Function at 0x409c58
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x417508
call fcn.00416288
mov eax, 0x1064
call fcn.00415be0
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
add eax, 0x18c0
push esi
push edi
je 0x409c84
inc dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
add eax, 0x18c2
je 0x409cb0
inc dword [ebp - 0x10]
mov dword [ebp - 0x4c], 0xf
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x60], bl
mov dword [ebp - 4], 1
call fcn.0040d480
cdq
mov ecx, 0x3c78105
idiv ecx
mov dword [ebp - 0x10], edx
call fcn.0040d480
cdq
mov ecx, 0x18c4
idiv ecx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
imul eax, ecx
mov dword [ebp - 0x10], eax
cmp esi, ebx
jne 0x409e89
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x1c], 0x1000
mov dword [ebp - 0x10], ebx
push 2
mov dword [ebp - 0x18], 0x18c7
mov dword [ebp - 0x10], ebx
pop edi
jmp 0x409d22
call esi
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edi
jl 0x409d1a
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], 0x18c9
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
jmp 0x409d5f
call esi
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edi
jl 0x409d57
mov eax, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov byte [ebp + eax - 0x1070], bl
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x409d91
push str.windows6346XP
push dword [ebp - 0x10]
call esi
cmp eax, ebx
je 0x409d91
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
jne 0x409e51
call fcn.0040d480
cdq
mov ecx, 0x18cb
idiv ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x3c8927c
mov eax, dword [ebp - 0x10]
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x409dbe
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x409ddc
push str.windows6348XP
push dword [ebp - 0x10]
call esi
cmp eax, ebx
je 0x409ddc
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x24], ebx
jbe 0x409ec6
cmp dword [ebp - 0x24], 3
ja 0x409ec6
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x1070]
lea esi, [ebp - 0x44]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x34], ebx
mov byte [ebp - 0x44], bl
call fcn.00403470
mov ebx, esi
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 2
call fcn.004033e8
push 1
xor edi, edi
mov byte [ebp - 4], 1
call fcn.00403438
call fcn.0040d480
cdq
mov ecx, 0x18cf
idiv ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x3c92ec0
mov eax, dword [ebp - 0x10]
test eax, eax
mov eax, dword [ebp - 0x14]
jne 0x409e4c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
xor ebx, ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040d480
cdq
mov ecx, 0x3c9a3f3
idiv ecx
mov dword [ebp - 0x10], edx
call fcn.0040d480
cdq
mov ecx, 0x18d2
idiv ecx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
imul eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 0xf
mov byte [eax], bl
lea ebx, [ebp - 0x60]
call fcn.004033e8
xor eax, eax
inc eax
push eax
xor edi, edi
mov esi, ebx
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
call fcn.00403438
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x6c]
call fcn.0040d151
push 0x41b64c
lea eax, [ebp - 0x6c]
push eax
call fcn.00410998
int3