Function at 0x403bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427b4e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x438130]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SoftwareSkypeUpdater
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00402870
test eax, eax
je 0x403cc7
call fcn.00401f80
mov esi, eax
mov eax, dword [0x43a9c4]
test al, 1
jne 0x403c90
or eax, 1
mov dword [0x43a9c4], eax
mov ecx, 0x43a990
mov byte [ebp - 4], 1
call fcn.004077e0
push 0x429090
call fcn.00418853
add esp, 4
mov byte [ebp - 4], 0
mov ecx, 0x43a990
call fcn.00408c40
test eax, eax
je 0x403cbf
push esi
push str.SoftwareSkypeUpdater
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push str.BitsJob:_failed_to_open_key___s___0x_x_
push eax
mov dword [ebp - 0x14], 0xfffffffe
call fcn.00407b90
add esp, 0x10
mov edi, dword [ebp - 0x2c]
jmp 0x403dfb
lea eax, [ebx + 0x1c]
push eax
lea ecx, [ebp - 0x20]
call fcn.004072b0
lea eax, [ebx + 4]
mov byte [ebp - 4], 2
push eax
push str.BitsJobId
lea ecx, [ebp - 0x2c]
call fcn.00404310
mov edi, dword [ebp - 0x2c]
test eax, eax
je 0x403d1a
cmp eax, 2
je 0x403d1a
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x403def
push esi
push str.BitsJobId
jmp 0x403e3c
mov eax, dword [ebx + 0x18]
mov ecx, 1
mov dword [ebp - 0x10], 0x104
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x104
or eax, ecx
jge 0x403d45
push 0x104
lea ecx, [ebx + 0x18]
call fcn.004041f0
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x18]
lea ecx, [ebp - 0x2c]
push str.BitsJobFile
call fcn.004043b0
mov edx, eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x10], edx
test eax, eax
jne 0x403d69
xor ecx, ecx
jmp 0x403d82
push dword [eax - 8]
push eax
call fcn.00418ba4
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x403e59
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x18]
cmp ecx, dword [eax - 8]
jg 0x403e59
mov dword [eax - 0xc], ecx
xor esi, esi
mov eax, dword [ebx + 0x18]
mov word [eax + ecx*2], si
test edx, edx
je 0x403dc2
cmp edx, 2
je 0x403dc2
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x403def
push esi
push str.BitsJobFile
jmp 0x403e3c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebx + 0x14]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.BitsJobError
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x403e1a
cmp dword [ebp - 0x14], 4
jne 0x403e1f
xor esi, esi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.004072f0
test edi, edi
je 0x403e06
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 2
je 0x403ded
call fcn.00401f80
mov esi, eax
call fcn.004037f0
mov ecx, eax
call fcn.00408c40
test eax, eax
je 0x403def
push esi
push str.BitsJobError
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push str.BitsJob:_failed_to_read__s__0x_x_
push eax
mov dword [ebp - 0x14], 0xfffffffe
call fcn.00407b90
add esp, 0x10
jmp 0x403def
push 0x80070057
call fcn.00402180
int3