Function at 0x409c90
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov dword [ebp - 0x24], 0x1382a
mov dword [ebp - 0x94], 0x4506
mov dword [ebp - 0x18], 0x17ea8
mov dword [ebp - 0x20], 0xb4f4
mov dword [ebp - 0x80], 0xcbc1
mov dword [ebp - 0x74], 0xff0e
mov dword [ebp - 0x60], 0x1057a
mov dword [ebp - 0x28], 0xd0ae
mov dword [ebp - 0x3c], 0x21e6
mov dword [ebp - 8], 0x154af
mov dword [ebp - 0x68], 0x895a
mov dword [ebp - 0x34], 0x4aa1
mov dword [ebp - 0x48], 0x8462
mov dword [ebp - 0x2c], 0x206d
mov dword [ebp - 4], 0xea3f
mov dword [ebp - 0x1c], 0x153b9
mov dword [ebp - 0x14], 0x4590
mov dword [ebp - 0x44], 0xd82f
mov dword [ebp - 0x6c], 0x817f
mov dword [ebp - 0x30], 0x13e80
mov dword [ebp - 0xc], 0x8595
mov dword [ebp - 0x10], 0x70d
mov dword [ebp - 0x90], 0xbe25
mov dword [ebp - 0x84], 0x122bd
mov dword [ebp - 0x64], 0x1354a
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0xbb32
push ecx
mov edx, dword [ebp - 0x60]
sub edx, 0xabc1
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0xfc26
push eax
mov ecx, dword [ebp + 8]
sub ecx, 0x1679
push ecx
mov edx, dword [ebp + 8]
add edx, 0xae80
push edx
mov eax, dword [ebp - 0x48]
sub eax, 0x128d
push eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x14b4
push ecx
mov edx, dword [ebp - 0x10]
add edx, 0x3d79
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0xefeb
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x10650
push ecx
call fcn.004131a0
add esp, 0x28
mov dword [ebp - 0x38], 0
jmp 0x409dd5
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x153b8
cmp dword [ebp - 0x38], eax
jge 0x409f7e
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x14]
je 0x409f79
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x14]
sub edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x7c]
jge 0x409e24
mov dword [ebp - 0x4c], 1
jmp 0x409e2b
mov dword [ebp - 0x4c], 0
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 4]
or ecx, dword [ebp - 0x4c]
je 0x409f79
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x80]
jge 0x409f79
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x18]
jge 0x409f79
mov ecx, dword [ebp - 0x84]
cmp ecx, dword [ebp - 0x3c]
jne 0x409f79
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x14]
jne 0x409f79
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp + 8]
jne 0x409f79
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 4]
jne 0x409f79
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
jne 0x409f79
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 8]
or eax, ecx
je 0x409f79
push 0x14839
push 0x4570
push 0x8f83
push 0x17a9f
push 0x64f7
push 0xdcdb
push 0x3f60
push 0x12933
call dword [sym.imp.KERNEL32.dll_GetEnabledXStateFeatures]
add esp, 0x20
mov edx, dword [ebp - 0xc]
or edx, dword [ebp + 0xc]
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x88]
cmp edx, dword [ebp - 0x8c]
jge 0x409f0c
mov dword [ebp - 0x50], 1
jmp 0x409f13
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x6c]
and eax, dword [ebp - 0x50]
je 0x409f79
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x24]
jne 0x409f79
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x3c]
jne 0x409f79
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 8]
jne 0x409f79
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x2c]
jne 0x409f79
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x90]
jne 0x409f79
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
push 0xbab5
push 0x11984
push 0x653f
push 0xeabe
push 0xe8cf
push 0x11d43
call dword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
add esp, 0x18
jmp 0x409dcc
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x1c]
jge 0x409f8f
mov dword [ebp - 0x54], 1
jmp 0x409f96
mov dword [ebp - 0x54], 0
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 8]
jge 0x409fa7
mov dword [ebp - 0x58], 1
jmp 0x409fae
mov dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x20]
jge 0x409fc2
mov dword [ebp - 0x5c], 1
jmp 0x409fc9
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x54]
and ecx, dword [ebp - 0x58]
or ecx, dword [ebp - 0x5c]
je 0x40a021
mov edx, dword [ebp - 0x60]
cmp edx, dword [ebp - 0x14]
jne 0x40a021
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 4]
jne 0x40a021
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp - 0x24]
jne 0x40a021
push 0xf9f8
push 0xd309
push 0x15eaa
push 0x5d7e
push 0xa569
push 0x4549
push 0xd338
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
add esp, 0x1c
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x40], 0
jmp 0x40a033
mov eax, dword [ebp - 0x40]
add eax, 1
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x68]
sub ecx, 0x8959
cmp dword [ebp - 0x40], ecx
jge 0x40a129
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jge 0x40a124
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x18]
jne 0x40a124
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x30]
jne 0x40a124
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x1c]
jne 0x40a124
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x40a124
push 0xb90f
push 0xda9c
push 0x58c7
push 0x1211
push 0x15783
push 0x5859
push 0x15bb1
push 0x282f
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
add esp, 0x20
mov ecx, dword [ebp - 0xc]
xor ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x1c]
jge 0x40a0c9
mov dword [ebp - 0x70], 1
jmp 0x40a0d0
mov dword [ebp - 0x70], 0
mov edx, dword [ebp - 0x6c]
add edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x70]
je 0x40a124
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x10]
jne 0x40a124
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x44]
jne 0x40a124
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x14]
jne 0x40a124
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jne 0x40a124
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x48]
jne 0x40a124
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x2024
push 0xf322
push 0xe577
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
jmp 0x40a02a
mov esp, ebp
pop ebp
ret