Function at 0x407f9e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2062c
call fcn.004664c0
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
push 0x400
mov dword [0x491f78], ebx
mov dword [0x491f7c], eax
mov dword [0x491f80], ebx
mov dword [0x491f84], ebx
mov dword [0x491f88], ebx
mov dword [0x491f8c], ebx
mov dword [0x491f90], 0x46e8e8
mov dword [0x491f94], ebx
mov dword [0x491f98], ebx
mov dword [0x491f9c], ebx
mov dword [0x491fa0], 0x46e8e8
mov dword [0x491fa4], ebx
mov dword [0x491fa8], ebx
mov dword [0x491fac], ebx
mov dword [0x491fb4], ebx
mov dword [0x491fbc], ebx
mov dword [0x491fc0], 0x66
call fcn.00455447
pop ecx
mov dword [0x491fb0], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0045787e
push esi
lea eax, [ebp - 0x424]
push str.Include
push eax
call fcn.004578ca
push ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0045790e
mov edi, 0x20a
push edi
call fcn.00455447
mov ecx, dword [0x491fb0]
mov edx, dword [0x491fb4]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x491fb4]
mov eax, dword [0x491fb0]
mov eax, dword [eax + ecx*4]
inc dword [0x491fb4]
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.004553d7
add esp, 0x40
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareAutoIt_v3AutoIt
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408212
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2062c]
push eax
push ebx
push ebx
push str.Include
push dword [ebp - 8]
mov dword [ebp + 8], 0x1fffe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408209
shr dword [ebp + 8], 1
mov eax, dword [ebp + 8]
add eax, eax
xor ecx, ecx
mov word [ebp + eax - 0x2062c], cx
mov word [ebp + eax - 0x2062a], cx
xor eax, eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x2062c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
xor ecx, ecx
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], cx
cmp ax, bx
je 0x408179
cmp eax, 0x3b
je 0x408179
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004553a6
pop ecx
pop ecx
jmp 0x408200
lea eax, [ebp - 0x218]
push eax
call fcn.00455031
pop ecx
test eax, eax
je 0x4081b5
lea eax, [ebp - 0x218]
push eax
call fcn.00455031
cmp word [ebp + eax*2 - 0x21a], 0x5c
pop ecx
je 0x4081b5
lea eax, [ebp - 0x218]
push 0x46e4c0
push eax
call fcn.004553a6
pop ecx
pop ecx
push edi
call fcn.00455447
mov ecx, dword [0x491fb0]
mov edx, dword [0x491fb4]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x491fb4]
mov eax, dword [0x491fb0]
mov eax, dword [eax + ecx*4]
inc dword [0x491fb4]
push esi
lea ecx, [ebp - 0x218]
push ecx
push eax
call fcn.00456e2a
xor eax, eax
mov word [ebp - 0x218], ax
mov eax, dword [ebp - 4]
add esp, 0x10
cmp word [eax], bx
je 0x408209
add dword [ebp - 4], 2
jmp 0x408148
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 0x491f78
pop ebx
leave
ret 4