Function at 0x401da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push edi
push 0x410
mov ebx, ecx
mov dword [ebp - 0x1c], 0
push 8
mov edi, edx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
test eax, eax
jne 0x401dd7
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
push str._Info__To_find_process:__s_n
call fcn.00401130
add esp, 8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push edi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [0x4040a4]
test eax, eax
jne 0x401e71
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], 0
push eax
push dword [ebp - 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0x410
push eax
push 0
push 0x404734
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401e68
push 0xfffffffffffffff5
call esi
push 0xc
push eax
call dword [0x4040a8]
push edi
push str._ERROR__Read_Reg_HKEY_CLASSES_ROOT_s__error__n
push 2
call dword [0x404180]
add esp, 4
push eax
call fcn.00401170
add esp, 0xc
push 0xfffffffffffffff5
call esi
push 7
push eax
call dword [0x4040a8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401e77
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x80]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x401f83
push 5
push str..ps1
push edi
call dword [0x404194]
mov edi, dword [ebp - 8]
add esp, 0xc
push edi
test eax, eax
jne 0x401ec8
push str._sShell0Command
jmp 0x401ecd
push str._sShellOpenCommand
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x410
push 0
push edi
call sub.P_2
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f6f
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0x410
push eax
push 0
push 0x404734
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401f66
mov edi, dword [0x4040a4]
push 0xfffffffffffffff5
call edi
push 0xc
push eax
call dword [0x4040a8]
push esi
push str._ERROR__Read_Reg_HKEY_CLASSES_ROOT_s__error__n
push 2
call dword [0x404180]
add esp, 4
push eax
call fcn.00401170
add esp, 0xc
push 0xfffffffffffffff5
call edi
push 7
push eax
call dword [0x4040a8]
mov edi, dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 1
call esi
push eax
call dword [0x4040a0]
jmp 0x401f9c
mov edi, dword [ebp - 8]
push 0x410
push 0
push edi
call sub.P_2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0xc
push edi
push str._Info__Get_Reg_ext:__s_n
call fcn.00401130
add esp, 8
cmp word [edi], 0
je 0x40222b
mov esi, edi
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401fc0
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 2]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 8
call eax
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov ecx, ebx
mov dword [ebp - 0xc], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401ff1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea eax, [eax*2 + 0x20a]
push eax
push 8
call esi
push eax
call edi
cmp dword [ebp - 0xc], 0
mov edi, eax
mov dword [ebp - 0x14], edi
je 0x402216
test edi, edi
je 0x402203
mov eax, dword [ebp - 8]
mov edx, eax
movzx eax, word [eax]
mov edi, eax
test ax, ax
je 0x40205f
mov ecx, eax
cmp cx, 0x20
je 0x40204f
movzx edi, cx
cmp cx, 9
jne 0x40205f
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov edi, eax
test ax, ax
jne 0x402040
cmp di, 0x22
jne 0x4020a9
movzx eax, word [edx + 2]
add edx, 2
xor ecx, ecx
cmp eax, 0x22
je 0x402092
mov ebx, dword [ebp - 0xc]
mov esi, eax
test si, si
je 0x40208f
add edx, 2
mov word [ebx + ecx*2], si
inc ecx
movzx eax, word [edx]
mov esi, eax
cmp eax, 0x22
jne 0x402078
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
xor esi, esi
mov word [eax + ecx*2], si
lea eax, [edx + 2]
cmp word [edx], 0x22
cmovne eax, edx
mov edx, eax
jmp 0x4020e0
xor esi, esi
cmp di, 0x20
je 0x4020d7
mov ebx, dword [ebp - 0xc]
movzx ecx, di
cmp cx, 9
je 0x4020d4
test cx, cx
je 0x4020d4
add edx, 2
mov word [ebx + esi*2], cx
inc esi
movzx eax, word [edx]
mov ecx, eax
cmp eax, 0x20
jne 0x4020b7
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov word [eax + esi*2], cx
movzx eax, word [edx]
mov esi, eax
test ax, ax
je 0x40210f
mov ecx, eax
nop dword [eax]
cmp cx, 0x20
je 0x4020ff
movzx esi, cx
cmp cx, 9
jne 0x40210f
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
mov esi, eax
test ax, ax
jne 0x4020f0
xor cl, cl
xor eax, eax
mov byte [ebp - 1], cl
test si, si
je 0x4021a2
movzx esi, si
add edx, 2
cmp si, 0x25
jne 0x402189
movzx ecx, word [edx]
cmp ecx, 0x31
je 0x402146
cmp ecx, 0x2a
je 0x402146
mov edi, dword [ebp - 0x14]
mov ecx, 0x25
mov word [edi + eax*2], cx
jmp 0x402190
mov edi, dword [ebp - 0x14]
lea esi, [eax + eax]
sub esi, ebx
mov byte [ebp - 1], 1
mov ecx, ebx
add esi, edi
nop word [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [esi + ecx - 2], ax
test ax, ax
jne 0x402160
mov eax, edi
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402175
sub eax, esi
sar eax, 1
add edx, 2
jmp 0x402191
mov edi, dword [ebp - 0x14]
mov word [edi + eax*2], si
inc eax
movzx ecx, word [edx]
mov esi, ecx
test cx, cx
jne 0x402122
cmp byte [ebp - 1], cl
jne 0x4021c5
jmp 0x4021a5
mov edi, dword [ebp - 0x14]
lea eax, [edi + eax*2]
mov ecx, 0x20
mov word [eax], cx
sub eax, ebx
lea ecx, [eax + 2]
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x4021b5
mov ebx, dword [ebp - 0xc]
push ebx
push str._Info__exepath:__s_n
call fcn.00401130
push edi
push str._Info__CommandLine:__s_n
call fcn.00401130
add esp, 0x10
mov edx, edi
mov ecx, ebx
call fcn.00401b10
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 1
mov dword [ebp - 0x1c], eax
call esi
mov ebx, dword [0x4040a0]
push eax
call ebx
jmp 0x40221c
mov ebx, dword [ebp - 0xc]
push ebx
push 1
call esi
mov ebx, dword [0x4040a0]
push eax
call ebx
jmp 0x40221c
mov ebx, dword [0x4040a0]
test edi, edi
je 0x402228
push edi
push 1
call esi
push eax
call ebx
mov edi, dword [ebp - 8]
push edi
push 1
call esi
push eax
call dword [0x4040a0]
mov eax, dword [ebp - 0x1c]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret