Function at 0x404bcf
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412541
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x437c
call fcn.00408950
mov eax, dword [0x4180b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x4348], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4350], esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x4374], edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x434c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4344], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4364], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4360], eax
xor ebx, ebx
mov byte [ebp - 0x218], bl
push 0x103
push ebx
lea eax, [ebp - 0x217]
push eax
call fcn.00408670
add esp, 0xc
mov dword [ebp - 0x4370], 0x104
mov dword [ebp - 0x4340], ebx
mov dword [ebp - 0x435c], 0x3fff
lea eax, [ebp - 0x4384]
push eax
lea eax, [ebp - 0x4378]
push eax
lea eax, [ebp - 0x4354]
push eax
lea eax, [ebp - 0x438c]
push eax
lea eax, [ebp - 0x4358]
push eax
lea eax, [ebp - 0x4388]
push eax
lea eax, [ebp - 0x437c]
push eax
lea eax, [ebp - 0x4340]
push eax
push ebx
lea eax, [ebp - 0x4370]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x4340], ebx
je 0x404d88
mov dword [ebp - 0x433c], ebx
jbe 0x404d88
mov dword [ebp - 0x436c], 0xff
lea eax, [ebp - 0x4384]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x436c]
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp - 0x433c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x404d70
lea eax, [ebp - 0x114]
push eax
call fcn.00407b40
lea eax, [ebp - 0x114]
push eax
call fcn.00407b40
pop ecx
pop ecx
lea eax, [ebp - 0x4334]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x114]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 0x4360]
push dword [ebp - 0x4364]
push dword [ebp - 0x4344]
push dword [ebp - 0x434c]
push edi
push dword [ebp - 0x4334]
mov ecx, dword [ebp - 0x4348]
call fcn.00404bcf
inc dword [ebp - 0x433c]
mov eax, dword [ebp - 0x433c]
cmp eax, dword [ebp - 0x4340]
jb 0x404cde
cmp dword [ebp - 0x4358], ebx
je 0x405379
mov dword [ebp - 0x433c], ebx
mov esi, 0x4139ec
mov edi, str.Prod_
mov eax, dword [ebp - 0x4358]
cmp dword [ebp - 0x433c], eax
jae 0x405379
push dword [ebp - 0x4354]
call fcn.00405f94
pop ecx
mov dword [ebp - 0x4334], eax
mov dword [ebp - 0x435c], 0x3fff
mov byte [ebp - 0x4218], bl
lea ecx, [ebp - 0x4354]
push ecx
push eax
push ebx
push ebx
lea eax, [ebp - 0x435c]
push eax
lea eax, [ebp - 0x4218]
push eax
push dword [ebp - 0x433c]
push dword [ebp - 0x4350]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, ebx
jne 0x40536e
push str.SymbolicLink
lea eax, [ebp - 0x4218]
push eax
call fcn.004087c0
pop ecx
pop ecx
test eax, eax
jne 0x4052fc
push dword [ebp - 0x4334]
lea ecx, [ebp - 0x4234]
call fcn.00401d45
mov dword [ebp - 4], ebx
push str.Ven_Seagate
call fcn.00407b40
pop ecx
push eax
push ebx
push str.Ven_Seagate
lea ecx, [ebp - 0x4234]
call fcn.004042a7
cmp eax, 0xffffffff
jne 0x404e81
push str.Ven_Maxtor
call fcn.00407b40
pop ecx
push eax
push ebx
push str.Ven_Maxtor
lea ecx, [ebp - 0x4234]
call fcn.004042a7
cmp eax, 0xffffffff
je 0x4052ea
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x4224]
mov dword [ebp - 0x4334], eax
push esi
call fcn.00407b40
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x4234]
call fcn.00404334
mov dword [ebp - 0x4338], eax
push esi
call fcn.00407b40
