Function at 0x440ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f5a0b
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x6b7e40]
xor eax, esp
mov dword [esp + 0x808], eax
push ebx
push esi
push edi
mov eax, dword [0x6b7e40]
xor eax, esp
push eax
lea eax, [esp + 0x820]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x20], ebx
cmp byte [0x6c1eec], 0
jne 0x440d01
push 0x6c1ed4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x6c1eec], 1
mov eax, dword [ebx]
test eax, eax
js 0x441279
cmp eax, 0x63
jg 0x441279
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.004423e0
mov esi, dword [esp + 0x18]
cmp esi, dword [0x6c2110]
jne 0x440e12
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
cmp dword [eax - 0xc], 0
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x1c]
jne 0x440dcc
call fcn.00404540
mov dword [esp + 0x828], 6
push dword [ebx + 4]
lea eax, [esp + 0x20]
push dword [ebx]
push str.SERVER_COOKIE__d_NOT_PRESENT_TO_DELETE__scripts:__d_
push eax
call fcn.00404520
add esp, 0xc
mov ecx, esp
push 0x63bfdc
call fcn.004021e0
push 0
lea eax, [esp + 0x24]
push eax
push pe_nt_image_headers32
push str.C:_amintegration_tools_setupishield_sldimdataServerCookieData.cpp
push 0
push 1
xor ecx, ecx
call fcn.004051a0
mov ecx, eax
call fcn.004022e0
mov dword [esp + 0x828], 0xffffffff
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x440f68
mov ecx, dword [edx]
push edx
jmp 0x440f63
call fcn.00404540
mov dword [esp + 0x828], 7
push dword [esi]
lea eax, [esp + 0x20]
push dword [ebx + 4]
push dword [ebx]
push str.ADDING_SERVER_COOKIE__d_for_scripts__d:__s
push eax
call fcn.00404520
add esp, 0x10
mov ecx, esp
push 0x63bfdc
call fcn.004021e0
push 0
lea eax, [esp + 0x24]
push eax
push 0x136
jmp 0x440d86
mov eax, dword [esi + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x1c]
sub eax, 0x10
push eax
call fcn.004046f0
lea edi, [eax + 0x10]
mov al, byte [esi + 0x20]
add esp, 4
mov dword [esp + 0x3c], edi
mov byte [esp + 0x40], al
lea eax, [ebx + 8]
mov dword [esp + 0x828], 8
mov dword [esp + 0x14], eax
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
cmp dword [eax - 0xc], 0
jne 0x440ec1
call fcn.00404540
push edi
mov byte [esp + 0x82c], 9
push dword [esp + 0x1c]
lea eax, [esp + 0x24]
push dword [ebx]
push str.DELETING_SERVER_COOKIE__d__scripts__d:__s_
push eax
call fcn.00404520
add esp, 0x10
mov ecx, esp
push 0x63bfdc
call fcn.004021e0
push 0
lea eax, [esp + 0x24]
push eax
push 0x145
push str.C:_amintegration_tools_setupishield_sldimdataServerCookieData.cpp
push 0
push 1
xor ecx, ecx
call fcn.004051a0
mov ecx, eax
call fcn.004022e0
push esi
lea eax, [esp + 0x28]
push eax
call fcn.00442150
jmp 0x440f1c
call fcn.00404540
mov byte [esp + 0x828], 0xa
push dword [ebx + 8]
lea eax, [esp + 0x20]
push edi
push dword [ebx + 4]
push dword [esp + 0x24]
push dword [ebx]
push str.REPLACING_SERVER_COOKIE__d__scripts__d___d_:___s___s_
push eax
call fcn.00404520
add esp, 0x18
mov ecx, esp
push 0x63bfdc
call fcn.004021e0
push 0
lea eax, [esp + 0x24]
push eax
push 0x152
push str.C:_amintegration_tools_setupishield_sldimdataServerCookieData.cpp
push 0
push 1
xor ecx, ecx
call fcn.004051a0
mov ecx, eax
call fcn.004022e0
mov byte [esp + 0x828], 8
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov eax, ebx
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x440f44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [esp + 0x828], 0xffffffff
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440f68
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x440f84
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x30], eax
mov edi, dword [esp + 0x20]
mov dword [esp + 0x828], 0xb
push dword [edi]
lea eax, [esp + 0x34]
