Function at 0x408d70
Capabilities:
Create thread
Link many functions at runtime
Load windows common language runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xeb4
mov eax, dword [0x455008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x210]
mov bl, cl
push 0
push eax
mov edi, edx
mov byte [ebp - 0xe95], bl
call fcn.00417b90
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.00417b90
add esp, 0x18
test bl, bl
jne 0x408e32
cmp dword [0x456654], 0
jne 0x409052
push 0x4476a8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x456654], eax
test eax, eax
je 0x409052
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4476c0
push eax
call esi
push 0x4476d4
push dword [0x456654]
mov dword [0x45665c], eax
call esi
push 0x4476ec
push dword [0x456654]
mov dword [0x456640], eax
call esi
mov dword [0x456644], eax
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0xeac], 0x104
jmp 0x40906e
cmp dword [0x456660], 0
jne 0x409052
push 0x800
lea eax, [ebp - 0xe20]
push 0
push eax
call fcn.00417b90
add esp, 0xc
mov dword [ebp - 0xe9c], 0
lea eax, [ebp - 0xea4]
mov dword [ebp - 0xea0], 0x400
push eax
push 0x20019
push 0
push 0x447710
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x408ef8
lea eax, [ebp - 0xea0]
push eax
lea eax, [ebp - 0xe20]
push eax
lea eax, [ebp - 0xe9c]
push eax
push 0
push 0x447754
push dword [ebp - 0xea4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408eec
mov eax, dword [ebp - 0xea0]
test eax, eax
je 0x408eec
add eax, eax
cmp eax, 0x800
jae 0x409b47
xor ecx, ecx
mov word [ebp + eax - 0xe20], cx
lea eax, [ebp - 0xe20]
push eax
call esi
mov dword [0x456660], eax
push dword [ebp - 0xea4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x456660]
test eax, eax
jne 0x408feb
lea eax, [ebp - 0xea4]
push eax
push 0x20019
push 0
push 0x447778
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408fd2
lea eax, [ebp - 0xea0]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xe9c]
push eax
push 0
push 0x4477e8
push dword [ebp - 0xea4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408fc6
cmp dword [ebp - 0xea0], eax
jbe 0x408fc6
push 0x208
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.00417b90
push 0x4477f8
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.0041fa9e
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.0041fb02
push 0x447864
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.0041fb02
add esp, 0x30
lea eax, [ebp - 0x620]
push eax
call esi
mov dword [0x456660], eax
push dword [ebp - 0xea4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x456660]
test eax, eax
jne 0x408feb
push 0x447880
call esi
mov dword [0x456660], eax
test eax, eax
je 0x409052
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x447898
push eax
call esi
push 0x4478a8
push dword [0x456660]
mov dword [0x45663c], eax
call esi
push 0x4478bc
push dword [0x456660]
mov dword [0x45664c], eax
call esi
push 0x4476ec
push dword [0x456660]
mov dword [0x456648], eax
call esi
mov dword [0x456650], eax
mov esi, 0x80004002
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0xeac], 0x104
jmp 0x409450
mov dword [ebp - 0xe84], 0
mov dword [ebp - 0xeac], 0x104
test bl, bl
jne 0x40935a
mov eax, dword [0x45665c]
test eax, eax
je 0x40935a
lea ecx, [ebp - 0xea8]
mov dword [ebp - 0xea8], 0
push ecx
push 0x4472d0
push 0x4472e0
call eax
lea ebx, [edi + 0x79a]
test eax, eax
jne 0x409334
lea esi, [eax + 5]
nop dword [eax]
mov eax, dword [ebp - 0xea8]
lea edx, [ebp - 0xe90]
push edx
push dword [0x4558d4]
mov dword [ebp - 0xe90], 0
mov ecx, dword [eax]
push eax
mov dword [ebp - 0xe88], ebx
call dword [ecx + 0x18]
test eax, eax
jne 0x40930b
mov dword [ebp - 0xe94], eax
lea edx, [ebp - 0xeb0]
mov dword [ebp - 0xeb0], eax
mov eax, dword [ebp - 0xe90]
push edx
lea edx, [ebp - 0xe94]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x4091b4
