Function at 0x404290
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x4c
push ebx
push esi
push edi
push 0x200
mov dword [esp + 0x10], 0
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push 0x200
push ebx
mov byte [ebx], 0
call fcn.00416d90
xor ecx, ecx
mov al, byte [0x42c1b8]
mov dword [esp + 0x29], ecx
push str.Lgesgifm
mov dword [esp + 0x31], ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x35], ecx
mov byte [esp + 0x2c], al
mov dword [esp + 0x39], ecx
mov word [esp + 0x3d], cx
mov byte [esp + 0x3f], cl
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
push ecx
call fcn.004061b0
lea edx, [esp + 0x30]
push edx
call fcn.00416df0
add esp, 0x18
test eax, eax
je 0x404331
call fcn.00416db0
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e1b4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e1b0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push str.dj_c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
mov ecx, edx
push eax
push 0x20019
and ecx, 3
push 0
push ebx
push 0x80000001
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40443f
mov ecx, dword [esp + 0x5c]
mov dword [ecx], 2
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0xc]
push ebp
add eax, 0x162
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov esi, 5
push 0
push str.OYpr
mov dword [esp + 0x24], esi
call fcn.0041bfd0
mov edx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 4
push eax
push edx
call ebp
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x10]
add ecx, 0x16c
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.KYefm
mov dword [esp + 0x24], esi
call fcn.0041bfd0
add esp, 4
push eax
mov eax, dword [esp + 0x2c]
push eax
call ebp
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10]
add edx, 0x14e
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0x41e194
mov dword [esp + 0x24], 0xa
call fcn.0041bfd0
mov ecx, dword [esp + 0x2c]
add esp, 4
push eax
push ecx
call ebp
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00416df0
add esp, 8
test eax, eax
je 0x404551
call fcn.00416db0
push 0x41e1b4
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x1c]
mov ecx, edx
push eax
push 0x20019
and ecx, 3
push 0
push ebx
push 0x80000001
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4045ab
mov ecx, dword [esp + 0x60]
mov dword [ecx], 2
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x10]
add eax, 0x6d
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0x41e18c
mov dword [esp + 0x24], 0xc8
call fcn.0041bfd0
mov edx, dword [esp + 0x30]
add esp, 4
push eax
push edx
call ebp
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x10]
add ecx, 9
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.C_mh_
mov dword [esp + 0x24], 0x64
call fcn.0041bfd0
add esp, 4
push eax
mov eax, dword [esp + 0x30]
push eax
call ebp
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10]
add edx, 0x135
push ecx
lea eax, [esp + 0x18]
push edx
push eax
mov esi, 5
push 0
push 0x41e180
mov dword [esp + 0x24], esi
call fcn.0041bfd0
mov ecx, dword [esp + 0x30]
add esp, 4
push eax
push ecx
call ebp
mov dl, byte [0x42c1b8]
mov ecx, 9
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], dl
push str.RlXm
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x14], esi
stosb byte es:[edi], al
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.cYic
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
add esp, 8
lea edx, [esp + 0x34]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x18]
add ecx, 0x149
lea eax, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push 0
push eax
push ecx
call ebp
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x10]
add eax, 0x144
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov esi, 5
push 0
push str.Racdfk
mov dword [esp + 0x24], esi
call fcn.0041bfd0
mov edx, dword [esp + 0x30]
add esp, 4
push eax
push edx
call ebp
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x10]
add ecx, 0x13a
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0x41e160
mov dword [esp + 0x24], 0x14
call fcn.0041bfd0
add esp, 4
push eax
mov eax, dword [esp + 0x30]
push eax
call ebp
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10]
add edx, 4
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.BYeKYlm__
mov dword [esp + 0x24], esi
call fcn.0041bfd0
mov ecx, dword [esp + 0x30]
add esp, 4
push eax
push ecx
call ebp
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e1b4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00416df0
add esp, 0xc
test eax, eax
je 0x40481d
call fcn.00416db0
push 0x41e150
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e150
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x68]
or ecx, 0xffffffff
lea edi, [eax + 0x176]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0
je 0x4048c8
mov eax, ebx
cmp byte [eax], 0x2f
jne 0x4048c0
mov byte [eax], 0x5c
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4048b8
mov eax, dword [esp + 0x60]
or ecx, 0xffffffff
lea edi, [eax + 0x162]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x18]
mov ecx, edx
push eax
push 0x20019
and ecx, 3
push 0
push ebx
push 0x80000001
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x10]
neg eax
sbb eax, eax
push edx
neg eax
inc eax
mov dword [ecx], eax
mov eax, dword [esp + 0x64]
add eax, 0x171
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Eglqf_rk
mov dword [esp + 0x24], 5
call fcn.0041bfd0
mov edx, dword [esp + 0x2c]
add esp, 4
push eax
push edx
call ebp
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x10]
add ecx, 0x270
push eax
lea edx, [esp + 0x18]
push ecx
push edx
mov esi, 0xa
push 0
push 0x41e140
mov dword [esp + 0x24], esi
call fcn.0041bfd0
add esp, 4
push eax
mov eax, dword [esp + 0x2c]
push eax
call ebp
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x10]
add edx, 0x27a
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Ojfcm_s
mov dword [esp + 0x24], esi
call fcn.0041bfd0
mov ecx, dword [esp + 0x2c]
add esp, 4
push eax
push ecx
call ebp
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x10]
add eax, 0x284
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.SjXbc_m_
mov dword [esp + 0x24], esi
call fcn.0041bfd0
mov edx, dword [esp + 0x2c]
add esp, 4
push eax
push edx
call ebp
mov eax, dword [esp + 0x18]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x60]
or ecx, 0xffffffff
pop ebp
lea edi, [eax + 0x16c]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404a16
lea ecx, [esp + 0x5c]
push ecx
call fcn.00405410
add esp, 4
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x60]
add esp, 4
mov eax, dword [edx]
pop edi
pop esi
pop ebx
add esp, 0x4c
ret