Function at 0x40d043
Capabilities:
Access the windows event log
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2e4]
sub esp, 0x364
mov eax, dword [0x414050]
push ebx
xor ebx, ebx
push esi
push edi
push 0x4058ac
push 0xa
mov dword [ebp + 0x2e0], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x6c], ebx
call fcn.0040eaa1
cmp dword [0x4140c4], ebx
pop ecx
pop ecx
mov byte [ebp + 0x1d4], bl
mov byte [ebp + 0x2dc], bl
mov byte [ebp + 0xcc], bl
je 0x40d133
push 0x405840
push 0xa
call fcn.0040eaa1
mov eax, dword [0x4140a8]
xor esi, esi
pop ecx
inc esi
cmp eax, ebx
pop ecx
je 0x40d120
push esi
push eax
push 5
push esi
push dword [0x414094]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov edi, eax
cmp edi, ebx
jne 0x40d0f2
push 0x4057f0
push 0xa
call fcn.0040eaa1
pop ecx
pop ecx
mov dword [0x4140b8], esi
jmp 0x40d120
push edi
push 0x405798
push 0x14
call fcn.0040eaa1
add esp, 0xc
push edi
push 0x400007d4
call fcn.0040e62a
push 0x405728
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
call fcn.0040bb06
push 0x4056d8
push 0xa
call fcn.0040eaa1
mov eax, esi
jmp 0x40e03e
mov esi, 0x4056a0
push esi
push 0x405678
push 0xa
call fcn.0040eaa1
xor edi, edi
add esp, 0xc
inc edi
cmp dword [0x4140c0], ebx
je 0x40d15e
cmp dword [0x414034], ebx
mov dword [ebp - 0x3c], edi
jne 0x40d161
mov dword [ebp - 0x3c], ebx
cmp dword [0x414094], ebx
jne 0x40d1a6
push 0x414094
push 0x2001b
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
je 0x40d1a6
push esi
push 0x405630
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0x800003e8
call fcn.0040e62a
jmp 0x40dff9
cmp dword [0x4140b4], ebx
jne 0x40d217
push 0x4055e0
push 0xa
call fcn.0040eaa1
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
mov dword [0x4140b4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [0x4140a8], eax
jne 0x40d208
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x405588
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0x800007d3
call fcn.0040e62a
push 0x405520
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
jmp 0x40d217
push eax
push 0x4054d8
push ebx
call fcn.0040eaa1
add esp, 0xc
mov eax, dword [0x4140a8]
cmp eax, ebx
je 0x40d27b
push edi
push eax
push 5
push edi
push dword [0x414094]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, eax
cmp esi, ebx
jne 0x40d24d
push 0x4057f0
push 0xa
call fcn.0040eaa1
pop ecx
pop ecx
mov dword [0x4140b8], edi
jmp 0x40d27b
push esi
push 0x405798
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0x400007d4
call fcn.0040e62a
push 0x405728
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
call fcn.0040bb06
or dword [0x41403c], 0xffffffff
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xd0]
push eax
mov dword [ebp - 0x40], ebx
mov edi, 0x104
mov dword [0x414040], 0x270f
push ebx
jmp 0x40d733
cmp esi, ebx
jne 0x40d78f
lea eax, [ebp + 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d2c6
sub eax, edx
push eax
lea eax, [ebp + 0xd0]
push eax
push 0x405498
push ebx
call fcn.0040eaa1
mov eax, dword [ebp - 0x50]
add esp, 0x10
dec eax
je 0x40d619
sub eax, 3
je 0x40d319
lea eax, [ebp + 0xd0]
push eax
push 0x40545c
push ebx
call fcn.0040eaa1
push 0x405410
push ebx
call fcn.0040eaa1
add esp, 0x14
jmp 0x40d712
push 0x4053d8
push ebx
call fcn.0040eaa1
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
lea eax, [ebp + 0xd0]
push 0x4053cc
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x40d363
push 0x405394
push ebx
call fcn.0040eaa1
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414044], eax
mov dword [ebp - 0x5c], 1
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x405388
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d3a0
