Function at 0x407f94
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2062c
call fcn.004666e0
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
push 0x400
mov dword [0x491fb8], ebx
mov dword [0x491fbc], eax
mov dword [0x491fc0], ebx
mov dword [0x491fc4], ebx
mov dword [0x491fc8], ebx
mov dword [0x491fcc], ebx
mov dword [0x491fd0], 0x475b14
mov dword [0x491fd4], ebx
mov dword [0x491fd8], ebx
mov dword [0x491fdc], ebx
mov dword [0x491fe0], 0x475b14
mov dword [0x491fe4], ebx
mov dword [0x491fe8], ebx
mov dword [0x491fec], ebx
mov dword [0x491ff4], ebx
mov dword [0x491ffc], ebx
mov dword [0x492000], 0x66
call fcn.00455667
pop ecx
mov dword [0x491ff0], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00457a9e
push esi
lea eax, [ebp - 0x424]
push str.Include
push eax
call fcn.00457aea
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00457b2e
mov edi, 0x20a
push edi
call fcn.00455667
mov ecx, dword [0x491ff0]
mov edx, dword [0x491ff4]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x491ff4]
mov eax, dword [0x491ff0]
mov eax, dword [eax + ecx*4]
inc dword [0x491ff4]
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004555f7
add esp, 0x40
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408208
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2062c]
push eax
push ebx
push ebx
push str.Include
push dword [ebp - 8]
mov dword [ebp + 8], 0x1fffe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4081ff
shr dword [ebp + 8], 1
mov eax, dword [ebp + 8]
add eax, eax
xor ecx, ecx
mov word [ebp + eax - 0x2062c], cx
mov word [ebp + eax - 0x2062a], cx
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2062c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
xor ecx, ecx
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], cx
cmp ax, bx
je 0x40816f
cmp eax, 0x3b
je 0x40816f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004555c6
pop ecx
pop ecx
jmp 0x4081f6
lea eax, [ebp - 0x218]
push eax
call fcn.00455251
pop ecx
test eax, eax
je 0x4081ab
lea eax, [ebp - 0x218]
push eax
call fcn.00455251
cmp word [ebp + eax*2 - 0x21a], 0x5c
pop ecx
je 0x4081ab
lea eax, [ebp - 0x218]
push 0x46e4b0
push eax
call fcn.004555c6
pop ecx
pop ecx
push edi
call fcn.00455667
mov ecx, dword [0x491ff0]
mov edx, dword [0x491ff4]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x491ff4]
mov eax, dword [0x491ff0]
mov eax, dword [eax + ecx*4]
inc dword [0x491ff4]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.0045704a
xor eax, eax
mov word [ebp - 0x218], ax
mov eax, dword [ebp - 4]
add esp, 0x10
cmp word [eax], bx
je 0x4081ff
add dword [ebp - 4], 2
jmp 0x40813e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x491fb8
pop ebx
leave
ret 4