Function at 0x403504
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
xor esi, esi
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push ebx
push str.CF2524C0_29AE_11CF_97EA_00AA0034319D
call edi
test eax, eax
je 0x403725
push ebx
push str.9B4E7760_3196_11CF_97EA_00AA0034319D
call edi
test eax, eax
je 0x403725
push ebx
push str.4CB1C7E0_2D65_11CF_8E30_08002B3638A6
call edi
test eax, eax
je 0x403725
push ebx
push str.C318AA20_2D79_11CF_8E30_08002B3638A6
call edi
test eax, eax
je 0x403725
push ebx
push str.0E278800_7c3f_11d0_b51f_00aa00342f9f
call edi
test eax, eax
je 0x403725
push ebx
push str.e400b42c_f2b8_11d0_920f_00a024df156e
call edi
test eax, eax
je 0x403725
push ebx
push str.F1D8CF80_29AE_11CF_97EA_00AA0034319D
call edi
test eax, eax
jne 0x4035b6
push dword [ebp + 0xc]
call fcn.0040338f
test eax, eax
je 0x4037a0
push pe_nt_image_headers32
mov esi, 1
push dword [ebp + 0x10]
push eax
push dword [0x407488]
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x4037a0
push ebx
push str.E8CF9400_29AE_11CF_97EA_00AA0034319D
call edi
test eax, eax
jne 0x4036bd
push dword [ebp + 0xc]
call fcn.004033c3
cmp eax, 0x1b70
mov edi, eax
jne 0x403696
mov eax, dword [ebp + 0xc]
add eax, 5
push eax
call fcn.00403319
push dword [ebp + 0xc]
mov ebx, eax
call fcn.004033f7
cmp ebx, 0x8000
jbe 0x40360d
mov esi, pe_nt_image_headers32
lea eax, [ebp - 0x8c]
push esi
push eax
push 0x1b86
jmp 0x403639
mov esi, pe_nt_image_headers32
test eax, eax
push esi
je 0x40362d
lea ecx, [ebp - 0x10c]
push ecx
push eax
push dword [0x407488]
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x40365d
lea eax, [ebp - 0x8c]
push eax
push 0x1b87
push dword [0x407488]
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
lea ecx, [ebp - 0x8c]
push ecx
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
lea ecx, [ebp - 0x8c]
push ecx
mov eax, dword [0x407488]
push edi
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x10c]
lea ecx, [ebp - 0x8c]
push eax
mov esi, 1
push ecx
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4037a0
test edi, edi
je 0x4037a0
push pe_nt_image_headers32
mov esi, 1
push dword [ebp + 0x10]
push edi
push dword [0x407488]
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x4037a0
push ebx
push str.C8DD9DE0_9D61_11d0_B91D_0000C004AA0B
call edi
test eax, eax
jne 0x4037a0
mov eax, dword [ebp + 0xc]
add eax, 7
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
add eax, 5
push eax
mov eax, dword [ebp + 0x10]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
add eax, 3
push eax
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
inc eax
push eax
mov eax, dword [ebp + 0x10]
add eax, 6
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 8], 0
jmp 0x4037a0
lea eax, [ebp - 4]
push eax
push 0x401114
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4037a0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403797
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0xc], 0x100
push eax
push ecx
push 0
push 0
push 0x401108
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40378e
mov esi, 1
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4037b0
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc