dword [0x40c680], eax
test eax, eax
je 0x4086ae
push str.GetProcessMemoryInfo
push eax
call esi
push str.GetPerformanceInfo
push dword [0x40c680]
mov dword [0x40c67c], eax
call esi
mov dword [0x40c64c], eax
push str.Wtsapi32.dll
call edi
mov dword [0x40c65c], eax
test eax, eax
je 0x4086ef
push str.WTSGetActiveConsoleSessionId
push eax
call esi
push str.WTSFreeMemory
push dword [0x40c65c]
mov dword [0x40c658], eax
call esi
push str.WTSQuerySessionInformationA
push dword [0x40c65c]
mov dword [0x40c650], eax
call esi
mov dword [0x40c654], eax
push str.ADVAPI32.DLL
call edi
mov dword [0x40c648], eax
test eax, eax
je 0x40870c
push str.GetCurrentHwProfileA
push eax
call esi
mov dword [0x40c644], eax
push str.XCPTHLR
mov byte [esp + 0x54], 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x50]
push 0x104
push ecx
push eax
call esi
cmp byte [esp + 0x50], 0
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
jne 0x40874b
xor ecx, ecx
jmp 0x40875b
lea ecx, [esp + 0x50]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x408752
sub ecx, edx
push ecx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
call fcn.00401540
sub esp, 8
mov dword [esp + 0x67c], 0
lea eax, [esp + 0x14]
mov byte [esp + 0x14], 0x5c
lea ecx, [esp + 0x28]
push eax
call fcn.004022a0
push eax
push ecx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
call fcn.004021d0
push eax
lea ecx, [esp + 0x24]
call fcn.00402b40
cmp dword [esp + 0x4c], 0x10
mov edi, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
jb 0x4087bb
push dword [esp + 0x38]
call edi
add esp, 4
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
push eax
push 0x104
push 0x40de50
call dword [sym.imp.MSVCR120.dll_strcpy_s]
mov ecx, 0x40de50
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4087e5
sub ecx, edx
cmp byte [ecx + 0x40de4f], 0x5c
jne 0x4087fd
mov byte [ecx + 0x40de4f], al
push 0x104
lea eax, [esp + 0x15c]
mov byte [esp + 0x15c], 0
push eax
push 0
call esi
push 0x100
lea eax, [esp + 0x364]
push eax
push 0x100
lea eax, [esp + 0x46c]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x174]
push 0
push eax
call dword [sym.imp.MSVCR120.dll__splitpath_s]
lea eax, [esp + 0x384]
push eax
lea eax, [esp + 0x488]
push eax
push 0
push 0
lea eax, [esp + 0x594]
push 0x104
push eax
call dword [sym.imp.MSVCR120.dll__makepath_s]
push str.SOFTWAREKWMUSIC
lea eax, [esp + 0x2a0]
push 0x100
push eax
call dword [sym.imp.MSVCR120.dll_sprintf_s]
add esp, 0x48
mov dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
lea eax, [esp + 0x26c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40894f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.Exception_Flags
push dword [esp + 0x24]
call esi
mov ecx, dword [0x40c034]
test eax, eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
cmove ecx, dword [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x20]
mov dword [0x40c034], ecx
push eax
push 0
push str.Exception_LogFile
push dword [esp + 0x24]
call esi
test eax, eax
jne 0x408945
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x104
push eax
push 0x40dd48
lea eax, [esp + 0x20]
push eax
push 0
push str.Exception_LogFile
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x407c70
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 1
mov dword [0x40c6dc], eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [esp + 0x34], 0x10
jb 0x408977
push dword [esp + 0x20]
call edi
add esp, 4
mov ecx, dword [esp + 0x66c]
mov eax, 0x40df58
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret