Function at 0x403ca9
Capabilities:
Enumerate process modules
Get graphical window text
Query or enumerate registry value
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x417cfc
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x13ec
call fcn.00414a40
mov eax, dword [0x41d2f0]
xor eax, esp
mov dword [esp + 0x13e8], eax
push ebx
push esi
push edi
mov eax, dword [0x41d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x1400]
mov dword fs:[0], eax
mov eax, dword [0x41ed70]
mov ebx, ecx
mov ecx, dword [ebx]
shl ecx, 4
lea esi, [ecx + eax + 8]
cmp byte [esi], 0
mov dword [esp + 0x38], ebx
jne 0x403d0e
mov al, 1
jmp 0x404e54
xor cl, cl
cmp byte [esi], cl
mov byte [esp + 0x16], cl
mov byte [esp + 0x1f], cl
jbe 0x404e18
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x419bf7
call fcn.00406ec3
movzx edi, byte [esp + 0x3b]
mov dword [esp + 0x7c], edi
imul edi, edi, 0x1c
xor esi, esi
mov dword [esp + 0x1424], esi
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
sub esp, 0x1c
add eax, edi
mov ecx, esp
mov dword [esp + 0x60], esp
push eax
mov dword [esp + 0x54], edi
call fcn.00406ee5
or dword [esp + 0x1440], 0xffffffff
lea ecx, [esp + 0x1270]
call fcn.00402300
mov dword [esp + 0x1408], 1
mov ecx, dword [ebx]
mov edx, dword [0x41ed70]
shl ecx, 4
mov ecx, dword [ecx + edx + 0xc]
push 0xffffffffffffffff
push esi
add ecx, edi
push eax
call fcn.004013b7
or dword [esp + 0x1408], 0xffffffff
push esi
push 1
lea ecx, [esp + 0x1240]
call fcn.00401469
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419da0
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x403e2e
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x1d0]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x403e0b
mov eax, dword [eax + 4]
jmp 0x403e0e
add eax, 4
push eax
call fcn.0040899e
cmp dword [0x41e154], eax
pop ecx
setne byte [esp + 0x17]
push 0
lea ecx, [esp + 0x1c8]
jmp 0x40493d
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419da4
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x403e82
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0xf0]
call fcn.00406f9e
call fcn.00402847
neg al
sbb al, al
inc al
mov byte [esp + 0x17], al
push 0
mov ecx, esi
jmp 0x40493d
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419da8
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x403ee3
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x198]
call fcn.00406f9e
mov ecx, eax
mov dword [esp + 0x1408], 2
call fcn.00403bc4
neg al
sbb al, al
inc al
mov byte [esp + 0x17], al
push 0
mov ecx, esi
jmp 0x404935
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419dac
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x403f37
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x128]
call fcn.00406f9e
call fcn.00402827
neg al
sbb al, al
inc al
mov byte [esp + 0x17], al
push 0
mov ecx, esi
jmp 0x40493d
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419dbc
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x403faa
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x208]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x403f7e
mov eax, dword [eax + 4]
jmp 0x403f81
add eax, 4
push 0x41ed80
push eax
call fcn.0040a7fc
pop ecx
pop ecx
push 0
push 1
lea ecx, [esp + 0x204]
call fcn.00401469
cmp dword [0x41ed94], 0
jmp 0x404949
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419dc0
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
push esi
je 0x4042b1
lea ecx, [esp + 0x1258]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1270], 0xf
call fcn.0040158f
push 3
pop eax
push eax
mov dword [esp + 0x140c], eax