push 0x405348
push ebx
call fcn.0040eaa1
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x74], eax
sete cl
mov dword [0x414030], ecx
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x40533c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d3d8
push 0x4052fc
push ebx
call fcn.0040eaa1
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414090], eax
mov dword [ebp - 0x78], 1
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x4052f0
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d415
push 0x4052a0
push ebx
call fcn.0040eaa1
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x80], eax
sete cl
mov dword [0x4140ac], ecx
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x405288
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d452
push 0x405228
push ebx
call fcn.0040eaa1
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x6c], eax
sete cl
mov dword [0x414034], ecx
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x402de4
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d48f
push 0x4051c8
push ebx
call fcn.0040eaa1
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x7c], eax
sete cl
mov dword [0x4140c0], ecx
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x4051b8
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d4c7
push 0x405158
push ebx
call fcn.0040eaa1
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414078], eax
mov dword [ebp - 0x60], 1
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x405148
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d4ff
push 0x4050e8
push ebx
call fcn.0040eaa1
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414068], eax
mov dword [ebp - 0x4c], 1
jmp 0x40d712
cmp dword [0x414038], ebx
je 0x40d538
lea eax, [ebp + 0xd0]
push 0x4050d4
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d538
push 0x405088
push ebx
call fcn.0040eaa1
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x4142e0], eax
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x405074
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d596
push 0x405018
push ebx
call fcn.0040eaa1
mov esi, dword [ebp + 0x1d8]
push esi
push 0x404fc8
push ebx
call fcn.0040eaa1
add esp, 0x14
cmp esi, ebx
je 0x40d589
cmp esi, 0x418937
ja 0x40d589
imul esi, esi, 0x3e8
mov dword [0x41403c], esi
jmp 0x40d712
push dword [0x41403c]
push 0x404f80
jmp 0x40d5e8
lea eax, [ebp + 0xd0]
push 0x404f68
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d5f6
push 0x404f20
push ebx
call fcn.0040eaa1
mov esi, dword [ebp + 0x1d8]
push esi
push 0x404ec8
push ebx
call fcn.0040eaa1
add esp, 0x14
cmp esi, 0x7fffffff
ja 0x40d5dd
mov dword [0x414040], esi
jmp 0x40d712
push dword [0x414040]
push 0x404e80
push ebx
call fcn.0040eaa1
add esp, 0xc
jmp 0x40d712
lea eax, [ebp + 0xd0]
push eax
push 0x40545c
push ebx
call fcn.0040eaa1
lea eax, [ebp + 0x1d8]
push eax
push 0x404e40
jmp 0x40d709
push 0x404e08
push ebx
call fcn.0040eaa1
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
lea eax, [ebp + 0xd0]
push 0x404df4
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x40d66c
push 0x404db4
push ebx
call fcn.0040eaa1
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x4140c8
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [ebp - 0x70], 1
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x404da4
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d6ad
push 0x404d68
push ebx
call fcn.0040eaa1
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x4142f8
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [0x414508], 1
jmp 0x40d712
lea eax, [ebp + 0xd0]
push 0x404d58
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40d6eb
push 0x404d1c
push ebx
