Function at 0x404e80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
push edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
xor edi, edi
push eax
push edi
push str.Timeout
push ebx
mov dword [ebp - 0x10], edi
call esi
mov edx, eax
test edx, edx
jne 0x404ecb
mov eax, dword [ebp - 0xc]
lea ecx, [eax - 3]
cmp ecx, 0x39
ja 0x404ed0
mov dword [0x42e890], eax
jmp 0x404ee5
cmp edx, 2
je 0x404ee5
movzx eax, dx
or eax, 0x80070000
test edx, edx
cmovle eax, edx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.LogLevel
push ebx
call esi
cmp eax, 2
je 0x404f20
test eax, eax
je 0x404f20
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x405169
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
push 3
pop ecx
cmp eax, ecx
cmova eax, ecx
cmp dword [edi], 0
mov dword [ebp - 0x10], eax
je 0x404f59
test eax, eax
jne 0x404f4f
xor esi, esi
inc esi
push esi
call main
push esi
push esi
call main
and dword [edi], 0
jmp 0x404f85
push 1
push eax
call main
jmp 0x404f8b
test eax, eax
je 0x404f8b
xor esi, esi
inc esi
push esi
push eax
call main
push esi
push 0
push 0x425b20
push 0x425898
push 0
call main
test eax, eax
js 0x405169
mov dword [edi], esi
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 8]
xor edi, edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.CDBufferRead
push ebx
call esi
mov ecx, eax
test ecx, ecx
jne 0x404fbc
cmp dword [ebp + 8], eax
setne al
mov dword [0x42e894], eax
jmp 0x404fd6
cmp ecx, 2
je 0x404fd6
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.CDBufferSize
push ebx
call esi
mov ecx, eax
test ecx, ecx
jne 0x405006
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40500b
mov dword [0x42e898], eax
jmp 0x405020
cmp ecx, 2
je 0x405020
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.NetworkBufferRead
push ebx
call esi
mov ecx, eax
test ecx, ecx
jne 0x40504f
cmp dword [ebp + 8], eax
setne al
mov dword [0x42e89c], eax
jmp 0x405069
cmp ecx, 2
je 0x405069
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.NetworkBufferSize
push ebx
call esi
mov ecx, eax
test ecx, ecx
jne 0x405099
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40509e
mov dword [0x42e8a0], eax
jmp 0x4050b3
cmp ecx, 2
je 0x4050b3
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.InternetBufferRead
push ebx
call esi
mov ecx, eax
test ecx, ecx
jne 0x4050e2
cmp dword [ebp + 8], eax
setne al
mov dword [0x42e8a4], eax
jmp 0x4050f8
cmp ecx, 2
je 0x4050f8
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.InternetBufferSize
push ebx
call esi
mov ecx, eax
test ecx, ecx
jne 0x405128
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40512d
mov dword [0x42e8a8], eax
jmp 0x40513e
cmp ecx, 2
je 0x40513e
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x405169
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.BufferWrite
push ebx
call esi
test eax, eax
jne 0x405169
cmp dword [ebp + 8], eax
setne al
mov dword [0x42e8ac], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8