Function at 0x4078e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e45f
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x44f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xa60], esi
mov dword [ebp - 0xa5c], esi
mov dword [ebp - 0xa68], esi
mov dword [ebp - 0xa64], 0
mov eax, dword fs:[0x2c]
mov dword [esi], 0
mov ebx, dword [eax]
mov eax, dword [0x454830]
cmp eax, dword [ebx + 4]
jle 0x407974
push 0x454830
call fcn.004099be
add esp, 4
cmp dword [0x454830], 0xffffffff
jne 0x407974
push 0x454830
mov dword [0x454850], 0
call fcn.00409974
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0xa55], 0
movlpd qword [ebp - 0xa18], xmm0
lea eax, [ebp - 0xa18]
mov dword [ebp - 4], 1
push eax
call fcn.00424f12
mov dword [ebp - 4], 2
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0xa55]
mov dword [ebp - 0xa1c], eax
lea eax, [ebp - 0xa20]
push eax
push 0x408c60
push 0x454850
call fcn.00425493
add esp, 0x10
test eax, eax
je 0x408058
lea eax, [ebp - 0xa18]
mov dword [ebp - 4], 3
push eax
call fcn.00424f4c
add esp, 4
mov byte [ebp - 4], 0
mov ecx, esi
push 0x4534c0
call fcn.00403470
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 0xa64], 1
push 0
push eax
call fcn.0040bd80
xorps xmm0, xmm0
mov dword [ebp - 0xa40], 0
movq qword [ebp - 0xa48], xmm0
add esp, 0xc
mov dword [ebp - 0xa48], 0
mov dword [ebp - 0xa44], 0
mov dword [ebp - 0xa40], 0
mov dword [ebp - 4], 6
mov eax, dword [0x454834]
cmp eax, dword [ebx + 4]
jle 0x407a93
push 0x454834
call fcn.004099be
add esp, 4
cmp dword [0x454834], 0xffffffff
jne 0x407a93
push 0x454834
mov dword [0x454860], 0
call fcn.00409974
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0xa55], 0
movlpd qword [ebp - 0xa18], xmm0
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 7
push eax
call fcn.00424f12
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0xa55]
mov dword [ebp - 0xa1c], eax
lea eax, [ebp - 0xa20]
push eax
push 0x408d20
push 0x454860
call fcn.00425493
add esp, 0x10
test eax, eax
je 0x40803f
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 9
push eax
call fcn.00424f4c
push 0x453e9c
push ecx
lea ecx, [ebp - 0xa48]
call fcn.00406090
test eax, eax
jne 0x407c28
mov eax, dword [0x4548a0]
cmp eax, dword [ebx + 4]
jle 0x407b51
push 0x4548a0
call fcn.004099be
add esp, 4
cmp dword [0x4548a0], 0xffffffff
jne 0x407b51
push 0x4548a0
mov dword [0x454868], 0
call fcn.00409974
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0xa55], 0
movlpd qword [ebp - 0xa20], xmm0
lea eax, [ebp - 0xa20]
mov byte [ebp - 4], 0xc
push eax
call fcn.00424f12
lea eax, [ebp - 0xa20]
mov dword [ebp - 0xa18], eax
lea eax, [ebp - 0xa55]
mov dword [ebp - 0xa14], eax
lea eax, [ebp - 0xa18]
push eax
push 0x408e00
push 0x454868
call fcn.00425493
add esp, 0x10
test eax, eax
je 0x407d80
lea eax, [ebp - 0xa20]
mov byte [ebp - 4], 0xe
push eax
call fcn.00424f4c
add esp, 4
mov dword [ebp - 0xa54], 0x800
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xa24]
push eax
push 0
push 0x452c98
push dword [ebp - 0xa48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x407c28
mov eax, dword [ebp - 0xa24]
cmp eax, 1
je 0x407c05
cmp eax, 2
jne 0x407c28
mov eax, dword [ebp - 0xa54]
test eax, eax
je 0x407d29
test al, 1
jne 0x407c28
shr eax, 1
cmp word [ebp + eax*2 - 0xa12], 0
je 0x407d32
mov eax, dword [0x454890]
cmp eax, dword [ebx + 4]
jle 0x407c62
push 0x454890
call fcn.004099be
add esp, 4
cmp dword [0x454890], 0xffffffff
jne 0x407c62
push 0x454890
mov dword [0x454888], 0
call fcn.00409974
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0xa55], 0
movlpd qword [ebp - 0xa18], xmm0
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x11
push eax
call fcn.00424f12
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0xa55]
mov dword [ebp - 0xa1c], eax
lea eax, [ebp - 0xa20]
push eax
push 0x408eb0
push 0x454888
call fcn.00425493
add esp, 0x10
test eax, eax
je 0x408026
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x13
push eax
call fcn.00424f4c
add esp, 4
mov byte [ebp - 4], 6
