Function at 0x409839
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe80
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x20019
xor esi, esi
push esi
push str.SYSTEMCurrentControlSetControlhivelist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409b2e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x444]
push eax
mov dword [ebp - 0x20], esi
push esi
jmp 0x409af3
inc dword [ebp - 0x20]
test eax, eax
jne 0x409b16
lea edi, [ebp - 0x444]
lea esi, [ebp - 0xc]
call fcn.00403083
lea edi, [ebp - 0x23c]
lea esi, [ebp - 8]
call fcn.00403083
mov esi, dword [ebp - 8]
cmp dword [esi - 0xc], 0
jne 0x4098d0
lea eax, [esi - 0x10]
call fcn.00404aac
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
jmp 0x409acf
cmp dword [ebp - 0x30], 2
jne 0x4098fc
push ebx
lea eax, [ebp - 0x64c]
push eax
push esi
call dword [0x4170c8]
cmp eax, ebx
jae 0x4098bd
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004030f8
mov esi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push esi
call fcn.004093bd
test eax, eax
jne 0x409912
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
jmp 0x4098c0
mov ebx, dword [ebp - 8]
cmp dword [ebx - 0xc], 0
jne 0x409920
lea eax, [ebx - 0x10]
jmp 0x4098c0
lea edi, [ebp - 8]
call fcn.0040bc5b
mov ecx, dword [ebx - 0xc]
inc eax
mov edi, ecx
sub edi, eax
mov esi, eax
test eax, eax
jge 0x409938
xor esi, esi
test edi, edi
jge 0x40993e
xor edi, edi
mov eax, 0x7fffffff
sub eax, esi
cmp eax, edi
jl 0x409b24
lea eax, [esi + edi]
cmp eax, ecx
jle 0x409958
mov edi, ecx
sub edi, esi
cmp esi, ecx
jle 0x40995e
xor edi, edi
test esi, esi
jne 0x409976
cmp edi, ecx
jne 0x409976
lea eax, [ebx - 0x10]
call fcn.004037c8
add eax, 0x10
mov dword [ebp - 0x28], eax
jmp 0x40998c
lea eax, [ebp - 8]
call fcn.004035cf
lea ecx, [ebx + esi*2]
push ecx
mov ecx, eax
lea esi, [ebp - 0x28]
call fcn.0040357b
mov edi, dword [ebp - 0x28]
add edi, 0xfffffff0
push ecx
mov eax, edi
mov esi, esp
mov dword [ebp - 0x2c], edi
call fcn.004037c8
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp + 8]
push esi
call fcn.00409519
test eax, eax
je 0x4099fb
mov eax, dword [0x41dddc]
mov ecx, 0x41dddc
call dword [eax + 0xc]
mov esi, dword [ebp - 0xc]
add eax, 0x10
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push str.Ignoring_:__s_n
push eax
call fcn.0040389f
mov eax, dword [ebp - 0x10]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00404aac
mov eax, edi
call fcn.00404aac
lea eax, [ebx - 0x10]
call fcn.00404aac
lea eax, [esi - 0x10]
jmp 0x409acf
and dword [ebp - 0x10], 0
push ecx
lea edi, [ebx - 0x10]
mov eax, edi
mov dword [ebp - 0x14], esp
call fcn.004037c8
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
push ecx
add eax, 0xfffffff0
mov ebx, esp
mov dword [ebp - 0x14], eax
call fcn.004037c8
add eax, 0x10
mov dword [ebx], eax
lea ebx, [ebp - 0x10]
call fcn.00409625
cmp dword [esi + 0xd0], 1
jne 0x409a46
mov eax, dword [ebp - 0x10]
test dword [esi + 0xd4], eax
je 0x409abd
push 0x830
lea eax, [ebp - 0xe7c]
push 0
push eax
call fcn.0040f5f0
pop ecx
pop ecx
mov eax, edi
mov ebx, esp
call fcn.004037c8
add eax, 0x10
mov dword [ebx], eax
call fcn.004094c0
pop ecx
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0xa6c]
mov dword [ebp - 0x650], edx
mov edx, dword [ebp - 8]
mov ebx, 0x208
push eax
mov ecx, ebx
call fcn.00401fb7
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0xe7c]
push eax
mov ecx, ebx
call fcn.00401fb7
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0xe7c]
push eax
lea ebx, [esi + 0x304]
call fcn.0040c238
mov eax, dword [ebp - 0x2c]
call fcn.00404aac
mov eax, edi
call fcn.00404aac
mov eax, dword [ebp - 0x14]
call fcn.00404aac
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
mov ebx, 0x104
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x40988d
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x409b30
push 0x80070057
call fcn.00404c03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4