Function at 0x406741
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c4
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 1
call fcn.00407514
mov dword [ebp - 0x34], eax
push 0x400
lea eax, [ebp - 0x9c4]
push esi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x5c4]
push eax
call fcn.0040827c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x5c4]
push eax
push esi
push dword [ebp + 0xc]
call fcn.004086c9
add esp, 0x20
test eax, eax
je 0x4067c9
cmp dword [ebp + 0x14], esi
jne 0x4067c9
or esi, 0xffffffff
jmp 0x4069d6
push 0x11
lea eax, [ebp - 0x5c4]
pop edx
mov ecx, dword [eax + 4]
cmp ecx, esi
jne 0x406801
mov ecx, dword [eax]
cmp ecx, 1
jne 0x4067e4
mov edi, eax
jmp 0x40680e
cmp ecx, 2
jne 0x4067ed
mov ebx, eax
jmp 0x40680e
cmp ecx, 5
jne 0x4067f7
mov dword [ebp - 0x1c], eax
jmp 0x40680e
cmp ecx, 6
jne 0x40680e
mov dword [ebp - 4], eax
jmp 0x40680e
cmp ecx, 1
jne 0x40680e
cmp dword [eax], 4
jne 0x40680e
mov dword [ebp - 0xc], eax
add eax, 0x34
dec edx
jne 0x4067d2
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x406829
cmp dword [eax + 0x28], esi
je 0x406829
mov dword [ebp - 0x2c], 1
jmp 0x40682e
cmp dword [ebp + 0x14], esi
je 0x4067c1
cmp edi, esi
je 0x406841
mov eax, dword [edi + 0x28]
cmp eax, esi
je 0x406841
cmp dword [edi + 0x2c], esi
jbe 0x406841
mov dword [ebp + 0x18], eax
cmp ebx, esi
je 0x406854
mov eax, dword [ebx + 0x28]
cmp eax, esi
je 0x406854
cmp dword [ebx + 0x2c], esi
jbe 0x406854
mov dword [ebp + 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, esi
je 0x40686a
mov eax, dword [ecx + 0x28]
cmp eax, esi
je 0x40686a
cmp dword [ecx + 0x2c], esi
jbe 0x40686a
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 4]
cmp ecx, esi
je 0x406880
mov eax, dword [ecx + 0x28]
cmp eax, esi
je 0x406880
cmp dword [ecx + 0x2c], esi
jbe 0x406880
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push esi
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 0xc]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40690f
push 0x10
pop eax
mov dword [ebp + 0xc], eax
push eax
lea eax, [ebp - 0x44]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp + 0xc]
mov edi, str._status
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, 0x40f4dc
jne 0x4068f6
cmp dword [ebp - 4], 1
jne 0x4068f6
cmp dword [ebp + 0xc], esi
jbe 0x4068f6
lea eax, [ebp - 0x44]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4068f6
mov dword [ebp - 0x28], esi
push 3
push ebx
push 1
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040672e
cmp eax, esi
jne 0x406a17
mov edi, 0x20a
lea eax, [ebp - 0x250]
push edi
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp + 0x14], esi
je 0x40695c
cmp dword [ebp - 0x2c], esi
jne 0x40695c
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.00407276
add esp, 0x10
jmp 0x40697a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x250]
push edi
push eax
push dword [ebp - 0xc]
call fcn.004064e0
add esp, 0x10
test eax, eax
jne 0x406982
push 2
pop eax
cmp eax, esi
jne 0x406a17
lea eax, [ebp - 0x250]
push eax
call fcn.00407fb7
test eax, eax
pop ecx
jne 0x4069ea
push 2
pop eax
or edi, 0xffffffff
cmp eax, esi
je 0x4069d4
cmp dword [ebp - 0x28], esi
je 0x4069d4
cmp dword [ebp + 8], esi
je 0x4069d4
cmp dword [ebp + 0x10], esi
je 0x4069d4
lea ecx, [ebp - 0x9c4]
push ecx
push dword [ebp - 0x14]
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00406a81
add esp, 0x28
mov esi, edi
lea eax, [ebp - 0x5c4]
push eax
call fcn.0040868b
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x250]
push dword [ebp - 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push eax
call fcn.004062a3
add esp, 0x14
cmp eax, esi
jne 0x406a17
lea eax, [ebp - 0x250]
push eax
call fcn.00406a38
pop ecx
cmp eax, 1
jne 0x406a23
xor edi, edi
jmp 0x40699d
cmp eax, esi
jne 0x406996
mov edi, dword [ebp - 0x34]
neg edi
sbb edi, edi
and edi, 2
inc edi
jmp 0x4069d4