Function at 0x406475
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6d0
push ebx
push esi
push edi
push 0x410380
lea eax, [ebp - 0x78]
push 0x20
mov esi, 0x4013fc
push eax
push esi
mov ebx, 0x410178
xor edi, edi
push 0x40135c
push ebx
mov dword [ebp - 0x2c], 0x4014f8
mov dword [ebp - 0x24], edi
mov word [ebp - 0x28], di
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.00409db9
test eax, eax
jne 0x4064c7
push 1
pop eax
jmp 0x40670e
call fcn.0040a6a1
test eax, eax
push 1
jne 0x4064e3
push 0x17b
call fcn.00407dbb
xor eax, eax
jmp 0x40670e
push 0x93
call fcn.00407dbb
push edi
push 0x401390
call fcn.00409152
mov dword [ebp - 8], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x4c8]
push dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x4c8]
push 0x20
push 0x4014e0
push eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
cmp dword [ebp - 8], edi
je 0x406698
mov dword [ebp - 0x20], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x280]
push eax
push edi
push 0x4014c8
push 0x401410
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x38], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x40657c
mov word [ebp - 0x280], di
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x20]
push edi
push 0x100400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push edi
push edi
push 0x42c
mov dword [ebp + 8], eax
push dword [ebp - 8]
call fcn.004095a1
cmp dword [ebp + 8], edi
je 0x40665a
push 0x7530
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40665a
cmp word [ebp - 0x280], di
je 0x406661
lea eax, [ebp - 0x280]
push eax
call fcn.0040a5cf
test eax, eax
jne 0x40665a
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0040ac61
test eax, eax
je 0x40665a
cmp dword [ebp - 0x1c], edi
je 0x40665a
cmp dword [ebp - 0x14], edi
je 0x40665a
push 0x410380
lea eax, [ebp - 0x6d0]
push 0x104
push eax
push esi
push 0x401378
push ebx
call fcn.00409db9
test eax, eax
je 0x40665a
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x6d0]
push eax
call fcn.0040a411
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x18]
ja 0x40664f
jne 0x406661
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x30]
jbe 0x406661
push 1
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
jmp 0x406661
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edi
je 0x40666f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 1
push 0x91
lea ecx, [ebp - 0x2c]
call fcn.00406732
cmp dword [ebp - 4], edi
je 0x406693
push 1
push 0x90
call fcn.00407dbb
jmp 0x40670b
cmp dword [ebp - 0x10], edi
jne 0x40670b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x493e0
push 1
mov dword [ebp - 0x24], eax
pop esi
lea eax, [ebp - 0x4c8]
push esi
push eax
call fcn.004073ca
test eax, eax
jl 0x4066f1
push esi
push 0x92
mov dword [ebp - 0xc], esi
call fcn.00407dbb
mov eax, dword [ebp - 0x34]
cmp eax, edi
je 0x4066d2
mov word [eax], di
lea eax, [ebp - 0x4c8]
push eax
call fcn.0040903d
push 0x410380
push edi
push 0x40135c
push ebx
call fcn.00409d11
jmp 0x4066fc
push esi
push 0x94
call fcn.00407dbb
push esi
push esi
push 0x95
lea ecx, [ebp - 0x2c]
call fcn.00406732
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 4