call fcn.0040eaa1
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x4141d0
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [ebp - 0x68], 1
jmp 0x40d712
lea eax, [ebp + 0xd0]
push eax
push 0x40545c
push ebx
call fcn.0040eaa1
lea eax, [ebp + 0x1d8]
push eax
push 0x404cdc
push ebx
call fcn.0040eaa1
add esp, 0x18
inc dword [ebp - 0x40]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x40]
push dword [0x414094]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x54], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
cmp esi, 0x103
jne 0x40d2b5
cmp dword [0x4140b8], ebx
jne 0x40d760
call fcn.0040bb68
push 0x404c90
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x70], ebx
pop ecx
pop ecx
jne 0x40d7c5
push 0x404c40
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc00003fa
call fcn.0040e5bb
jmp 0x40dff9
push dword [ebp - 0x40]
push esi
push 0x404be0
push 0x14
call fcn.0040eaa1
add esp, 0x10
push dword [ebp - 0x40]
push esi
push 0xc00003f8
call fcn.0040e710
mov dword [0x4140b8], ebx
call fcn.0040bb06
call fcn.0040bb68
jmp 0x40dff9
push 0x404b98
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x68], ebx
pop ecx
pop ecx
jne 0x40d7ec
push 0x404b48
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc00003fb
jmp 0x40d785
push 0x404b00
push ebx
call fcn.0040eaa1
cmp dword [0x414508], ebx
pop ecx
pop ecx
push 0x4142f8
jne 0x40d80d
push 0x404aa0
jmp 0x40d812
push 0x404a50
push ebx
call fcn.0040eaa1
add esp, 0xc
push 0x404a08
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x5c], ebx
pop ecx
pop ecx
push dword [0x414044]
jne 0x40d83a
push 0x4049a8
jmp 0x40d83f
push 0x404958
push ebx
call fcn.0040eaa1
add esp, 0xc
push 0x404910
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x78], ebx
pop ecx
pop ecx
jne 0x40d873
mov esi, 0x1000
push esi
push 0x4048b0
push ebx
call fcn.0040eaa1
mov dword [0x414090], esi
jmp 0x40d884
push dword [0x414090]
push 0x404860
push ebx
call fcn.0040eaa1
add esp, 0xc
mov esi, 0x404820
push esi
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x80], ebx
pop ecx
pop ecx
push dword [0x4140ac]
jne 0x40d8a7
push 0x4047c8
jmp 0x40d8ac
push 0x404780
push ebx
call fcn.0040eaa1
add esp, 0xc
push esi
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x74], ebx
pop ecx
pop ecx
push dword [0x414030]
jne 0x40d8d0
push 0x404720
jmp 0x40d8d5
push 0x4046d0
push ebx
call fcn.0040eaa1
add esp, 0xc
push 0x404678
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x6c], ebx
pop ecx
pop ecx
jne 0x40d909
push 0x404618
push ebx
call fcn.0040eaa1
pop ecx
pop ecx
mov dword [0x414034], 1
jmp 0x40d91d
push dword [0x414034]
push 0x4045c8
push ebx
call fcn.0040eaa1
add esp, 0xc
push 0x404578
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x7c], ebx
pop ecx
pop ecx
jne 0x40d944
push 0x404520
push ebx
call fcn.0040eaa1
pop ecx
pop ecx
mov dword [0x4140c0], ebx
jmp 0x40d958
push dword [0x4140c0]
push 0x4044d0
push ebx
call fcn.0040eaa1
add esp, 0xc
push 0x404480
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x60], ebx
pop ecx
pop ecx
jne 0x40d986
mov esi, 0x1f4
push esi
push 0x404420
push ebx
call fcn.0040eaa1
add esp, 0xc
mov dword [0x414078], esi
jmp 0x40d9c3
push dword [0x414078]
push 0x4043d0
push ebx
call fcn.0040eaa1
add esp, 0xc
push 2
pop esi
cmp dword [0x414078], esi
jae 0x40d9c3
push 0x404370
push ebx
call fcn.0040eaa1
pop ecx
pop ecx
push esi
push 0x800003f2
mov dword [0x414078], esi
call fcn.0040e62a
push 0x404320
push ebx
call fcn.0040eaa1
cmp dword [ebp - 0x4c], ebx
pop ecx
pop ecx
jne 0x40d9f1
mov esi, 0x12c
push esi
push 0x4042c0
push ebx
call fcn.0040eaa1
add esp, 0xc
mov dword [0x414068], esi
jmp 0x40da2e
push dword [0x414068]