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push str._to_
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
jne 0x404021
inc byte [esp + 0x16]
jmp 0x4042a4
mov eax, dword [esp + 0x28]
mov ecx, dword [0x41ed70]
add eax, 0xfffffffd
push eax
mov eax, dword [ebx]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 3
add eax, edi
push eax
lea esi, [esp + 0x1244]
call fcn.00406f9e
push 4
mov esi, 0x41a044
push esi
lea eax, [esp + 0x1240]
push eax
mov byte [esp + 0x1414], 4
call fcn.00406f79
cmp eax, 0xffffffff
mov dword [esp + 0x24], eax
je 0x404152
inc eax
push eax
mov dword [esp + 0x1c], eax
push esi
lea eax, [esp + 0x1240]
push eax
call fcn.00406f79
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
lea esi, [esp + 0x40]
jne 0x4040c0
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x1240]
push eax
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x4040b1
mov eax, dword [eax + 4]
jmp 0x4040b4
add eax, 4
push eax
call fcn.0040898d
mov dword [esp + 0x1c], eax
jmp 0x404132
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
dec eax
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x1240]
push eax
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x4040e6
mov eax, dword [eax + 4]
jmp 0x4040e9
add eax, 4
push eax
call fcn.0040898d
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
mov dword [esp + 0x20], eax
call fcn.00401469
mov eax, dword [esp + 0x2c]
push 0xffffffffffffffff
inc eax
push eax
lea eax, [esp + 0x1240]
push eax
lea esi, [esp + 0x4c]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x404125
mov eax, dword [eax + 4]
jmp 0x404128
add eax, 4
push eax
call fcn.0040898d
mov dword [esp + 0x24], eax
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.00401469
push 0xffffffffffffffff
push dword [esp + 0x28]
lea ecx, [esp + 0x1240]
call fcn.00401523
cmp dword [esp + 0x1250], 0x10
mov eax, dword [esp + 0x123c]
jae 0x40416a
lea eax, [esp + 0x123c]
push 0x41a048
push eax
lea eax, [esp + 0x44]
push eax
call fcn.0040af2e
add esp, 0xc
test eax, eax
je 0x40418a
inc byte [esp + 0x16]
jmp 0x404292
cmp dword [esp + 0x18], 0
jbe 0x404195
push 0
jmp 0x404197
push 2
push dword [esp + 0x1c]
push dword [esp + 0x44]
call fcn.004095ae
mov eax, dword [esp + 0x34]
mov ecx, dword [0x41ed70]
add esp, 0xc
add eax, 4
push 0xffffffffffffffff
push eax
mov eax, dword [ebx]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, edi
push eax
lea esi, [esp + 0x4c]
call fcn.00406f9e
push 0xffffffffffffffff
xor esi, esi
push esi
push eax
lea ecx, [esp + 0x1260]
mov byte [esp + 0x1414], 5
call fcn.004013b7
push esi
push 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x1410], 4
call fcn.00401469
cmp dword [esp + 0x20], esi
mov edi, dword [esp + 0x1268]
je 0x40420b
mov edi, dword [esp + 0x20]
lea esi, [edi + 1]
push esi
call fcn.00408316
pop ecx
push esi
push 0
push eax
mov dword [esp + 0x2c], eax
call fcn.0040b9c0
add esp, 0xc
push dword [esp + 0x3c]
push edi
push 1
push dword [esp + 0x2c]
call fcn.0040a114
push dword [esp + 0x4c]
call fcn.004098ad
mov eax, dword [esp + 0x126c]
add esp, 0x14
cmp dword [esp + 0x126c], 0x10
jae 0x404259
lea eax, [esp + 0x1258]
mov esi, dword [esp + 0x20]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x40427b
test cl, cl
je 0x404277
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x40427b
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x40425d
xor eax, eax
jmp 0x404280
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x404288
inc byte [esp + 0x16]
push dword [esp + 0x20]
call fcn.00409e37
pop ecx
push 0
push 1
