Function at 0x4095a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0xc], 0xe2d6
mov dword [ebp - 4], 0x1455b
mov dword [ebp - 0x30], 0x154e0
mov dword [ebp - 0x3c], 0x1e8e
mov dword [ebp - 0x68], 0x3c4a
mov dword [ebp - 0x58], 0x12c6b
mov dword [ebp - 0x74], 0x18042
mov dword [ebp - 8], 0x15289
mov dword [ebp - 0x54], 0x2d1
mov dword [ebp - 0x6c], 0x5ba2
mov dword [ebp - 0x24], 0x95a1
mov dword [ebp - 0x18], 0x9d7c
mov dword [ebp - 0x20], 0x8c69
mov dword [ebp - 0x38], 0xc73d
mov dword [ebp - 0x1c], 0x10e6f
mov dword [ebp - 0x14], 0xca84
mov dword [ebp - 0x78], 0x1627c
mov dword [ebp - 0x2c], 0xa43c
mov dword [ebp - 0x80], 0xfdc6
mov dword [ebp - 0x10], 0x10eac
mov dword [ebp - 0x48], 0xbcbe
mov dword [ebp - 0x84], 0x934c
mov dword [ebp - 0x34], 0x1358b
mov dword [ebp - 0x70], 0x1081b
mov eax, dword [ebp - 0x68]
or eax, dword [ebp - 0x10]
je 0x4096a0
mov ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 0x1c]
jge 0x40966d
mov dword [ebp - 0x40], 1
jmp 0x409674
mov dword [ebp - 0x40], 0
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x3c]
jge 0x409685
mov dword [ebp - 0x44], 1
jmp 0x40968c
mov dword [ebp - 0x44], 0
mov eax, dword [ebp + 0x10]
or eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x44]
je 0x4096a0
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 8]
add edx, 0x1c33
push edx
mov eax, dword [ebp - 0x18]
add eax, 0xd375
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x10c72
push ecx
call fcn.004063c0
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, 0x83f0
push edx
call fcn.00410820
add esp, 4
mov dword [ebp - 0x28], 0
jmp 0x4096e9
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x74]
sub ecx, 0x18041
cmp dword [ebp - 0x28], ecx
jge 0x409961
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jge 0x40995c
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 4]
jne 0x40995c
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x48]
jne 0x40995c
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x48]
jne 0x40995c
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x1c]
jge 0x40995c
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 8]
jne 0x40995c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x40995c
push 0x210d
push 0xdddc
push 0x3402
push 0x55b8
push 0x79d9
push 0xec19
push 0x6c38
push 0xbe5
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x20
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x78]
cmp edx, dword [ebp - 0x2c]
jge 0x4097a3
mov dword [ebp - 0x4c], 1
jmp 0x4097aa
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jge 0x4097bb
mov dword [ebp - 0x50], 1
jmp 0x4097c2
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x14]
and ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x4c]
and ecx, dword [ebp - 0x50]
je 0x40994e
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp + 0xc]
jne 0x40994e
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x6c]
jne 0x40994e
push 0x9761
push 0x4043
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
add esp, 8
mov ecx, dword [ebp - 0x18]
xor ecx, dword [ebp - 0x30]
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x7c], 0
je 0x409931
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x58]
jne 0x409931
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 0x1c]
jne 0x409931
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 8]
jne 0x409931
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x20]
jne 0x409931
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 4]
jne 0x409931
mov edx, dword [ebp - 0x58]
cmp edx, dword [ebp - 0x20]
jge 0x409868
mov dword [ebp - 0x5c], 1
jmp 0x40986f
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp + 8]
sub eax, 1
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jge 0x409889
mov dword [ebp - 0x60], 1
jmp 0x409890
mov dword [ebp - 0x60], 0
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0xc]
jge 0x4098a1
mov dword [ebp - 0x64], 1
jmp 0x4098a8
mov dword [ebp - 0x64], 0
mov eax, dword [ebp - 0x5c]
and eax, dword [ebp - 0x60]
or eax, dword [ebp - 0x64]
je 0x409931
mov ecx, dword [ebp - 0x68]
imul ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x409931
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp + 8]
jne 0x409931
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x80]
jne 0x409931
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [ebp - 4]
jne 0x409931
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x70]
jne 0x409931
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x10]
jne 0x409931
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x14]
jge 0x409900
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
push 0xb52b
push 0x15a5b
push 0x406
push 0x5652
push 0x9fd0
push 0xa8a5
push 0x440c
push 0x6b2c
call dword [sym.imp.KERNEL32.dll_FindResourceA]
add esp, 0x20
push 0x161c9
push 0x9a4f
push 0x2ab6
push 0xddd1
call dword [sym.imp.KERNEL32.dll_Process32First]
add esp, 0x10
push 0x2a87
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
add esp, 4
jmp 0x4096e0
mov esp, ebp
pop ebp
ret