Function at 0x4036f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x4122b8]
push ebx
xor edx, edx
push esi
push edi
mov dword [esp + 0x234], eax
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x21]
mov byte [esp + 0x20], dl
rep stosd dword es:[edi], eax
mov byte [esp + 0x128], al
mov ecx, 0x41
lea edi, [esp + 0x129]
rep stosd dword es:[edi], eax
cmp dword [ebp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], edx
jne 0x403760
mov eax, 1
mov ecx, dword [esp + 0x234]
call fcn.00408681
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.MSVCR71.dll_strstr]
push 0x40a79c
push esi
call edi
add esp, 8
cmp eax, esi
jne 0x40377f
mov ebx, 0x80000000
jmp 0x4037d9
push 0x40a788
push esi
call edi
add esp, 8
cmp eax, esi
jne 0x403795
mov ebx, 0x80000005
jmp 0x4037d9
push 0x40a774
push esi
call edi
add esp, 8
cmp eax, esi
jne 0x4037ab
mov ebx, 0x80000001
jmp 0x4037d9
push 0x40a760
push esi
call edi
add esp, 8
cmp eax, esi
jne 0x4037c1
mov ebx, 0x80000002
jmp 0x4037d9
push 0x40a754
push esi
call edi
add esp, 8
cmp eax, esi
jne 0x403916
mov ebx, 0x80000003
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
add esp, 8
inc eax
lea edx, [esp + 0x20]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4037f0
mov edi, dword [sym.imp.MSVCR71.dll_strrchr]
lea eax, [esp + 0x20]
push 0x5c
push eax
call edi
push 0x5c
push esi
mov byte [eax], 0
call edi
add esp, 0x10
inc eax
lea edx, [esp + 0x128]
sub edx, eax
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403820
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x2c]
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40384d
mov esi, eax
jmp 0x40391b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x138]
push edx
mov edi, 1
push eax
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x403884
mov esi, eax
jmp 0x40391b
cmp dword [esp + 0x10], edi
je 0x403894
mov esi, 2
jmp 0x40391b
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4038a5
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor esi, esi
jmp 0x40391b
push eax
call sub.MFC71.DLL_operator_new_1
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esp + 0x1c], ebx
jne 0x4038bf
mov esi, 3
jmp 0x40391b
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x138]
push ecx
push edx
mov dword [esp + 0x28], edi
call esi
test eax, eax
je 0x4038e7
mov esi, eax
jmp 0x40391b
mov edx, dword [ebp + 0xc]
test edx, edx
mov esi, dword [esp + 0x18]
mov edi, dword [ebp + 0x10]
je 0x403910
cmp dword [edi], esi
jae 0x403902
mov dword [edi], esi
mov esi, 4
jmp 0x40391b
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403906
mov dword [edi], esi
xor esi, esi
jmp 0x40391b
mov esi, 1
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40392a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40393b
push eax
call sub.MFC71.DLL_operator_delete_1
add esp, 4
mov ecx, dword [esp + 0x234]
mov eax, esi
call fcn.00408681
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret