Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x70
lea eax, [esp]
push ebx
push esi
push edi
push eax
push 0x20019
push 0
push str.SOFTWARELXSUPMON
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012fe
lea ecx, [esp + 0x10]
lea edx, [esp + 0x48]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.UserWantsToBeReminded
push eax
mov dword [esp + 0x28], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4012ee
mov edx, dword [0x488e90]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x3a
push edx
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40109e
test cl, cl
je 0x40109a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40109e
add eax, 2
add esi, 2
test cl, cl
jne 0x401076
xor eax, eax
jmp 0x4010a3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4010bb
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x70
ret
mov edx, dword [0x488e90]
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x34
push edx
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4010fd
test cl, cl
je 0x4010f9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4010fd
add eax, 2
add esi, 2
test cl, cl
jne 0x4010d5
xor eax, eax
jmp 0x401102
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40111d
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
pop edi
pop esi
pop ebx
add esp, 0x70
ret
mov edx, dword [0x488e90]
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x35
push edx
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40115f
test cl, cl
je 0x40115b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40115f
add eax, 2
add esi, 2
test cl, cl
jne 0x401137
xor eax, eax
jmp 0x401164
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40117f
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x70
ret
mov edx, dword [0x488e90]
lea ecx, [esp + 0x14]
push 0x32
push ecx
push 0x36
push edx
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4011c1
test cl, cl
je 0x4011bd
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4011c1
add eax, 2
add esi, 2
test cl, cl
jne 0x401199
xor eax, eax
jmp 0x4011c6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4011d4
push 0x15180
jmp 0x4012c8
mov eax, dword [0x488e90]
lea edx, [esp + 0x14]
push 0x32
push edx
push 0x37
push eax
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401215
test cl, cl
je 0x401211
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401215
add eax, 2
add esi, 2
test cl, cl
jne 0x4011ed
xor eax, eax
jmp 0x40121a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401228
push 0x2a300
jmp 0x4012c8
mov eax, dword [0x488e90]
lea edx, [esp + 0x14]
push 0x32
push edx
push 0x38
push eax
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401269
test cl, cl
je 0x401265
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401269
add eax, 2
add esi, 2
test cl, cl
jne 0x401241
xor eax, eax
jmp 0x40126e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401279
push 0x93a80
jmp 0x4012c8
mov eax, dword [0x488e90]
lea edx, [esp + 0x14]
push 0x32
push edx
push 0x39
push eax
call edi
lea esi, [esp + 0x14]
lea eax, [esp + 0x48]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4012ba
test cl, cl
je 0x4012b6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4012ba
add eax, 2
add esi, 2
test cl, cl
jne 0x401292
xor eax, eax
jmp 0x4012bf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4012f3
push 0x127500
mov eax, dword [esp + 0x84]
push eax
call fcn.00416930
mov ecx, dword [esp + 0x14]
add esp, 8
mov esi, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x70
ret
call fcn.004164a0
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x70
ret