lea ecx, [esp + 0x1240]
call fcn.00401469
xor esi, esi
push esi
lea ecx, [esp + 0x1258]
jmp 0x404740
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0x419ddc
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
push esi
je 0x4045f7
lea ecx, [esp + 0x1290]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x12a8], 0xf
call fcn.0040158f
mov dword [esp + 0x1408], 6
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 3
push str._to_
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
jne 0x404331
inc byte [esp + 0x16]
jmp 0x4045ea
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x41ed70]
add eax, 0xfffffffd
push eax
mov dword [esp + 0x34], eax
mov eax, dword [ebx]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 3
add eax, edi
push eax
lea esi, [esp + 0x1244]
call fcn.00406f9e
push 4
mov esi, 0x41a044
push esi
lea eax, [esp + 0x1240]
push eax
mov byte [esp + 0x1414], 7
call fcn.00406f79
cmp eax, 0xffffffff
mov dword [esp + 0x24], eax
je 0x404466
inc eax
push eax
mov dword [esp + 0x1c], eax
push esi
lea eax, [esp + 0x1240]
push eax
call fcn.00406f79
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
lea esi, [esp + 0x40]
jne 0x4043d4
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x1240]
push eax
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x4043c5
mov eax, dword [eax + 4]
jmp 0x4043c8
add eax, 4
push eax
call fcn.0040898d
mov dword [esp + 0x1c], eax
jmp 0x404446
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
dec eax
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x1240]
push eax
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x4043fa
mov eax, dword [eax + 4]
jmp 0x4043fd
add eax, 4
push eax
call fcn.0040898d
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
mov dword [esp + 0x20], eax
call fcn.00401469
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
inc eax
push eax
lea eax, [esp + 0x1240]
push eax
lea esi, [esp + 0x4c]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x404439
mov eax, dword [eax + 4]
jmp 0x40443c
add eax, 4
push eax
call fcn.0040898d
mov dword [esp + 0x24], eax
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.00401469
push 0xffffffffffffffff
push dword [esp + 0x28]
lea ecx, [esp + 0x1240]
call fcn.00401523
cmp dword [esp + 0x1250], 0x10
mov eax, dword [esp + 0x123c]
jae 0x40447e
lea eax, [esp + 0x123c]
push 0x41a048
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0040af2e
add esp, 0xc
test eax, eax
je 0x40449e
inc byte [esp + 0x16]
jmp 0x4045d8
cmp dword [esp + 0x18], 0
jbe 0x4044a9
push 0
jmp 0x4044ab
push 2
push dword [esp + 0x1c]
push dword [esp + 0x3c]
call fcn.004095ae
mov eax, dword [esp + 0x38]
mov ecx, dword [0x41ed70]
add esp, 0xc
add eax, 4
push 0xffffffffffffffff
push eax
mov eax, dword [ebx]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, edi
push eax
lea esi, [esp + 0x4c]
call fcn.00406f9e
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x1298]
mov byte [esp + 0x1414], 8
call fcn.004013b7
push 0
push 1
mov ecx, esi
mov byte [esp + 0x1410], 7
call fcn.00401469
mov eax, dword [ebx]
push dword [esp + 0x30]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 3
add eax, edi
push eax
lea esi, [esp + 0x7c]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x404538
mov eax, dword [eax + 4]
jmp 0x40453b
add eax, 4
push 0x41ed80
push eax
call fcn.0040a7fc
pop ecx
pop ecx
push 0
push 1
lea ecx, [esp + 0x78]
call fcn.00401469
mov eax, dword [0x41ed94]
test eax, eax
jne 0x404562
inc byte [esp + 0x16]
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x40456c
mov edi, eax
lea esi, [edi + 1]