push str.ServerCookie_
push str._s_d
push eax
call fcn.00404520
add esp, 0x10
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x440fd6
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
lea ecx, [edi + 8]
mov byte [esp + 0x828], 0xc
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x44102a
push edi
call fcn.00442020
mov edi, eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov dword [edi], ecx
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x14]
mov dword [edi + 4], ecx
lea ecx, [edi + 8]
push eax
call fcn.00404570
mov eax, dword [esp + 0x20]
mov cl, byte [eax + 0xc]
mov byte [edi + 0xc], cl
mov ecx, dword [esp + 0x14]
mov edi, eax
cmp byte [edi + 0xc], 0
je 0x4410ca
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
je 0x441244
lea ecx, [esp + 0x14]
call fcn.00404540
mov byte [esp + 0x828], 0xd
push dword [edi + 8]
lea eax, [esp + 0x18]
push dword [edi + 4]
push str._d__s
push eax
call fcn.00404520
add esp, 0x10
lea ecx, [esp + 0x18]
push str.SoftwareSolidWorksIM
call fcn.004021e0
push 1
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0x24]
mov ecx, SysReAllocStringLen
mov byte [esp + 0x834], 0xe
call fcn.00417640
mov byte [esp + 0x834], 0xd
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
add esp, 0xc
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44121f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x44121f
push str.SoftwareSolidWorksIM
lea ecx, [esp + 0x18]
call fcn.004021e0
mov byte [esp + 0x828], 0xf
xor eax, eax
mov word [esp + 0x44], ax
lea eax, [esp + 0x18]
push eax
push 0x20019
push 0
push dword [esp + 0x20]
mov dword [esp + 0x34], 0
push SysReAllocStringLen
mov dword [esp + 0x40], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x441179
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x40]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x441179
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441150
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x24]
call fcn.00402090
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x2b], 1
jmp 0x44117e
mov byte [esp + 0x2b], 0
mov byte [esp + 0x828], 0xc
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4411a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x2b], 0
je 0x441244
lea ecx, [esp + 0x14]
call fcn.00404540
mov eax, dword [esp + 0x20]
push esi
mov byte [esp + 0x82c], 0x10
push dword [eax]
lea eax, [esp + 0x1c]
push str.REMOVING_SERVER_COOKIE__d_FROM_REGISTRY:__s
push eax
call fcn.00404520
add esp, 0xc
mov ecx, esp
push 0x63bfdc
call fcn.004021e0
push 0
lea eax, [esp + 0x1c]
push eax
push 0x16f
push str.C:_amintegration_tools_setupishield_sldimdataServerCookieData.cpp
push 0
push 1
xor ecx, ecx
call fcn.004051a0
mov ecx, eax
call fcn.004022e0
push 1
push dword [esp + 0x34]
mov edx, str.SoftwareSolidWorksIM
mov ecx, SysReAllocStringLen
call fcn.00417ad0
add esp, 8
mov byte [esp + 0x828], 0xc
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441244
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [esp + 0x828], 0xb
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441265
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x828], 0xffffffff
mov edx, dword [esp + 0x30]
jmp 0x4415eb
cmp eax, 0x29a
jne 0x441513
mov eax, dword [ebx + 8]
lea edi, [ebx + 8]
cmp dword [eax - 0xc], 0
mov dword [esp + 0x18], edi
jne 0x441298
xor ebx, ebx
jmp 0x4412a7
push 0xa
push 0
push eax
call fcn.005bc96e
add esp, 0xc
mov ebx, eax
mov eax, dword [edi]
mov esi, 0x63
cmp dword [eax - 0xc], 0
mov dword [esp + 0x20], esi
jl 0x44138b
push 0x6473a8
push eax
call fcn.005bda07
mov edi, eax
add esp, 8
test edi, edi
je 0x44138b
mov eax, dword [esp + 0x18]
sub edi, dword [eax]
sar edi, 1
js 0x44138b
push edi
