Function at 0x409250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c5fb
mov eax, dword fs:[0]
push eax
mov eax, 0x2088
call fcn.00417900
mov eax, dword [0x43d180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2084], esi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x39c]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x207c], eax
call fcn.004116e0
lea eax, [ebp - 0x2080]
mov dword [ebp - 4], 0
push eax
push 1
push 0
push 0x42dcb8
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2078], 0x1000
mov dword [ebp - 0x208c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x208c]
push eax
lea eax, [ebp - 0x2078]
push eax
push 0
push 0
push 0x42d928
push dword [ebp - 0x2080]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x2080]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00408940
mov eax, dword [ebp - 0x2078]
mov dword [ebp - 0x2080], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x314], ax
lea eax, [ebp - 0x312]
push eax
call fcn.00417930
lea eax, [ebp - 0x314]
push eax
call fcn.00408d20
add esp, 0x10
mov ecx, esi
push 1
push 0
call fcn.00410d10
mov ecx, esi
call fcn.004110d0
push 0x50
lea ecx, [esi + 0x3cb0]
call fcn.00408e50
push eax
lea ecx, [ebp - 0x39c]
call fcn.00411900
lea ecx, [esi + 0x3cb0]
call fcn.00408f30
push eax
lea ecx, [ebp - 0x39c]
call fcn.004118f0
push edi
mov ecx, esi
call fcn.00409b60
mov esi, eax
lea eax, [ebp - 0x108]
push 0x80
push 0
push eax
mov dword [ebp - 0x2088], esi
call fcn.00417930
lea eax, [ebp - 0x108]
push eax
call fcn.00410880
add esp, 0x10
call sub.GIDBIN1.dll_GIDSDKGetAppID
push edi
mov edi, dword [ebp - 0x2084]
mov ecx, edi
push 1
mov dword [ebp - 0x208c], eax
call fcn.00409ef0
cmp dword [ebp - 0x2080], 0xb000
mov ecx, 1
mov eax, 0
cmove eax, ecx
mov ecx, edi
mov dword [ebp - 0x2094], eax
lea eax, [ebp - 0x164c]
push eax
push dword [ebp - 0x207c]
call fcn.00409e30
push eax
push esi
lea ecx, [ebp - 0x39c]
call fcn.00411e30
test eax, eax
jne 0x409786
mov ecx, edi
call fcn.00410870
test dword [ebp - 0x208c], eax
jne 0x40943c
push 0x1e
push esi
push str.0000_0000_0000_0000_0000
call fcn.00417a82
add esp, 0xc
test eax, eax
jne 0x4096bf
cmp dword [ebp - 0x1648], 0xc8
jne 0x40977f
xor eax, eax
xorps xmm0, xmm0
push 0x62
push eax
mov word [ebp - 0x24], ax
mov word [ebp - 0x12], ax
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x86]
push eax
movdqu xmmword [ebp - 0x22], xmm0
call fcn.00417930
push 0x10
push 0xa
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x2080]
call fcn.00417b8d
add esp, 0x1c
cmp dword [ebp - 0x2080], 0xb000
jne 0x409683
mov eax, dword [ebp - 0x2094]
mov dword [ebp - 0x207c], 0
mov dword [ebp - 0x2080], 1
mov dword [ebp - 0x2084], 0x64
test eax, eax
je 0x4096bf
push 0x18
push esi
push str.000B_16BA_10F7_8F81_7777
call fcn.0041646d
add esp, 0xc
test eax, eax
je 0x409672
lea eax, [ebp - 0x207c]
push eax
push 0x20019
push 0
push 0x42dd00
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2084]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2080]
push eax
push 0
push str.SerialNumber
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 0x32
lea eax, [ebp - 0x88]
nop
cmp word [eax], 0
mov esi, 0x32
je 0x409543
add eax, 2
dec ecx
jne 0x409530
jmp 0x40954d
test ecx, ecx
je 0x40954d
mov eax, esi
sub eax, ecx
jne 0x409593
lea eax, [ebp - 0x207c]
