Function at 0x401210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x402551
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x698
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x15c
lea edi, [esp + 0x130]
rep stosd dword es:[edi], eax
mov dword [esp + 0x130], 3
xor ebx, ebx
mov cl, byte [eax + 0x404076]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x401251
mov edi, dword [sym.imp.MSVCR70.dll_sprintf]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x4ab]
push ecx
call edi
add esp, 8
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x404044]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x401280
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x50f]
push eax
call edi
add esp, 8
xor eax, eax
mov cl, byte [eax + str.2005]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x4012a3
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x523]
push edx
call edi
add esp, 8
xor eax, eax
jmp 0x4012d0
mov cl, byte [eax + 0x404062]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x4012d0
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x52d]
push ecx
call edi
add esp, 8
xor eax, eax
mov cl, byte [eax + 0x404066]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x4012f3
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x531]
push eax
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov al, byte [0x40406a]
mov esi, dword [sym.imp.MSVCR70.dll__mbsicmp]
lea ecx, [esp + 0x30]
push 0x4033dc
push ecx
mov dword [esp + 0x544], edx
mov byte [esp + 0x38], al
mov byte [esp + 0x39], bl
call esi
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x68c], eax
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0x40406b]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x401350
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x69c]
push eax
call edi
mov al, byte [0x404072]
add esp, 8
push 0x104
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov byte [esp + 0x34], al
mov byte [esp + 0x35], bl
mov byte [esp + 0x6ab], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp eax, ebx
je 0x4013bd
push ecx
mov edx, esp
mov dword [esp + 0x18], esp
push edx
lea ecx, [esp + 0x30]
call fcn.00401890
mov eax, dword [ebp + 8]
push eax
call fcn.004016b0
mov dword [esp + 0x540], eax
jmp 0x4013c8
mov dword [esp + 0x540], 0x409
mov dword [esp + 0x1c], ebx
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x6ac], ebx
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x6ac], 1
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x81
mov byte [esp + 0x6b0], 2
call sub.MFC70.DLL_Ordinal_957
mov ecx, eax
cmp ecx, ebx
je 0x40143b
lea eax, [esp + 0x14]
push eax
mov eax, 0x81
call fcn.00401ac0
push 0x82
call sub.MFC70.DLL_Ordinal_957
mov ecx, eax
cmp ecx, ebx
je 0x40145a
lea edx, [esp + 0x18]
push edx
mov eax, 0x82
call fcn.00401ac0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push str.SOFTWARE_s_s_
lea edi, [esp + 0x1c]
call fcn.00401a60
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40150b
lea ecx, [esp + 0x529]
push ecx
lea edx, [esp + 0x523]
push edx
lea eax, [esp + 0x513]
push eax
push str._s__s__s
lea edi, [esp + 0x20]
call fcn.00401a60
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x2c]
push eax
push ebx
push ecx
push edx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401500
lea esp, [esp]
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x544], cl
inc eax
cmp cl, bl
jne 0x4014f0
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [0x404073]
lea edx, [esp + 0x28]
push 0x4033dc
push edx
mov byte [esp + 0x30], cl
mov byte [esp + 0x31], bl
call esi
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x650], eax
mov al, byte [0x404074]
lea ecx, [esp + 0x30]
push 0x4033dc
push ecx
mov byte [esp + 0x38], al
mov byte [esp + 0x39], bl
call esi
mov dl, byte [0x404075]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x698], eax
lea eax, [esp + 0x38]
push 0x4033dc
push eax
mov byte [esp + 0x40], dl
mov byte [esp + 0x41], bl
call esi
add esp, 0x18
neg eax
sbb eax, eax
or edi, 0xffffffff
neg eax
push str.Ereg.dll
mov dword [esp + 0x694], eax
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], edi
mov dword [esp + 0x250], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
jne 0x4015be
push 0x30
push str.Register_Today
push str.Failed_to_load_Ereg_DLL.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4015e8
push str.AuthorizationWizard
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
jne 0x401605
push 0x30
push str.Register_Today
push str.Could_not_locate_AuthorizationWizard__.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x6ac], 1
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x401634
lea ecx, [esp + 0x130]
push ecx
call eax
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x6ac], 1
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40163e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x6ac], bl
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401662
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x6ac], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x401684
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x6a4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4