Function at 0x409e30
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44477a
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x4564c4]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4564c4]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov dword [esp + 0x14c], 0
mov eax, dword [esp + 0x154]
push 0x44b9af
push eax
call fcn.0042f58c
add esp, 8
test eax, eax
setne al
test al, al
je 0x40a6a2
xor edi, edi
mov dword [esp + 0x1c], edi
push 0x103
lea ecx, [esp + 0x41]
push edi
mov byte [esp + 0x154], 1
push ecx
mov byte [esp + 0x48], 0
call fcn.00431520
mov ecx, dword [0x45a558]
add esp, 0xc
lea edx, [esp + 0x38]
push edx
mov edx, dword [0x457a90]
lea eax, [esp + 0x1c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push ecx
push edx
mov dword [esp + 0x3c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x409ef5
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
push 0x44b9af
lea ecx, [esp + 0x28]
call fcn.00403330
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov byte [esp + 0x14c], 3
xor ebp, ebp
push ebp
lea ecx, [esp + 0x28]
push str.kd_02d
push ecx
call fcn.004033f0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x3c]
push ecx
push edi
push edx
push eax
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x40a089
mov eax, dword [esp + 0x34]
cmp eax, 1
je 0x409f6e
cmp eax, 2
jne 0x40a089
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x409f83
cmp byte [esp + eax + 0x3b], 0
jne 0x40a089
jmp 0x409f88
mov byte [esp + 0x3c], 0
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00403330
mov bl, 4
mov byte [esp + 0x14c], bl
mov eax, dword [esp + 0x14]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x3c], esp
mov esi, esp
push eax
call fcn.00403490
add esp, 4
lea edx, [esp + 0x24]
add eax, 0x10
push edx
mov dword [esi], eax
call fcn.00405cd0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x150], 5
call fcn.00403410
mov byte [esp + 0x14c], bl
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409ffe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00407350
cmp eax, edi
jne 0x40a010
xor ecx, ecx
jmp 0x40a020
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x40a015
sub ecx, esi
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00401760
mov edx, dword [esp + 0x14]
push 0x44b9af
push edx
call fcn.0042f58c
add esp, 8
cmp eax, edi
setne al
test al, al
je 0x40a055
lea ebx, [esp + 0x14]
lea esi, [esp + 0x28]
call fcn.0040f3a0
xor edi, edi
mov byte [esp + 0x14c], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a07d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 1
cmp ebp, 0xa
jl 0x409f19
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
xor esi, esi
cmp ebp, edi
mov edi, dword [esp + 0x154]
jle 0x40a0d4
mov edi, edi
test esi, esi
jl 0x40a0f8
cmp esi, ebp
jge 0x40a0f8
mov eax, dword [ebx + esi*4]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40a0ee
push eax
push edi
call fcn.0042f58c
add esp, 8
test eax, eax
sete al
test al, al
jne 0x40a20d
add esi, 1
cmp esi, ebp
jl 0x40a0a0
mov eax, dword [esp + 0x30]
cmp ebp, eax
jne 0x40a148
lea ecx, [esp + 0x154]
cmp ecx, ebx
jb 0x40a109
lea edx, [ebx + eax*4]
cmp ecx, edx
jae 0x40a109
push 0x80004005
call fcn.00401520
push 0
push 0
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
test eax, eax
jne 0x40a112
lea esi, [eax + 1]
jmp 0x40a12a
lea esi, [ebp + ebp]
test esi, esi
jl 0x40a1ca
cmp esi, 0x1fffffff
ja 0x40a1ca
push 4
push esi
push ebx
call fcn.0042f324
add esp, 0xc
test eax, eax
je 0x40a1ca
mov ebx, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], ebx
lea eax, [ebx + ebp*4]
test eax, eax
mov byte [esp + 0x14c], 6
je 0x40a1bb
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
lea esi, [edi - 0x10]
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40a17e
cmp eax, dword [esi]
jne 0x40a17e
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40a1b5
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x40a197
call fcn.00401670
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
add eax, 1
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0042daa5
add esp, 0x10
add edi, 0x10
mov dword [ebx + ebp*4], edi
add ebp, 1
mov byte [esp + 0x14c], 3
mov dword [esp + 0x2c], ebp
cmp ebp, 0xb
jne 0x40a20d
mov eax, dword [ebx]
sub eax, 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a1ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x28
lea eax, [ebx + 4]
push eax
push 0x2c
push ebx
call fcn.0042db20
push eax
call fcn.00403240
mov ebp, 0xa
add esp, 0x14
mov dword [esp + 0x2c], ebp
test ebp, ebp
mov dword [esp + 0x18], 0
jle 0x40a614
lea ecx, [ecx]
mov esi, dword [esp + 0x18]
push esi
lea ecx, [esp + 0x28]
push str.kd_02d
push ecx
call fcn.004033f0
add esp, 0xc
test esi, esi
jl 0x40a0f8
cmp esi, dword [esp + 0x2c]
jge 0x40a0f8
mov edx, dword [esp + 0x28]
mov esi, dword [edx + esi*4]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
sub esi, 0x10
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x40a277
cmp eax, dword [esi]
jne 0x40a277
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x40a2ad
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40a192
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
add eax, 1
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0042daa5
add esp, 0x10
lea esi, [edi + 0x10]
mov dword [esp + 0x14], esi
push esi
mov byte [esp + 0x150], 7
call fcn.004080d0
mov ebp, eax
test ebp, ebp
je 0x40a2dd
mov edi, ebp
lea ecx, [edi + 1]
lea ecx, [ecx]
mov al, byte [edi]
add edi, 1
test al, al
jne 0x40a2d0
sub edi, ecx
jne 0x40a337
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40a397
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40a30f
cmp dword [esi - 8], 0
jl 0x40a6fa
mov dword [esi - 0xc], 0
mov byte [esi], 0
jmp 0x40a397
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a325
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
jmp 0x40a397
mov ecx, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov dword [esp + 0x20], ecx
mov ecx, 1
sub ecx, dword [esi - 4]
mov ebx, ebp
sub eax, edi
sub ebx, esi
or eax, ecx
jge 0x40a361
push edi
lea ecx, [esp + 0x18]
call fcn.004015a0
mov esi, dword [esp + 0x14]
cmp ebx, dword [esp + 0x20]
push edi
ja 0x40a374
add ebx, esi
push ebx
push edi
push esi
call fcn.0042db20
jmp 0x40a37c
push ebp
push edi
push esi
call fcn.0042daa5
add esp, 0x10
test edi, edi
jl 0x40a6fa
cmp edi, dword [esi - 8]
jg 0x40a6fa
mov dword [esi - 0xc], edi
mov byte [edi + esi], 0
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
lea edi, [esi - 0x10]
mov dword [esp + 0x24], esp
mov ebp, esp
call eax
cmp dword [edi + 0xc], 0
lea ecx, [edi + 0xc]
jl 0x40a3c5
cmp eax, dword [edi]
jne 0x40a3c5
mov ebx, edi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40a3fb
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov ebx, eax
test ebx, ebx
je 0x40a192
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 4]
add eax, 1
push eax
lea ecx, [edi + 0x10]
push ecx
push eax
lea edx, [ebx + 0x10]
push edx
call fcn.0042daa5
add esp, 0x10
lea eax, [esp + 0x3c]
add ebx, 0x10
push eax
mov dword [ebp], ebx
call fcn.00405cd0
mov byte [esp + 0x14c], 8
mov eax, dword [eax]
lea ebx, [eax - 0x10]
cmp ebx, edi
mov dword [esp + 0x34], eax
je 0x40a57c
cmp dword [edi + 0xc], 0
lea ebp, [edi + 0xc]
jl 0x40a4b1
mov ecx, dword [ebx]
cmp ecx, dword [edi]
jne 0x40a4b1
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
cmp dword [ebx + 0xc], 0
lea ecx, [ebx + 0xc]
jl 0x40a458
cmp eax, dword [ebx]
jne 0x40a458
mov esi, ebx
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x40a48e
mov ecx, dword [ebx + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x40a192
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 4]
add eax, 1
push eax
add ebx, 0x10
push ebx
push eax
lea ecx, [esi + 0x10]
push ecx
call fcn.0042daa5
add esp, 0x10
or edx, 0xffffffff
lock xadd dword [ebp], edx
dec edx
test edx, edx
jg 0x40a4a5
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
add esi, 0x10
mov dword [esp + 0x14], esi
jmp 0x40a57c
mov ebx, dword [eax - 0xc]
test ebx, ebx
jne 0x40a50e
cmp dword [edi + 4], 0
mov ebx, dword [edi]
je 0x40a57c
cmp dword [edi + 0xc], 0
lea eax, [edi + 0xc]
jge 0x40a4e6
cmp dword [esi - 8], 0
jl 0x40a6fa
mov dword [esi - 0xc], 0
mov byte [esi], 0
jmp 0x40a57c
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40a4fc
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
jmp 0x40a57c
test eax, eax
je 0x40a6fa
mov ebp, dword [esp + 0x34]
mov ecx, dword [esi - 0xc]
mov eax, 1
sub eax, dword [edi + 0xc]
mov edi, dword [edi + 8]
sub edi, ebx
sub ebp, esi
or edi, eax
mov dword [esp + 0x20], ecx
jge 0x40a542
push ebx
lea ecx, [esp + 0x18]
call fcn.004015a0
mov esi, dword [esp + 0x14]
cmp ebp, dword [esp + 0x20]
push ebx
ja 0x40a555
add ebp, esi
push ebp
push ebx
push esi
call fcn.0042db20
jmp 0x40a561
mov edx, dword [esp + 0x38]
push edx
push ebx
push esi
call fcn.0042daa5
add esp, 0x10
test ebx, ebx
jl 0x40a6fa
cmp ebx, dword [esi - 8]
jg 0x40a6fa
mov dword [esi - 0xc], ebx
mov byte [ebx + esi], 0
mov byte [esp + 0x14c], 7
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a5a4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x24]
xor eax, eax
test esi, esi
setne al
test eax, eax
je 0x40a0ee
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x1c]
add eax, 1
push eax
push esi
push 1
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esi, 0xfffffff0
mov byte [esp + 0x14c], 3
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40a5f7
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
jl 0x40a220
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
test esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40a62b
push esi
call edi
xor esi, esi
mov dword [esp + 0x1c], esi
test ebx, ebx
mov byte [esp + 0x14c], 2
je 0x40a673
xor esi, esi
test ebp, ebp
jle 0x40a666
lea ecx, [ecx]
mov eax, dword [ebx + esi*4]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a65f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 1
cmp esi, ebp
jl 0x40a640
push ebx
call fcn.0042dbcf
mov esi, dword [esp + 0x20]
add esp, 4
mov byte [esp + 0x14c], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a69b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x40a6a2
push esi
call edi
mov dword [esp + 0x14c], 0xffffffff
mov eax, dword [esp + 0x154]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a6d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.0042dbc0
add esp, 0x13c
ret 4
push 0x80070057
call fcn.00401520
int3