Function at 0x409d2d
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4122dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push ebp
push esi
mov esi, ecx
push edi
push str.License.txt
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 1
call fcn.0040f070
xor ebx, ebx
push str.ShowEULA
lea ecx, [esp + 0x34]
mov dword [esp + 0x15c], ebx
call fcn.0040f070
lea eax, [esp + 0x10]
lea ebp, [esi + 0x514]
push eax
push 0x20019
push ebx
mov ecx, ebp
mov byte [esp + 0x164], 1
mov dword [esp + 0x1c], ebx
call fcn.0040f270
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409e99
xor ecx, ecx
lea edx, [esp + 0x1c]
mov dword [esp + 0x21], ecx
lea eax, [esp + 0x20]
mov word [esp + 0x25], cx
push edx
mov byte [esp + 0x2b], cl
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], bl
mov dword [esp + 0x2c], 7
mov dword [esp + 0x24], ebx
call fcn.0040f270
mov edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409e06
mov eax, dword [esp + 0x14]
cmp eax, 4
je 0x409dec
cmp eax, 3
jne 0x409e06
cmp dword [esp + 0x1c], 4
jne 0x409e06
mov eax, dword [esp + 0x20]
and eax, 0xff
mov dword [esp + 0x44], eax
jne 0x409e06
mov dword [esp + 0x18], ebx
push 0x416560
lea ecx, [esp + 0x3c]
call fcn.0040f070
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x48]
lea edx, [esp + 0x4c]
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0x44]
push edx
push eax
push ebx
lea ecx, [esp + 0x48]
mov byte [esp + 0x168], 2
mov dword [esp + 0x58], 0x104
mov dword [esp + 0x50], ebx
call fcn.0040f270
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409e73
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x28]
push edx
call fcn.0040f100
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x38]
mov byte [esp + 0x158], 1
call fcn.0040f030
cmp dword [esp + 0x18], ebx
je 0x40a0b7
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
mov ecx, ebp
call fcn.0040f270
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409f37
xor edx, edx
lea eax, [esp + 0x14]
mov dword [esp + 0x21], edx
lea ecx, [esp + 0x20]
mov word [esp + 0x25], dx
push eax
mov byte [esp + 0x2b], dl
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], bl
mov dword [esp + 0x24], 7
mov dword [esp + 0x2c], ebx
call fcn.0040f270
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409f2c
mov eax, dword [esp + 0x1c]
cmp eax, 4
je 0x409f11
cmp eax, 3
jne 0x409f2c
cmp dword [esp + 0x14], 4
jne 0x409f2c
mov ecx, dword [esp + 0x20]
and ecx, 0xff
mov dword [esp + 0x44], ecx
jne 0x409f2c
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], ebx
je 0x40a0b7
cmp dword [esi + 0x4b4], ebx
je 0x40a0b7
lea eax, [esp + 0x28]
lea ecx, [esi + 0x4bc]
push eax
lea edx, [esp + 0x3c]
push ecx
push edx
call fcn.0040a100
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x15c], 3
call fcn.0040f130
lea ecx, [esp + 0x38]
mov byte [esp + 0x158], 1
call fcn.0040f030
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
lea ecx, [esp + 0x40]
call fcn.0040f270
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x40a0ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x4b4]
lea ecx, [esp + 0x28]
mov edi, dword [eax]
call fcn.0040f270
mov ecx, dword [esi + 0x4b4]
push eax
call dword [edi + 0xc]
test eax, eax
je 0x40a0a3
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov word [esp + 0x15], cx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x14], bl
mov byte [esp + 0x17], cl
call fcn.0040d260
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
je 0x40a059
lea edx, [esp + 0x10]
push ebx
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
mov ecx, ebp
call fcn.0040f270
push eax
push 0x80000002
call edi
test eax, eax
jne 0x40a059
lea eax, [esp + 0x14]
push 4
push eax
push 4
push ebx
lea ecx, [esp + 0x40]
call fcn.0040f270
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40a04a
xor esi, esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x40a0bb
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
mov ecx, ebp
call fcn.0040f270
push eax
push 0x80000001
call edi
lea ecx, [esp + 0x14]
push 4
push ecx
push 4
push ebx
lea ecx, [esp + 0x40]
call fcn.0040f270
mov edx, dword [esp + 0x20]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a0bb
mov dword [esp + 0x18], 6
jmp 0x40a0bb
mov dword [esp + 0x18], 2
jmp 0x40a0bb
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x30]
mov byte [esp + 0x158], bl
call fcn.0040f030
lea ecx, [esp + 0x28]
mov dword [esp + 0x158], 0xffffffff
call fcn.0040f030
mov ecx, dword [esp + 0x150]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14c
ret