Function at 0x404dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x734
mov dword [esp + 0x72c], eax
call fcn.00422fe0
lea eax, [esp + 0x478]
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxM7F3dmK5P726d_Y2M_E3vzP2NnDxcT248fLzcK7MPGz4rv0s_J397DxcSK5drew8XE2fbZx8vZz4T1zsbG1A
call fcn.004224a0
mov edi, eax
lea eax, [esp + 0x578]
mov edx, str.69rGw8nL3sPFxO3FxQ
call fcn.004224a0
mov ebx, eax
mov dword [esp + 0x728], 0x20
call fcn.00422e10
test eax, eax
je 0x4051ce
mov ecx, dword [esp + 0x728]
mov dword [esp + 0x14], 0x542830
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, edi
lea esi, [esp + 0x702]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
mov ecx, ebx
call fcn.00405390
lea eax, [esp + 0x578]
mov edx, str.6cLB69ra4s_G2g
call fcn.004224a0
mov ebx, eax
mov dword [esp + 0x730], 0x27
call fcn.00422e10
test eax, eax
je 0x405178
mov edi, dword [esp + 0x730]
mov dword [esp + 0x14], 0x542830
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
lea esi, [esp + 0x6db]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
lea edx, [esp + 0x478]
call fcn.00405390
movsx eax, byte [esp + 0x702]
test eax, eax
je 0x404eb9
movsx eax, byte [esp + 0x6db]
test eax, eax
jne 0x404ec8
xor eax, eax
add esp, 0x734
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
movsd xmm0, qword [0x53eb60]
movsd qword [esp + 0x6d0], xmm0
movzx esi, word [0x53eb68]
mov word [esp + 0x6d8], si
mov al, byte [0x53eb6a]
mov byte [esp + 0x6da], al
pxor xmm0, xmm0
movaps xmmword [esp + 0x6c0], xmm0
lea eax, [esp + 0x420]
call fcn.004252d0
lea eax, [esp + 0x420]
mov edx, str.0420
mov ecx, 4
call fcn.00401c90
lea eax, [esp + 0x420]
lea edx, [esp + 0x6d0]
mov ecx, 0xb
call fcn.00401c90
lea eax, [esp + 0x420]
mov edx, str.0420
mov ecx, 4
call fcn.00401c90
lea edx, [esp + 0x702]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x404f7b
mov eax, edx
add edx, ecx
call fcn.00425520
lea edx, [esp + 0x702]
mov ecx, eax
lea eax, [esp + 0x420]
call fcn.00401c90
lea eax, [esp + 0x6c0]
lea edx, [esp + 0x420]
call fcn.00408c90
movzx edi, byte [esp + 0x6ca]
movzx esi, byte [esp + 0x6cb]
movzx ebx, byte [esp + 0x6cc]
movzx ecx, byte [esp + 0x6cd]
movzx edx, byte [esp + 0x6ce]
movzx eax, byte [esp + 0x6cf]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x6e1]
push eax
movzx edx, byte [esp + 0x6e4]
push edx
movzx ecx, byte [esp + 0x6e7]
push ecx
movzx ebx, byte [esp + 0x6ea]
push ebx
movzx esi, byte [esp + 0x6ed]
push esi
movzx edi, byte [esp + 0x6f0]
push edi
movzx eax, byte [esp + 0x6f3]
push eax
movzx edx, byte [esp + 0x6f6]
push edx
movzx ecx, byte [esp + 0x6f9]
push ecx
movzx ebx, byte [esp + 0x6fc]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x6d4]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea edi, [esp + 0x690]
lea esi, [esp + 0x6db]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x405077
test dl, dl
je 0x405073
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x405077
add edi, 2
add esi, 2
test dl, dl
jne 0x405057
xor eax, eax
jmp 0x40507c
sbb eax, eax
or eax, 1
test eax, eax
je 0x40508f
xor eax, eax
add esp, 0x734
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
lea edi, [esp + 0x678]
lea esi, [esp + 0x67c]
lea ebx, [esp + 0x680]
lea ecx, [esp + 0x684]
lea edx, [esp + 0x688]
lea eax, [esp + 0x68c]
push eax
push edx
push ecx
push ebx
push esi
push edi
push 0x53fa14
lea eax, [esp + 0x71e]
push eax
call dword [sym.imp.MSVCR80.dll_sscanf]
add esp, 0x20
cmp eax, 6
jne 0x405080
movzx edx, byte [esp + 0x678]
movzx ecx, byte [esp + 0x67c]
movzx eax, byte [esp + 0x680]
movzx ebx, byte [esp + 0x688]
movzx edi, byte [0x56e794]
mov esi, dword [esp + 0x72c]
mov dword [esp + 0x6b8], eax
movzx eax, byte [esp + 0x684]
xor edx, edi
movzx edi, byte [0x56e796]
mov byte [esi], dl
movzx edx, byte [0x56e795]
xor ecx, edx
movzx edx, byte [esp + 0x68c]
mov byte [esi + 1], cl
mov ecx, dword [esp + 0x6b8]
xor ecx, edi
mov byte [esi + 2], cl
movzx ecx, byte [0x56e797]
xor eax, ecx
mov byte [esi + 3], al
movzx eax, byte [0x56e798]
xor ebx, eax
mov byte [esi + 4], bl
mov eax, 6
movzx ebx, byte [0x56e799]
xor edx, ebx
mov byte [esi + 5], dl
add esp, 0x734
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov byte [esp + 0x6db], 0
lea edi, [esp + 0x478]
lea esi, [esp + 0x220]
mov dword [esp + 0x420], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x40521e
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x405195
mov byte [esp + 0x702], 0
lea esi, [esp + 0x20]
mov dword [esp + 0x220], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4052d4
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x4051e1
mov ebx, dword [esp + 0x420]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40524b
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x724]
push eax
push ecx
push 0
lea esi, [esp + 0x22c]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4052c7
lea edx, [esp + 0x6db]
lea eax, [esp + 0x730]
push eax
xor ecx, ecx
push edx
push ecx
push ecx
push ebx
push dword [esp + 0x738]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x724]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x404ea1
mov byte [esp + 0x6db], 0
jmp 0x404ea1
mov ebx, dword [esp + 0x220]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x405301
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x6bc]
push eax
push ecx
push 0
lea esi, [esp + 0x2c]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40537a
lea edx, [esp + 0x702]
lea eax, [esp + 0x728]
push eax
xor ecx, ecx
push edx
push ecx
push ecx
push ebx
push dword [esp + 0x6d0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x6bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x404e45
mov byte [esp + 0x702], 0
jmp 0x404e45