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x452b68
call edi
mov esi, eax
lea eax, [ebp - 0x210]
push eax
call edi
cmp eax, esi
je 0x407da4
mov eax, dword [ebp - 0xa48]
test eax, eax
je 0x407d05
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xa60]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00409555
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp - 0xa10], ax
lea ecx, [ebp - 0x210]
mov edx, 0xff
lea esi, [ebp - 0xa10]
mov eax, ecx
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffeff]
test eax, eax
je 0x407d6e
movzx eax, word [ecx + esi]
test ax, ax
je 0x407d6e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x407d50
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
jmp 0x407c28
lea eax, [ebp - 0xa20]
mov byte [ebp - 4], 0xf
push eax
call fcn.00424f6d
add esp, 4
mov byte [ebp - 4], 0xd
test al, al
je 0x408087
jmp 0x408071
mov eax, dword [0x454878]
mov dword [ebp - 0xa3c], 0
mov dword [ebp - 0xa38], 0
mov dword [ebp - 0xa34], 0
mov dword [ebp - 0xa30], 0
mov dword [ebp - 0xa2c], 0
mov dword [ebp - 0xa28], 0
cmp eax, dword [ebx + 4]
jle 0x407e1a
push 0x454878
call fcn.004099be
add esp, 4
cmp dword [0x454878], 0xffffffff
jne 0x407e1a
push 0x454878
mov dword [0x454870], 0
call fcn.00409974
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0xa55], 0
movlpd qword [ebp - 0xa18], xmm0
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x16
push eax
call fcn.00424f12
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0xa55]
mov dword [ebp - 0xa1c], eax
lea eax, [ebp - 0xa20]
push eax
push 0x408f80
push 0x454870
call fcn.00425493
add esp, 0x10
test eax, eax
je 0x40800d
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x18
push eax
call fcn.00424f4c
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0x210]
push 0x453e34
push eax
call fcn.00406020
mov eax, dword [ebp - 0xa30]
add esp, 0x24
mov esi, dword [ebp - 0xa28]
mov edi, dword [ebp - 0xa2c]
mov dword [ebp - 0xa24], eax
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0xa1c], eax
mov eax, dword [ebp - 0xa3c]
mov dword [ebp - 0xa5c], eax
mov eax, dword [0x45485c]
cmp eax, dword [ebx + 4]
jle 0x407f39
push 0x45485c
call fcn.004099be
add esp, 4
cmp dword [0x45485c], 0xffffffff
jne 0x407f39
push 0x45485c
mov dword [0x454858], 0
call fcn.00409974
add esp, 4
xorps xmm0, xmm0
mov byte [ebp - 0xa55], 0
movlpd qword [ebp - 0xa18], xmm0
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x1b
push eax
call fcn.00424f12
lea eax, [ebp - 0xa18]
mov dword [ebp - 0xa50], eax
lea eax, [ebp - 0xa55]
mov dword [ebp - 0xa4c], eax
lea eax, [ebp - 0xa50]
push eax
push 0x409070
push 0x454858
call fcn.00425493
add esp, 0x10
test eax, eax
je 0x407fec
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x1d
push eax
call fcn.00424f4c
push esi
push edi
mov byte [ebp - 4], 6
push dword [ebp - 0xa24]
mov esi, dword [ebp - 0xa60]
push dword [ebp - 0xa54]
push dword [ebp - 0xa1c]
push dword [ebp - 0xa5c]
push 0x453f04
push esi
call fcn.00403aa0
mov eax, dword [ebp - 0xa48]
add esp, 0x24
test eax, eax
je 0x407d0b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407d0b
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x1e
push eax
call fcn.00424f6d
add esp, 4
mov byte [ebp - 4], 0x1c
test al, al
jne 0x40808c
jmp 0x408087
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x19
push eax
call fcn.00424f6d
add esp, 4
mov byte [ebp - 4], 0x17
jmp 0x408003
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0x14
push eax
call fcn.00424f6d
add esp, 4
mov byte [ebp - 4], 0x12
jmp 0x408003
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 0xa
push eax
call fcn.00424f6d
add esp, 4
mov byte [ebp - 4], 8
jmp 0x408003
lea eax, [ebp - 0xa18]
mov byte [ebp - 4], 4
push eax
call fcn.00424f6d
add esp, 4
mov byte [ebp - 4], 2
jmp 0x408003
sub esp, 8
lea eax, [ebp - 0xa20]
mov ecx, esp
push eax
call fcn.004020f0
call fcn.004021b0
call fcn.0042551c
sub esp, 8
lea eax, [ebp - 0xa18]
mov ecx, esp
push eax
call fcn.004020f0
call fcn.004021b0
int3