Function at 0x4073c0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x45c
call fcn.00427090
test eax, eax
jle 0x4073fc
mov eax, dword [0x45929c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc6
mov dword [esp + 4], 7
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetTimer]
sub esp, 0x10
lea eax, [esp + 0x40]
mov dword [esp], 0x80000002
xor esi, esi
mov dword [esp + 0x10], eax
mov eax, dword [0x450484]
mov dword [esp + 0xc], 0x20019
add eax, 0x12c6
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x407448
add esp, 0x45c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x44]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
sub esp, 0x30
mov ebx, eax
test eax, eax
jne 0x40755c
mov esi, dword [esp + 0x44]
test esi, esi
je 0x40755c
xor esi, esi
lea edi, [esp + 0x250]
mov dword [esp + 0x34], esi
jmp 0x4074e1
add ebx, 1
cmp ebx, dword [esp + 0x44]
jae 0x407558
xor eax, eax
mov dword [esp + 0x48], 0x100
mov word [esp + 0x250], ax
xor eax, eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x4c], 0x200
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
mov ebp, eax
test eax, eax
jne 0x4074d8
cmp word [esp + 0x250], 0
je 0x4074d8
jmp 0x40758c
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
sub esp, 4
add esp, 0x45c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebp, 1
cmp ebp, 8
je 0x4074d8
mov eax, dword [ebp*4 + 0x459020]
test eax, eax
je 0x407580
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407580
mov dword [esp + 0x38], eax
mov ebp, 0x4507c0
xor esi, esi
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4074d8
add esi, 1
add ebp, 0xa48
cmp esi, 6
jne 0x4075b2
cmp word [0x4507c0], 0
mov edx, dword [esp + 0x38]
je 0x40762d
cmp word [0x451208], 0
je 0x40770b
cmp word [0x451c50], 0
je 0x407701
cmp word [0x452698], 0
je 0x4076f7
cmp word [0x4530e0], 0
je 0x4076ed
cmp word [0x453b28], 0
mov edx, 5
jne 0x4074d8
imul ecx, edx, 0xa48
mov dword [esp + 0x38], edx
mov dword [esp + 0xc], 0x200
mov dword [esp + 8], edi
lea ebp, [ecx + 0x4507c0]
mov dword [esp + 0x3c], ecx
mov dword [esp + 4], 0x200
mov dword [esp], ebp
call dword [0x42a308]
mov edx, dword [esp + 0x38]
mov dword [ebp + 0x200], 0
mov dword [esp], edx
call fcn.00406f50
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
test eax, eax
jne 0x407696
xor eax, eax
add dword [esp + 0x34], 0x10000
mov word [ecx + 0x4507c0], ax
jmp 0x4074d8
xor ecx, ecx
add dword [esp + 0x34], 0x10001
xor esi, esi
mov dword [ebp + 0x244], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x11
call fcn.00407230
mov edx, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x408f80
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x208], eax
sub esp, 0x18
jmp 0x4074d8
mov edx, 4
jmp 0x40762d
mov edx, 3
jmp 0x40762d
mov edx, 2
jmp 0x40762d
mov edx, 1
jmp 0x40762d