Function at 0x403e6c
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4331fa
call fcn.004269c8
sub esp, 0x27c
mov eax, dword [0x44de90]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, str.CLSID
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x434bec
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, str.InprocServer
lea edi, [ebp - 0x4c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
lea edi, [ebp - 0x3e]
stosw word es:[edi], ax
mov esi, str.LocalServer
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2f]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, str.LocalServer32
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp - 0x1d]
stosb byte es:[edi], al
lea eax, [ebp - 0x268]
push eax
xor ebx, ebx
push 0x2001f
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x80000000
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x278], ebx
mov dword [ebp - 4], ebx
call dword [0x451e18]
cmp eax, ebx
jne 0x404094
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x270], ebx
lea eax, [ebp - 0x288]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x160]
push eax
push dword [ebp - 0x270]
mov dword [ebp - 0x27c], 0x104
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x404094
cmp eax, ebx
je 0x403f7a
cmp dword [ebp - 0x274], 5
jg 0x404094
inc dword [ebp - 0x274]
inc dword [ebp - 0x270]
jmp 0x403f1c
lea eax, [ebp - 0x160]
push 1
push eax
call fcn.0041a768
pop ecx
pop ecx
lea eax, [ebp - 0x160]
push eax
call fcn.00425700
pop ecx
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x26c], ebx
cmp dword [ebp - 0x26c], 4
jae 0x403f72
mov eax, dword [ebp - 0x26c]
shl eax, 4
lea eax, [ebp + eax - 0x5c]
push eax
mov eax, dword [ebp - 0x280]
lea eax, [ebp + eax - 0x160]
push eax
call fcn.00425600
lea eax, [ebp - 0x160]
push 1
push eax
call fcn.0041a768
add esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 0x160]
push 1
push 1
push dword [ebp + 8]
push 0x4349c5
push eax
push dword [ebp - 0x268]
call fcn.0041aa5e
add esp, 0x1c
cmp al, bl
je 0x404068
push 6
pop ecx
mov esi, str.HKEY_CLASSES_ROOTCLSID_
lea edi, [ebp - 0x264]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x3a
xor eax, eax
pop ecx
lea edi, [ebp - 0x24b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00425610
push dword [ebp + 0xc]
lea eax, [ebp - 0x264]
push str._Default_value_
push eax
push str.system_registry
push dword [ebp + 8]
push str._s_tStartUp_link_in__s_restored_to_default_value___s__new_value__s_s__n
call fcn.00419ab0
add esp, 0x20
mov dword [ebp - 0x278], 4
inc dword [ebp - 0x26c]
jmp 0x403fa3
cmp dword [ebp - 0x268], ebx
je 0x4040a8
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x278]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret