Function at 0x404e1b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x40fb2c
call fcn.0040ef70
sub esp, 0x1c
push ebx
push esi
mov esi, 0x416cc4
xor ebx, ebx
push 0x4162ec
mov ecx, esi
mov dword [ebp - 0x1c], ebx
call sub.MFC42.DLL_CString::Find
cmp eax, ebx
mov dword [ebp - 0x20], eax
jl 0x405004
push edi
push eax
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
call sub.MFC42.DLL_CString::Left
mov edi, dword [sym.imp.MSVCRT.dll__mbsicmp]
push str.HKEY_CLASSES_ROOT
push dword [ebp - 0x14]
mov dword [ebp - 4], ebx
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404e7d
mov dword [ebp - 0x18], 0x80000000
jmp 0x404f15
push str.HKEY_CURRENT_USER
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404e96
mov dword [ebp - 0x18], 0x80000001
jmp 0x404f15
push str.HKEY_LOCAL_MACHINE
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404eaf
mov dword [ebp - 0x18], 0x80000002
jmp 0x404f15
push str.HKEY_USERS
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404ec8
mov dword [ebp - 0x18], 0x80000003
jmp 0x404f15
push str.HKEY_PERFORMANCE_DATA
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404ee1
mov dword [ebp - 0x18], 0x80000004
jmp 0x404f15
push str.HKEY_CURRENT_CONFIG
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404efa
mov dword [ebp - 0x18], 0x80000005
jmp 0x404f15
push str.HKEY_DYN_DATA
push dword [ebp - 0x14]
call edi
pop ecx
test eax, eax
pop ecx
jne 0x404ff7
mov dword [ebp - 0x18], 0x80000006
xor edi, edi
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x20]
mov ecx, esi
inc eax
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call sub.MFC42.DLL_CString::Mid_1
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
mov dword [ebp - 0x20], ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x404f5c
mov edi, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x24], edi
cmp eax, ebx
lea ecx, [ebp - 0x28]
sete byte [ebp - 0xd]
call fcn.0040ebd0
cmp byte [ebp - 0xd], bl
je 0x404fec
lea eax, [ebp - 0x28]
mov esi, str.PublicMode
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x404fb6
cmp dword [ebp - 0x20], ebx
jne 0x404fad
cmp dword [ebp + 8], ebx
je 0x404fad
mov dword [ebp + 8], 1
push 4
lea eax, [ebp + 8]
jmp 0x404fc9
mov dword [ebp - 0x1c], 1
jmp 0x404fdf
xor eax, eax
cmp dword [ebp + 8], ebx
push 4
setne al
mov dword [ebp - 0x20], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 4
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp - 0x1c], ecx
cmp edi, ebx
je 0x404ff7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp edi, ebx
je 0x404ff7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0040ebd0
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4