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.00404680
lea eax, [edi + 1]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x82c], 0
mov ecx, dword [esp + 0x1c]
push eax
call fcn.00404030
mov edi, dword [esp + 0x24]
cmp dword [edi - 0xc], 0
je 0x441325
push 0xa
push 0
push edi
call fcn.005bc96e
add esp, 0xc
mov ebx, eax
mov esi, dword [esp + 0x2c]
cmp dword [esi - 0xc], 0
je 0x441340
push 0xa
push 0
push esi
call fcn.005bc96e
add esp, 0xc
mov dword [esp + 0x20], eax
lea eax, [esi - 0x10]
or esi, 0xffffffff
mov dword [esp + 0x2c], eax
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x441363
mov ecx, dword [eax]
push dword [esp + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov dword [esp + 0x828], 0xffffffff
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441387
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x20]
mov eax, 0x63
test ebx, ebx
jns 0x441398
xor ebx, ebx
jmp 0x44139d
cmp ebx, eax
cmovg ebx, eax
cmp esi, ebx
cmovl esi, ebx
cmp esi, eax
cmovg esi, eax
mov dword [esp + 0x20], esi
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4413c7
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push ebx
lea eax, [esp + 0x1c]
push 0x647478
push eax
mov dword [esp + 0x838], 1
call fcn.00404520
add esp, 0x10
lea ecx, [esp + 0x18]
push 0x63bfdc
call fcn.004021e0
xor ecx, ecx
call fcn.004051a0
mov edi, eax
push ecx
mov byte [esp + 0x82c], 2
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
mov esi, esp
push ecx
call fcn.004046f0
add esp, 4
add eax, 0x10
push 0
push 0
mov dword [esi], eax
lea eax, [esp + 0x20]
push eax
push 0x10e
push str.C:_amintegration_tools_setupishield_sldimdataServerCookieData.cpp
push 1
push 1
mov ecx, edi
call fcn.004055a0
mov byte [esp + 0x828], 1
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
or esi, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441471
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esp + 0x20]
cmp ebx, edi
jg 0x4414f2
lea esp, [esp]
push 0x63bfdc
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x3c], SysReAllocStringLen
call fcn.004021e0
push 0
mov byte [esp + 0x82c], 3
push 0x63bfdc
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x48], 0
call fcn.00402090
lea ecx, [esp + 0x34]
call fcn.00440ca0
mov byte [esp + 0x828], 1
mov edx, dword [esp + 0x3c]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4414ed
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc ebx
cmp ebx, edi
jle 0x441480
mov dword [esp + 0x828], 0xffffffff
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jmp 0x4415f8
call fcn.004a4516
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x44152f
push 0x80004005
call fcn.00402040
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x828], 4
push dword [ebx + 8]
lea eax, [esp + 0x18]
push dword [ebx]
push str.WARNING:_Invalid_server_cookie_index__d___s
push eax
call fcn.00404520
add esp, 0x10
lea ecx, [esp + 0x18]
push 0x63bfdc
call fcn.004021e0
xor ecx, ecx
call fcn.004051a0
mov edi, eax
push ecx
mov byte [esp + 0x82c], 5
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
mov esi, esp
push ecx
call fcn.004046f0
add esp, 4
add eax, 0x10
push 0
push 0
mov dword [esi], eax
lea eax, [esp + 0x20]
push eax
push 0x120
push str.C:_amintegration_tools_setupishield_sldimdataServerCookieData.cpp
push 1
push 1
mov ecx, edi
call fcn.004055a0
mov byte [esp + 0x828], 4
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4415dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x828], 0xffffffff
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x441602
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x820]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.005bc16b
mov esp, ebp
pop ebp
ret