Function at 0x4074a0
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x45c
call fcn.0042b3c0
test eax, eax
jle 0x4074dc
mov eax, dword [0x45b0dc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc6
mov dword [esp + 4], 7
mov dword [esp], eax
call dword [sym.imp.USER32.dll_SetTimer]
sub esp, 0x10
lea eax, [esp + 0x40]
mov dword [esp], 0x80000002
xor esi, esi
mov dword [esp + 0x10], eax
mov eax, dword [0x452484]
mov dword [esp + 0xc], 0x20019
add eax, 0x870
mov dword [esp + 8], 0
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x407528
add esp, 0x45c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x44]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
sub esp, 0x30
mov ebx, eax
test eax, eax
jne 0x40763c
mov esi, dword [esp + 0x44]
test esi, esi
je 0x40763c
xor esi, esi
lea edi, [esp + 0x250]
mov dword [esp + 0x34], esi
jmp 0x4075c1
add ebx, 1
cmp ebx, dword [esp + 0x44]
jae 0x407638
xor eax, eax
mov dword [esp + 0x48], 0x100
mov word [esp + 0x250], ax
xor eax, eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x48]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x50]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x4c], 0x200
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
mov ebp, eax
test eax, eax
jne 0x4075b8
cmp word [esp + 0x250], 0
je 0x4075b8
jmp 0x40766c
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
sub esp, 4
add esp, 0x45c
pop ebx
pop esi
pop edi
pop ebp
ret
add ebp, 1
cmp ebp, 8
je 0x4075b8
mov eax, dword [ebp*4 + 0x45ae60]
test eax, eax
je 0x407660
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407660
mov dword [esp + 0x38], eax
mov ebp, 0x4527c0
xor esi, esi
mov dword [esp + 4], ebp
mov dword [esp], edi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4075b8
add esi, 1
add ebp, 0xa48
cmp esi, 6
jne 0x407692
cmp word [0x4527c0], 0
mov edx, dword [esp + 0x38]
je 0x40770d
cmp word [0x453208], 0
je 0x4077eb
cmp word [0x453c50], 0
je 0x4077e1
cmp word [0x454698], 0
je 0x4077d7
cmp word [0x4550e0], 0
je 0x4077cd
cmp word [0x455b28], 0
mov edx, 5
jne 0x4075b8
imul ecx, edx, 0xa48
mov dword [esp + 0x38], edx
mov dword [esp + 0xc], 0x200
mov dword [esp + 8], edi
lea ebp, [ecx + 0x4527c0]
mov dword [esp + 0x3c], ecx
mov dword [esp + 4], 0x200
mov dword [esp], ebp
call dword [0x42e308]
mov edx, dword [esp + 0x38]
mov dword [ebp + 0x200], 0
mov dword [esp], edx
call fcn.00407040
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
test eax, eax
jne 0x407776
xor eax, eax
add dword [esp + 0x34], 0x10000
mov word [ecx + 0x4527c0], ax
jmp 0x4075b8
xor ecx, ecx
add dword [esp + 0x34], 0x10001
xor esi, esi
mov dword [ebp + 0x244], ecx
mov dword [esp], edx
mov dword [esp + 4], 0x10
call fcn.00407320
mov edx, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x4095b0
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 0x208], eax
sub esp, 0x18
jmp 0x4075b8
mov edx, 4
jmp 0x40770d
mov edx, 3
jmp 0x40770d
mov edx, 2
jmp 0x40770d
mov edx, 1
jmp 0x40770d