push 0x404270
push ebx
call fcn.0040eaa1
xor esi, esi
inc esi
add esp, 0xc
cmp dword [0x414068], esi
jae 0x40da2e
push 0x404218
push ebx
call fcn.0040eaa1
pop ecx
pop ecx
push esi
push 0x800003f4
mov dword [0x414068], esi
call fcn.0040e62a
cmp dword [0x414034], ebx
je 0x40da3e
cmp dword [0x4140c0], ebx
jne 0x40da93
cmp dword [ebp - 0x3c], ebx
je 0x40dab0
push 0x4041c0
push 0xa
call fcn.0040eaa1
pop ecx
pop ecx
push 0x40000bc8
call fcn.0040e5bb
cmp dword [0x4140bc], ebx
je 0x40da83
xor esi, esi
cmp dword [0x414088], ebx
jbe 0x40da83
mov eax, dword [0x414080]
push dword [eax + esi*4]
call fcn.0040bcd2
inc esi
cmp esi, dword [0x414088]
jb 0x40da6d
cmp dword [0x414034], ebx
je 0x40dab0
cmp dword [0x4140c0], ebx
je 0x40dab0
cmp dword [ebp - 0x3c], ebx
jne 0x40dab0
push 0x404160
push 0xa
call fcn.0040eaa1
pop ecx
pop ecx
push 0x40000bc9
call fcn.0040e5bb
push 0x4140c8
push 0x404128
push ebx
call fcn.0040eaa1
push 0x4141d0
push 0x4040f8
push ebx
call fcn.0040eaa1
push dword [0x4140ac]
push 0x4040b0
push ebx
call fcn.0040eaa1
push dword [0x414030]
push 0x404058
push ebx
call fcn.0040eaa1
add esp, 0x30
cmp dword [0x4140bc], ebx
je 0x40db1c
push 0x404010
push ebx
call fcn.0040eaa1
push 0x403fc8
push 0xa
call fcn.0040eaa1
add esp, 0x10
jmp 0x40df16
mov esi, 0x403f9c
push esi
push 0x405678
push 0xa
mov dword [0x4140bc], 1
call fcn.0040eaa1
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 9
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
je 0x40db6f
push esi
push 0x403f58
push 0x14
call fcn.0040eaa1
add esp, 0xc
push esi
push 0xc00003e9
jmp 0x40d19c
mov esi, 0x105
push esi
lea eax, [ebp + 0x1d8]
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], esi
push ebx
jmp 0x40de9b
cmp dword [ebp - 0x3c], ebx
jne 0x40df1e
call fcn.0040cf7b
lea eax, [ebp + 0x1d8]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
cmp eax, ebx
mov dword [ebp - 0x3c], eax
jne 0x40dbf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x403f1c
push 0x14
mov dword [ebp - 0x4c], eax
call fcn.0040eaa1
lea eax, [ebp + 0x1d8]
push eax
push 0x403eec
push 0x14
call fcn.0040eaa1
add esp, 0x18
push dword [ebp - 0x4c]
lea eax, [ebp + 0x1d8]
push eax
push 0x80000bbf
call fcn.0040e844
jmp 0x40de8e
push dword [ebp - 0x3c]
call fcn.0040bcd2
test eax, eax
je 0x40df51
mov eax, dword [0x414088]
lea eax, [eax*4 + 4]
push eax
push dword [0x414080]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x40df87
push eax
push 0x403eac
push ebx
mov dword [0x414080], eax
call fcn.0040eaa1
mov eax, dword [0x414088]
mov ecx, dword [0x414080]
mov edx, dword [ebp - 0x3c]
mov dword [ecx + eax*4], edx
mov eax, dword [0x41408c]
add esp, 0xc
add eax, 0x105
push eax
push dword [0x41407c]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x40df9c
push eax
push 0x403e68
push ebx
mov dword [0x41407c], eax
call fcn.0040eaa1
add dword [0x41408c], esi
mov eax, dword [0x41407c]
mov ecx, dword [0x41408c]
mov byte [eax + ecx - 1], bl
push edi
lea eax, [ebp + 0x1d8]
push eax
mov eax, dword [0x414088]
imul eax, eax, 0x105
add eax, dword [0x41407c]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
mov eax, dword [0x414088]
add esp, 0x18
lea eax, [eax*4 + 4]
push eax
push dword [0x414084]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x40dfb6
push eax
push 0x403e18
push ebx
mov dword [0x414084], eax
call fcn.0040eaa1
push edi
lea eax, [ebp - 0x38]
push 0x403f9c
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
lea eax, [ebp - 0x38]
add esp, 0x18
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dcf6
sub eax, esi
lea ecx, [ebp + 0x1d8]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40dd0a
sub ecx, eax
lea eax, [ecx + esi + 1]