push eax
push 0x20119
push 0
push 0x42dd00
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2084]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2080]
push eax
push 0
push str.SerialNumber
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, esi
lea eax, [ebp - 0x88]
jmp 0x4095a0
cmp word [eax], 0
je 0x4095ae
add eax, 2
dec ecx
jne 0x4095a0
jmp 0x4095bc
test ecx, ecx
je 0x4095bc
mov eax, esi
sub eax, ecx
jne 0x40966c
lea eax, [ebp - 0x207c]
push eax
push 0x20019
push 0
push str.SOFTWARETrendMicroUniClient1700LicensePlugin
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2084]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2080]
push eax
push 0
push 0x42ddc0
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, esi
lea eax, [ebp - 0x88]
lea ebx, [ebx]
cmp word [eax], 0
je 0x40961e
add eax, 2
dec ecx
jne 0x409610
jmp 0x409626
test ecx, ecx
je 0x409626
sub esi, ecx
jne 0x40966c
lea eax, [ebp - 0x207c]
push eax
push 0x20119
push 0
push str.SOFTWARETrendMicroUniClient1700LicensePlugin
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2084]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2080]
push eax
push 0
push 0x42ddc0
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [ebp - 0x2088]
mov eax, dword [ebp - 0x207c]
test eax, eax
je 0x409683
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x164c]
mov ecx, edi
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00409e30
push eax
push esi
lea ecx, [ebp - 0x39c]
call fcn.004117f0
test eax, eax
jne 0x409786
cmp dword [ebp - 0x1648], 0xc8
jne 0x40977f
mov ecx, edi
call fcn.00410870
test dword [ebp - 0x208c], eax
jne 0x4096e5
mov esi, 0x17
jmp 0x409715
mov eax, dword [ebp - 0x1644]
test eax, eax
je 0x409703
cmp eax, 0x4b1
je 0x409703
push eax
call fcn.00409100
add esp, 4
mov esi, eax
jmp 0x409715
push dword [ebp - 0x2088]
mov ecx, edi
mov esi, 0x15
call fcn.00410c40
push 0x1e
push dword [ebp - 0x2088]
push str.0000_0000_0000_0000_0000
call fcn.00417a82
add esp, 0xc
test eax, eax
je 0x409738
push esi
push 0
mov ecx, edi
call fcn.00410d10
lea eax, [ebp - 0x1640]
mov ecx, edi
push eax
call fcn.00410d50
lea eax, [ebp - 0x1498]
mov ecx, edi
push eax
call fcn.00410ba0
push dword [ebp - 0xc34]
mov ecx, edi
call fcn.00410ca0
push dword [ebp - 0xc30]
mov ecx, edi
call fcn.00410b90
mov ecx, edi
call fcn.00410870
push eax
mov ecx, edi
call fcn.00410b70
jmp 0x40979f
mov esi, 0x14
jmp 0x40979f
cmp eax, 0xfffffffd
jne 0x409790
lea esi, [eax + 0x2f]
jmp 0x40979f
mov ecx, 0xa
mov esi, 0x14
cmp eax, ecx
cmove esi, ecx
mov ecx, edi
call fcn.004110d0
cmp esi, 0x15
je 0x409831
push 0x1e
push dword [ebp - 0x2088]
push str.0000_0000_0000_0000_0000
call fcn.00417a82
add esp, 0xc
test eax, eax
je 0x409831
mov dword [ebp - 0x7b4], 0x418
lea eax, [ebp - 0x7ac]
mov dword [ebp - 0x7b0], 0xc0001b58
cmp esi, 0xa
jne 0x4097ec
push 0
push esi
jmp 0x4097f3
push dword [ebp - 0x1644]
push esi
push str._d:_d
push 0x104
push eax
call fcn.00401280
add esp, 0x14
call fcn.004053d0
push eax
push 0x42de44
lea eax, [ebp - 0x5a4]
push 0x104
push eax
call fcn.00401280
lea eax, [ebp - 0x7b4]
push eax
call sub.GIDBIN1.dll_GIDSDKAddEvent
add esp, 0x14
lea ecx, [ebp - 0x39c]
mov dword [ebp - 4], 0xffffffff
call fcn.00411760
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00416230
mov esp, ebp
pop ebp
ret 8