mov cl, byte [edi + 0x79a]
lea ebx, [edi + 0x79a]
cmp eax, 1
jne 0x409175
test cl, cl
je 0x40913e
push dword [ebp - 0xe94]
push eax
push 0x447b18
push 0
push 0
call fcn.00414dd0
add esp, 0x14
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xe90]
dec esi
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jg 0x4090b0
mov ebx, dword [ebp - 0xe88]
mov eax, dword [ebp - 0xea8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40934b
test cl, cl
je 0x409191
push dword [ebp - 0xe94]
push eax
push 0x447b88
push 0
push 0
call fcn.00414dd0
add esp, 0x14
mov eax, dword [ebp - 0xe90]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0xea8]
mov ebx, dword [ebp - 0xe88]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40934b
mov ecx, dword [ebp - 0xe94]
test ecx, ecx
je 0x4092d5
lea edx, [ebp - 0xe88]
mov dword [ebp - 0xe88], 0
mov eax, dword [ecx]
push edx
push 0x4472f0
push ecx
call dword [eax]
test eax, eax
jne 0x409294
mov eax, dword [ebp - 0xe88]
lea edx, [ebp - 0xeac]
push edx
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x409244
mov eax, dword [ebp - 0xe88]
lea edx, [ebp - 0xe84]
push edx
push 0x4384b0
push 0x4472c0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x40925f
cmp byte [edi + 0x79a], 0
je 0x40925f
cmp eax, 0x80131704
jne 0x40923c
push eax
push 0x4478e0
jmp 0x409253
push eax
push 0x447988
jmp 0x409253
cmp byte [edi + 0x79a], 0
je 0x40925f
push eax
push 0x4479e0
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe88]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xe94]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xe90]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0xea8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40934b
cmp byte [edi + 0x79a], 0
je 0x4092af
push eax
push 0x447a40
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe94]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xe90]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0xea8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40934b
cmp byte [edi + 0x79a], 0
je 0x4092f1
push 0
push 0x447ab0
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe90]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 0xea8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40934b
cmp byte [ebx], 0
je 0x409164
push eax
push 0x447be8
push 0
push 0
call fcn.00414dd0
mov eax, dword [ebp - 0xea8]
add esp, 0x10
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40934b
cmp byte [ebx], 0
je 0x40934b
push eax
push 0x447c50
push 0
push 0
call fcn.00414dd0
add esp, 0x10
cmp dword [ebp - 0xe84], 0
jne 0x4095fe
jmp 0x40936d
mov esi, 0x80004002
test bl, bl
jne 0x40944b
lea ebx, [edi + 0x79a]
mov eax, dword [0x456640]
test eax, eax
je 0x409416
cmp dword [0x456644], 0
je 0x409416
lea ecx, [ebp - 0xeac]
push ecx
push 0x104
lea ecx, [ebp - 0x418]
push ecx
push dword [0x4558d4]
call eax
mov esi, eax
test esi, esi
jne 0x4093e1
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0x418]
push eax
push 3
call dword [0x456644]
mov esi, eax
test esi, esi
je 0x409431
cmp byte [edi + 0x79a], 0
je 0x409431
push esi
push 0x447cb8
push 0
push 0
call fcn.00414dd0
add esp, 0x10
jmp 0x409431
cmp byte [ebx], 0
je 0x409431
cmp esi, 0x80070057
jne 0x409402
push esi
push 0x447d18
push 0
push 0
call fcn.00414dd0
add esp, 0x10
jmp 0x409431
push esi
push 0x447da0
push 0
push 0
call fcn.00414dd0
add esp, 0x10
jmp 0x409431
cmp byte [ebx], 0
je 0x40942c
push 0x447de4
push 0
push 0
call fcn.00414dd0
add esp, 0xc
mov esi, 0x80004002
cmp byte [ebp - 0xe95], 0
je 0x4095f1
cmp dword [ebp - 0xe84], 0
jne 0x4095fe
mov eax, dword [0x456650]
mov ecx, dword [0x45663c]
test ecx, ecx
je 0x409b34
cmp dword [0x45664c], 0
je 0x409b34
cmp dword [0x456648], 0
je 0x409b34
test eax, eax
je 0x409b34
lea eax, [ebp - 0xe88]
mov dword [ebp - 0xe94], 0