cmp eax, edi
ja 0x40dfcb
lea eax, [ebp + 0x1d8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dd27
lea edi, [ebp - 0x38]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40dd34
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x38]
push eax
and ecx, 3
push 0x403dd0
push 0xa
rep movsb byte es:[edi], byte [esi]
call fcn.0040eaa1
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x40dffd
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x403dc0
push dword [ebp - 0x58]
mov dword [ebp - 0x48], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40dddb
push eax
mov eax, dword [0x414088]
imul eax, eax, 0x105
add eax, dword [0x41407c]
push eax
push 0x403d60
push 0x14
call fcn.0040eaa1
add esp, 0x10
mov eax, dword [0x414088]
mov ecx, dword [0x414084]
mov dword [ecx + eax*4], ebx
jmp 0x40de1d
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp - 0x58]
mov dword [ebp - 0x64], 1
call fcn.0040ec15
cmp eax, ebx
je 0x40de0b
push eax
push 0x403d10
push 0x14
call fcn.0040eaa1
add esp, 0xc
jmp 0x40ddcb
mov eax, dword [ebp - 0x60]
mov ecx, dword [0x414088]
mov edx, dword [0x414084]
mov dword [edx + ecx*4], eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x414088]
imul eax, eax, 0x105
add eax, dword [0x41407c]
push eax
push 0x403cdc
push ebx
call fcn.0040eaa1
push dword [ebp - 0x3c]
push dword [0x414088]
push 0x403ca8
push ebx
call fcn.0040eaa1
mov eax, dword [0x414088]
mov ecx, dword [0x414084]
push dword [ecx + eax*4]
push eax
push 0x403c68
push ebx
call fcn.0040eaa1
add esp, 0x2c
inc dword [0x414088]
inc dword [ebp - 0x40]
mov dword [ebp - 0x48], 0x105
mov edi, 0x104
mov esi, 0x105
push dword [ebp - 0x48]
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
mov dword [ebp - 0x3c], eax
jne 0x40db88
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x414088]
push 0x403c28
push ebx
call fcn.0040eaa1
add esp, 0xc
xor edi, edi
cmp dword [0x414088], ebx
jbe 0x40df10
mov dword [ebp - 0x3c], ebx
mov eax, dword [0x41407c]
mov ecx, dword [ebp - 0x3c]
add eax, ecx
push eax
mov eax, dword [0x414080]
push dword [eax + edi*4]
push edi
push 0x403bf8
push ebx
call fcn.0040eaa1
add dword [ebp - 0x3c], esi
add esp, 0x14
inc edi
cmp edi, dword [0x414088]
jb 0x40dedc
cmp dword [0x414088], ebx
je 0x40e030
xor eax, eax
inc eax
jmp 0x40e040
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0x403b98
push 0x14
call fcn.0040eaa1
add esp, 0x10
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0xc00003f9
call fcn.0040e710
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dff9
push 0x403b48
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0x80000bb9
call fcn.0040e5bb
push 0xc00007e3
call fcn.0040e5bb
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x40dff9
push 0x403b08
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc0000bc2
jmp 0x40df6e
push 0x403ac4
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc0000bc4
call fcn.0040e5bb
jmp 0x40dfea
push 0x403a78
push 0x14
call fcn.0040eaa1
pop ecx
pop ecx
push 0xc0000bc5
jmp 0x40dfaf
lea eax, [ebp - 0x38]
push eax
push 0x403a40
push 0x14
call fcn.0040eaa1
push 0x4039f8
push 0xa
call fcn.0040eaa1
add esp, 0x14
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [0x414088]
xor eax, eax
jmp 0x40e040
push esi
lea eax, [ebp - 0x38]
push eax
push 0x403990
push 0x14
call fcn.0040eaa1
add esp, 0x10
push esi
lea eax, [ebp - 0x38]
push eax
push 0x80001393
call fcn.0040e844
push 0x4039f8
push 0xa
call fcn.0040eaa1
pop ecx
pop ecx
jmp 0x40dfea
push 0x403940
push 0x14
call fcn.0040eaa1
xor eax, eax
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2e0]
pop edi
pop esi
pop ebx
call fcn.00412b09
add ebp, 0x2e4
leave
ret