Function at 0x40f216
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
push edi
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x114], 0
mov eax, dword [0x45aee4]
mov dword [ebp - 0xc8], eax
mov cx, word [0x45aee8]
mov word [ebp - 0xc4], cx
mov dl, byte [0x45aeea]
mov byte [ebp - 0xc2], dl
xor eax, eax
mov byte [ebp - 0xc1], al
mov ecx, dword [0x45aeec]
mov dword [ebp - 0x100], ecx
mov edx, dword [0x45aef0]
mov dword [ebp - 0xfc], edx
mov ax, word [0x45aef4]
mov word [ebp - 0xf8], ax
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0xf6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x45aef8]
mov dword [ebp - 0xb8], ecx
mov edx, dword [0x45aefc]
mov dword [ebp - 0xb4], edx
mov ax, word [0x45af00]
mov word [ebp - 0xb0], ax
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0xae]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [0x45af04]
mov dword [ebp - 0x84], ecx
mov edx, dword [0x45af08]
mov dword [ebp - 0x80], edx
mov eax, dword [0x45af0c]
mov dword [ebp - 0x7c], eax
mov ecx, dword [0x45af10]
mov dword [ebp - 0x78], ecx
mov dl, byte [0x45af14]
mov byte [ebp - 0x74], dl
xor eax, eax
mov dword [ebp - 0x73], eax
mov dword [ebp - 0x6f], eax
mov dword [ebp - 0x6b], eax
mov dword [ebp - 0x67], eax
mov dword [ebp - 0x63], eax
mov word [ebp - 0x5f], ax
mov byte [ebp - 0x5d], al
mov byte [ebp - 0x54], 0
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x104], 0
mov byte [ebp - 0x164], 0
mov ecx, 0x13
xor eax, eax
lea edi, [ebp - 0x163]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x28], 0
mov ecx, 9
xor eax, eax
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x110]
push ecx
push 3
push 0
push 0x45af18
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f3c5
jmp 0x40f714
mov dword [ebp - 0x108], 0x2a
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
lea edx, [ebp - 0xc8]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x40f413
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x100]
push ecx
call fcn.00422890
add esp, 8
lea edx, [ebp - 0x110]
push edx
push 3
push 0
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x5c]
sub eax, 1
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffff
je 0x40f6fd
mov dword [ebp - 0x58], 0x50
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x164]
push edx
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40f6e1
lea edx, [ebp - 0xcc]
push edx
push 3
push 0
lea eax, [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f4fc
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x104], 0x14
lea eax, [ebp - 0x104]
push eax
push 0x45ff78
lea ecx, [ebp - 0xbc]
push ecx
push 0
push 0x45af34
mov edx, dword [ebp - 0xcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x104], 0x14
mov eax, dword [ebp - 0x114]
push eax
push 0x45ff78
push 1
push 0
push 0x45af40
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x110]
push edx
push 3
push 0
push 0x45af4c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x114]
push eax
push 0x45ff78
push 1
push 0
push 0x45af68
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xcc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.MOT8888
lea ecx, [ebp - 0xb8]
push ecx
call fcn.00422890
add esp, 8
lea edx, [ebp - 0x110]
push edx
push 3
push 0
lea eax, [ebp - 0xb8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f5f0
jmp 0x40f712
mov dword [ebp - 0x58], 0x28
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x28]
push edx
push 0
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x40f62c
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f710
lea edx, [ebp - 0xcc]
push edx
push 3
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f65e
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f70e
mov dword [ebp - 0x108], 6
mov dword [ebp - 0x104], 0x14
mov eax, dword [ebp - 0x114]
push eax
push 0x45ff78
push 1
push 0
push 0x45af7c
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40f6d6
mov edx, dword [ebp - 0x114]
push edx
push 0x45ff78
push 1
push 0
push str.AttachedTo
mov eax, dword [ebp - 0xcc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xcc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f70c
mov eax, dword [ebp - 0x5c]
sub eax, 1
mov dword [ebp - 0x5c], eax
jmp 0x40f6f8
mov ecx, dword [ebp - 0x5c]
sub ecx, 1
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x10c], 0x103
jne 0x40f6f8
jmp 0x40f6fd
jmp 0x40f484
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f714
jmp 0x40f6d6
jmp 0x40f6d6
jmp 0x40f6d6
jmp 0x40f6d6
pop edi
mov esp, ebp
pop ebp
ret