push eax
lea eax, [ebp - 0xe90]
mov dword [ebp - 0xe90], 0
push eax
lea eax, [ebp - 0xe94]
mov dword [ebp - 0xe88], 0
push eax
push dword [0x456670]
call ecx
mov esi, eax
test esi, esi
jne 0x4095f1
cmp dword [ebp - 0xe88], eax
jbe 0x4095d9
mov dword [ebp - 0xeb0], eax
lea eax, [ebp - 0xeb0]
push eax
push 0x104
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0xe90]
push dword [eax]
push dword [0x456670]
call dword [0x456648]
mov esi, eax
test esi, esi
jne 0x4095d9
lea eax, [ebp - 0xe84]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [0x456650]
mov esi, eax
test esi, esi
jne 0x409595
mov dword [ebp - 0xea0], eax
mov dword [ebp - 0xea8], 0x104
cmp word [ebp - 0x210], ax
jne 0x4095d9
lea eax, [ebp - 0xe9c]
push eax
push 0x20019
push esi
push 0x447778
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4095d9
lea eax, [ebp - 0xea8]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0xea0]
push eax
push esi
push 0x4477e8
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xe9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4095d9
cmp esi, 0x80131c3c
jne 0x4095ae
cmp byte [edi + 0x79a], 0
je 0x4095d9
push esi
push 0x447e20
jmp 0x4095cd
cmp byte [edi + 0x79a], 0
je 0x4095d9
cmp esi, 0x8013134b
jne 0x4095c7
push esi
push 0x447ed8
jmp 0x4095cd
push esi
push 0x447f88
push 0
push 0
call fcn.00414dd0
add esp, 0x10
push dword [ebp - 0xe88]
push dword [ebp - 0xe90]
push dword [ebp - 0xe94]
call dword [0x45664c]
cmp dword [ebp - 0xe84], 0
je 0x409b34
mov eax, dword [ebp - 0xe84]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x409b0d
push 0x14
mov byte [ebp - 0xe89], 1
call fcn.00416174
add esp, 4
mov esi, eax
mov dword [ebp - 0xe9c], esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov dword [esi], vtable.CCorDebugManagedCallback2.1.0
mov dword [esi + 4], vtable.CCorDebugManagedCallback2.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], 1
mov dword [esi + 0x10], 0
call ebx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0xe84]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jne 0x409ac1
push 0x30
call fcn.00416174
mov esi, eax
add esp, 4
mov dword [ebp - 0xe94], esi
lea eax, [esi + 0x10]
mov dword [esi], vtable.CCorDebugUnmanagedCallback.0
push eax
mov dword [esi + 8], 1
mov dword [esi + 4], edi
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
mov dword [esi + 0x28], eax
call ebx
push 0
push 0
push esi
push 0x405980
push 0
push 0
mov dword [esi + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0xe84]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
test esi, esi
jne 0x409a8a
mov dword [ebp - 0xe90], eax
lea edx, [ebp - 0xe90]
mov eax, dword [ebp - 0xe84]
push edx
push esi
push dword [0x456670]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
cmp byte [edi + 0x5c], 0
mov esi, eax
je 0x409752
cmp esi, 0x8013132e
je 0x409725
cmp esi, 0x80070057
jne 0x409752
push dword [0x456670]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov eax, dword [ebp - 0xe84]
lea edx, [ebp - 0xe90]
push edx
push 0
mov byte [edi + 0x5c], 0
push dword [0x456670]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
test esi, esi
jne 0x409a21
mov eax, dword [ebp - 0xe94]
mov ebx, dword [ebp - 0xe90]
add eax, 0x10
push eax
mov byte [edi + 0x5d], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0xe94]
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x409790
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0xe94]
mov dword [eax + 0xc], esi
test ebx, ebx
je 0x40979d
mov dword [eax + 0xc], ebx
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
mov eax, dword [ebp - 0xe94]
add eax, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [ebp - 0xe95], 0
lea eax, [ebp - 0x210]
lea edx, [ebp - 0x418]
mov ecx, 0x447ff8
jne 0x4097cc
mov ecx, 0x448028
cmp word [ebp - 0x210], 0
cmove eax, edx
push eax
push ecx
push 0
push 0
call fcn.00414dd0
add esp, 0x10
cmp byte [edi + 0x5c], 0
jne 0x4097ff
push dword [0x456670]
call dword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
je 0x4097ff
mov byte [edi + 0x5c], 1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop word [eax + eax]
mov eax, dword [edi + 0x18]
cmp eax, dword [edi + 0x14c]
jge 0x40992d
cmp byte [0x456678], 0
jne 0x40992d
push 0
push dword [0x4558d4]
call ebx
test eax, eax
je 0x409926
push 0
push dword [0x457eb8]
call ebx
cmp eax, 0x102
jne 0x40992d
mov eax, dword [edi + 0x18]
cmp eax, dword [edi + 0x14c]
jge 0x40992d
cmp byte [0x456678], 0
jne 0x40992d
push 0
push dword [0x4558d4]
call ebx
test eax, eax
je 0x409926
cmp byte [edi + 0x5c], 0
je 0x4098d0
push 0xc8
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
test eax, eax
je 0x4098c4
mov edx, edi
lea ecx, [ebp - 0xe80]
call fcn.00406690
add esp, 4
push eax
push dword [ebp - 0xe78]
push dword [ebp - 0xe7c]
call dword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x4098d0
xor edx, edx
xor ecx, ecx
call fcn.00406690
add esp, 4
xor ecx, ecx
mov eax, 0xc8
cmp byte [edi + 0x5c], cl
cmovne eax, ecx
push eax
mov eax, dword [ebp - 0xe9c]
push dword [eax + 0x10]
call ebx
test eax, eax
je 0x409913
cmp eax, 0x102
je 0x409810
push dword [0x457eb8]
mov dword [0x456674], 0xfffffff6
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x409810
mov byte [0x456678], 1
mov byte [ebp - 0xe89], 0
jmp 0x409810
mov byte [0x456678], 1
cmp byte [ebp - 0xe89], 0
je 0x409a10
mov eax, dword [ebp - 0xe90]
lea edx, [ebp - 0xe88]
push edx
mov dword [ebp - 0xe88], 0
push 0x446704
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jne 0x4099f5
lea ebx, [edi + 0x88]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0xe88]
push 0xffffffffffffffff
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x4099b7
mov eax, dword [ebp - 0xe88]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
je 0x4099d1
cmp byte [edi + 0x79a], 0
je 0x4099d1
cmp esi, 0x80131302
jne 0x4099b0
push 0x448050
jmp 0x4099c5
push 0x4480e8
jmp 0x4099c5
cmp byte [edi + 0x79a], 0
je 0x4099d1
push 0x448138
push 0
push 0
call fcn.00414dd0
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0xe88]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xe90]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x409aa5
cmp byte [edi + 0x79a], 0
je 0x409a10
push esi
push 0x448188
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe90]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x409aa5
mov al, byte [edi + 0x79a]
cmp esi, 0x8013134b
jne 0x409a5e
test al, al
je 0x409a45
push esi
push 0x448210
push 0
push 0
call fcn.00414dd0
add esp, 0x10
push 0x44514c
mov edx, 0x4482a8
mov ecx, 0x8013134b
call fcn.0040a300
add esp, 4
jmp 0x409aa5
test al, al
je 0x409a74
push esi
push 0x4482f0
push 0
push 0
call fcn.00414dd0
add esp, 0x10
push 0x44514c
mov edx, 0x448344
mov ecx, esi
call fcn.0040a300
add esp, 4
jmp 0x409aa5
cmp byte [edi + 0x79a], 0
je 0x409aa5
push esi
push 0x448360
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe84]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0xe94]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x409adc
cmp byte [edi + 0x79a], 0
je 0x409adc
push esi
push 0x4483b8
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe84]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov ecx, dword [ebp - 0xe9c]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
cmp byte [ebp - 0xe89], 0
jne 0x409b28
mov eax, dword [ebp - 0xe84]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
jmp 0x409b28
cmp byte [edi + 0x79a], 0
je 0x409b28
push esi
push 0x448410
push 0
push 0
call fcn.00414dd0
add esp, 0x10
mov eax, dword [ebp - 0xe84]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415f69
mov esp, ebp
pop ebp
ret
call fcn.00416099
int3