push esi
call fcn.00408316
pop ecx
push esi
push 0
push eax
mov dword [esp + 0x2c], eax
call fcn.0040b9c0
add esp, 0xc
push dword [esp + 0x34]
push edi
push 1
push dword [esp + 0x2c]
call fcn.0040a114
push dword [esp + 0x44]
call fcn.004098ad
mov eax, dword [esp + 0x12a4]
add esp, 0x14
cmp dword [esp + 0x12a4], 0x10
jae 0x4045ba
lea eax, [esp + 0x1290]
push eax
push dword [esp + 0x24]
call fcn.0040a6a0
test eax, eax
pop ecx
pop ecx
jne 0x4045ce
inc byte [esp + 0x16]
push dword [esp + 0x20]
call fcn.00409e37
pop ecx
push 0
push 1
lea ecx, [esp + 0x1240]
call fcn.00401469
xor esi, esi
push esi
lea ecx, [esp + 0x1290]
jmp 0x404740
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0x419e04
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x404669
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0xd4]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x404645
mov eax, dword [eax + 4]
jmp 0x404648
add eax, 4
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
neg eax
sbb al, al
inc al
mov byte [esp + 0x17], al
push 0
lea ecx, [esp + 0xcc]
jmp 0x40493d
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419e24
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
push esi
je 0x404754
lea ecx, [esp + 0x12ac]
mov dword [esp + 0x12c4], 0xf
call fcn.0040158f
mov dword [esp + 0x1408], 9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x64
lea ecx, [esp + 0x12c8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x4046c9
inc byte [esp + 0x16]
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x7c]
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x4046f3
mov eax, dword [eax + 4]
jmp 0x4046f6
add eax, 4
mov esi, eax
lea eax, [esp + 0x12c4]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x40471d
test cl, cl
je 0x404719
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x40471d
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x4046ff
xor esi, esi
jmp 0x404722
sbb esi, esi
sbb esi, 0xffffffff
push 0
push 1
lea ecx, [esp + 0x78]
call fcn.00401469
test esi, esi
je 0x404737
inc byte [esp + 0x16]
lea ecx, [esp + 0x12a8]
push 0
or dword [esp + 0x140c], 0xffffffff
push 1
call fcn.00401469
jmp 0x404aab
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0x419e44
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x4047e2
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x144]
call fcn.00406f9e
mov edi, eax
lea esi, [esp + 0x100]
mov dword [esp + 0x1408], 0xa
call fcn.00402236
mov ecx, edi
mov byte [esp + 0x1408], 0xb
call fcn.004078c4
neg al
sbb al, al
push 0
inc al
push 1
mov ecx, esi
mov byte [esp + 0x1f], al
call fcn.00401469
push 0
lea ecx, [esp + 0x13c]
jmp 0x404935
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419ea8
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x404869
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x1b4]
call fcn.00406f9e
mov edi, eax
lea esi, [esp + 0x170]
mov dword [esp + 0x1408], 0xc
call fcn.0040229b
mov ecx, edi
mov byte [esp + 0x1408], 0xd
call fcn.004078c4
neg al
sbb al, al
push 0
inc al
push 1
mov ecx, esi
mov byte [esp + 0x1f], al
call fcn.00401469
push 0
lea ecx, [esp + 0x1ac]
jmp 0x404935
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x41a04c
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x404958
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 8
add eax, edi
push eax
lea esi, [esp + 0x224]
call fcn.00406f9e
mov dword [esp + 0x20], eax
mov dword [esp + 0x1408], 0xe
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push 0xffffffffffffffff
push 3
add eax, edi
push eax
lea esi, [esp + 0x1ec]
call fcn.00406f9e
mov ecx, dword [esp + 0x20]
mov byte [esp + 0x1408], 0xf
cmp dword [ecx + 0x18], 0x10
jb 0x4048f1
mov edx, dword [ecx + 4]
jmp 0x4048f8
mov edx, dword [esp + 0x20]
add edx, 4
lea ecx, [esp + 0x8c]
push ecx
push 0xf003f
xor esi, esi
push esi
push edx
mov ecx, eax
call fcn.00402c46
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
test eax, eax
push 1
lea ecx, [esp + 0x1e8]
setne byte [esp + 0x1f]
call fcn.00401469
push esi
lea ecx, [esp + 0x21c]
or dword [esp + 0x140c], 0xffffffff
push 1
call fcn.00401469
cmp byte [esp + 0x17], 0
je 0x404aab
inc byte [esp + 0x16]
jmp 0x404aab
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419ee4
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
mov ecx, dword [0x41ed70]
je 0x404ad1
lea eax, [esp + 0x68]
push eax
mov eax, dword [ebx]
push 0xf003f
push 0
sub esp, 0x1c
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x40]
mov esi, esp
mov dword [esp + 0x58], esp
push 0xffffffffffffffff
push 8
push eax
call fcn.00406f9e
lea edi, [esp + 0x68]
call fcn.00401b16
mov edi, eax
mov dword [esp + 0x1414], 0x10
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x24]
push 0xffffffffffffffff
push 3
push eax
lea esi, [esp + 0x88]
call fcn.00406f9e
mov byte [esp + 0x1414], 0x11
cmp dword [edi + 0x18], 0x10
jb 0x4049f5
mov edi, dword [edi + 4]
jmp 0x4049f8
add edi, 4
push edi
mov ecx, eax
call fcn.00402c46
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
setne byte [esp + 0x17]
xor esi, esi
push esi
push 1
lea ecx, [esp + 0x78]
call fcn.00401469
or dword [esp + 0x1408], 0xffffffff
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.00401469
cmp byte [esp + 0x17], 0
je 0x404a3b
inc byte [esp + 0x16]
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
push esi
push esi
push esi
push esi
sub esp, 0x1c
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x44]
mov esi, esp
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push 8
push eax
call fcn.00406f9e
lea ebx, [esp + 0xd8]
call fcn.00401b88
cmp dword [eax + 0x18], 0x10
jb 0x404a7c
mov eax, dword [eax + 4]
jmp 0x404a7f
add eax, 4
push eax
push dword [esp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
test eax, eax
push 1
lea ecx, [esp + 0xb4]
setne bl
call fcn.00401469
test bl, bl
je 0x404aa7
inc byte [esp + 0x16]
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebx]
mov eax, dword [0x41ed70]
shl ecx, 4
lea esi, [ecx + eax]
cmp byte [esi + 1], 0
je 0x404df7
movzx ecx, byte [esp + 0x16]
dec ecx
cmp ecx, dword [esp + 0x60]
jmp 0x404dfc
mov eax, dword [ebx]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419f18
add eax, edi
push eax
call fcn.00406f79
mov ecx, dword [0x41ed70]
cmp eax, 0xffffffff
mov eax, dword [ebx]
je 0x404ce9
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x18]
push 3
push str._to_
push eax
call fcn.00406f79
lea ecx, [esp + 0x64]
push ecx
mov ecx, dword [0x41ed70]
push 0xf003f
push 0
mov dword [esp + 0x34], eax
add eax, 0xfffffff8
sub esp, 0x1c
mov dword [esp + 0x58], eax
mov esi, esp
mov dword [esp + 0x54], esp
push eax
mov eax, dword [ebx]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x44]
push 8
push eax
call fcn.00406f9e
lea edi, [esp + 0x68]
call fcn.00401b16
mov edi, eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffffd
push eax
mov dword [esp + 0x1418], 0x12
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x28]
push 3
push eax
lea esi, [esp + 0x88]
call fcn.00406f9e
mov byte [esp + 0x1414], 0x13
cmp dword [edi + 0x18], 0x10
jb 0x404ba0
mov edi, dword [edi + 4]
jmp 0x404ba3
add edi, 4
push edi
mov ecx, eax
call fcn.00402c46
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
setne byte [esp + 0x17]
xor esi, esi
push esi
push 1
lea ecx, [esp + 0x78]
call fcn.00401469
or dword [esp + 0x1408], 0xffffffff
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.00401469
cmp byte [esp + 0x17], 0
je 0x404be6
inc byte [esp + 0x16]
mov ecx, dword [0x41ed70]
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x1330]
push eax
mov eax, dword [ebx]
push esi
push esi
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x58], esp
push dword [esp + 0x5c]
shl eax, 4
mov dword [esp + 0x8c], 0xc8
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x48]
push 8
push eax
call fcn.00406f9e
lea ebx, [esp + 0x1264]
call fcn.00401b88
cmp dword [eax + 0x18], 0x10
jb 0x404c3f
mov eax, dword [eax + 4]
jmp 0x404c42
add eax, 4
push eax
push dword [esp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
test eax, eax
push 1
lea ecx, [esp + 0x1240]
setne bl
call fcn.00401469
test bl, bl
je 0x404c6a
inc byte [esp + 0x16]
mov eax, dword [esp + 0x28]
mov ecx, dword [0x41ed70]
add eax, 4
push 0xffffffffffffffff
push eax
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x20]
lea esi, [esp + 0x98]
push eax
call fcn.00406f9e
cmp dword [eax + 0x18], 0x10
jb 0x404ca3
mov eax, dword [eax + 4]
jmp 0x404ca6
add eax, 4
mov ecx, eax
lea eax, [esp + 0x132c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x404ccd
test dl, dl
je 0x404cc9
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x404ccd
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x404caf
xor esi, esi
jmp 0x404cd2
sbb esi, esi
sbb esi, 0xffffffff
push 0
push 1
lea ecx, [esp + 0x98]
call fcn.00401469
test esi, esi
jmp 0x404aa1
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
push esi
push 0x419f54
add eax, edi
push eax
call fcn.00406f79
cmp eax, 0xffffffff
je 0x404aab
xor edi, edi
push edi
lea ecx, [esp + 0x1274]
mov dword [esp + 0x128c], 0xf
call fcn.0040158f
mov dword [esp + 0x1408], 0x14
mov eax, dword [ebx]
mov ecx, dword [0x41ed70]
shl eax, 4
mov eax, dword [eax + ecx + 0xc]
add eax, dword [esp + 0x18]
push 0xffffffffffffffff
push 3
push eax
lea esi, [esp + 0x160]
call fcn.00406f9e
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x127c]
mov byte [esp + 0x1414], 0x15
call fcn.004013b7
push edi
push 1
mov ecx, esi
mov byte [esp + 0x1410], 0x14
call fcn.00401469
lea eax, [esp + 0x6c]
push eax
push 0x1000
lea eax, [esp + 0x23c]
push eax
call sub.PSAPI.DLL_EnumProcesses
test eax, eax
jne 0x404d99
inc byte [esp + 0x16]
mov esi, dword [esp + 0x6c]
lea eax, [esp + 0x1270]
shr esi, 2
xor edi, edi
call fcn.00401c60
cmp dword [esp + 0x1288], 0x10
mov eax, dword [esp + 0x1274]
jae 0x404dc6
lea eax, [esp + 0x1274]
push eax
push dword [esp + edi*4 + 0x238]
call fcn.00401a38
test eax, eax
jne 0x404de4
cmp edi, esi
jae 0x404dde
inc edi
jmp 0x404dae
inc byte [esp + 0x16]
jmp 0x404deb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1270]
jmp 0x40473e
cmp byte [esp + 0x16], 0
je 0x404e03
cmp byte [esi], 0
je 0x404e37
inc byte [esp + 0x1f]
mov cl, byte [esp + 0x1f]
cmp cl, byte [esi + 8]
jb 0x403d20
mov cl, byte [esp + 0x16]
mov edx, dword [ebx]
shl edx, 4
add eax, edx
cmp byte [eax + 1], 0
je 0x404e3b
cmp byte [eax], 0
je 0x404e32
test cl, cl
jne 0x403d07
cmp cl, byte [eax + 8]
jmp 0x404e51
xor al, al
jmp 0x404e54
cmp byte [eax], 0
je 0x404e4f
movzx eax, byte [eax + 8]
movzx edx, cl
sub eax, edx
jne 0x403d07
test cl, cl
sete al
mov ecx, dword [esp + 0x1400]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x13e8]
xor ecx, esp
call fcn.00408623
mov esp, ebp
pop ebp
ret