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x4234]
call fcn.00404334
mov ecx, dword [ebp - 0x4334]
mov edx, dword [ebp - 0x4338]
lea ecx, [ecx + edx + 1]
push ecx
inc eax
push eax
lea eax, [ebp - 0x42c0]
push eax
lea ecx, [ebp - 0x4234]
call fcn.0040465f
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x4234]
call fcn.004046a3
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x42c0]
call fcn.004014f7
mov eax, dword [ebp - 0x4224]
mov dword [ebp - 0x4338], eax
push esi
call fcn.00407b40
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x4234]
call fcn.00404334
mov dword [ebp - 0x4334], eax
push esi
call fcn.00407b40
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x4234]
call fcn.00404334
mov ecx, dword [ebp - 0x4338]
sub ecx, dword [ebp - 0x4334]
push ecx
inc eax
push eax
lea eax, [ebp - 0x4288]
push eax
lea ecx, [ebp - 0x4234]
call fcn.0040465f
mov byte [ebp - 4], 3
push esi
call fcn.00407b40
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x4288]
call fcn.00404334
push eax
push ebx
lea eax, [ebp - 0x4330]
push eax
lea ecx, [ebp - 0x4288]
call fcn.0040465f
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x4288]
call fcn.004046a3
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x4330]
call fcn.004014f7
lea eax, [ebp - 0x4288]
push eax
mov ecx, dword [ebp - 0x4348]
call fcn.00404802
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4288]
push eax
mov ecx, dword [ebp - 0x434c]
call fcn.00401baa
push edi
call fcn.00407b40
pop ecx
push eax
push ebx
push edi
lea ecx, [ebp - 0x4234]
call fcn.004042a7
cmp eax, 0xffffffff
je 0x405127
mov eax, dword [ebp - 0x4224]
mov dword [ebp - 0x4338], eax
push edi
call fcn.00407b40
pop ecx
push eax
push ebx
push edi
lea ecx, [ebp - 0x4234]
call fcn.004042a7
mov dword [ebp - 0x4334], eax
push edi
call fcn.00407b40
pop ecx
push eax
push ebx
push edi
lea ecx, [ebp - 0x4234]
call fcn.004042a7
mov ecx, dword [ebp - 0x4338]
sub ecx, dword [ebp - 0x4334]
push ecx
push eax
lea eax, [ebp - 0x4250]
push eax
lea ecx, [ebp - 0x4234]
call fcn.0040465f
mov byte [ebp - 4], 5
push 0x413944
call fcn.00407b40
pop ecx
push eax
push ebx
push 0x413944
lea ecx, [ebp - 0x4250]
call fcn.00404334
push eax
push ebx
lea eax, [ebp - 0x42f8]
push eax
lea ecx, [ebp - 0x4250]
call fcn.0040465f
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x4250]
call fcn.004046a3
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x42f8]
call fcn.004014f7
mov eax, dword [ebp - 0x4240]
add eax, 0xfffffffb
push eax
push 5
lea eax, [ebp - 0x42a4]
push eax
lea ecx, [ebp - 0x4250]
call fcn.0040465f
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x4250]
call fcn.004046a3
mov byte [ebp - 4], 5
push ebx
push 1
lea ecx, [ebp - 0x42a4]
call fcn.004014f7
lea eax, [ebp - 0x4250]
push eax
mov ecx, dword [ebp - 0x4348]
call fcn.0040449a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x4250]
push eax
mov ecx, dword [ebp - 0x4374]
call fcn.00401baa
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x4250]
call fcn.004014f7
jmp 0x405143
push str.Unknown
call fcn.00407b40
pop ecx
push eax
push str.Unknown
mov ecx, dword [ebp - 0x4344]
call fcn.0040456e
push str.Rev_
call fcn.00407b40
pop ecx
push eax
push ebx
push str.Rev_
lea ecx, [ebp - 0x4234]
call fcn.004042a7
cmp eax, 0xffffffff
je 0x40528d
mov eax, dword [ebp - 0x4224]
mov dword [ebp - 0x4338], eax
push str.Rev_
call fcn.00407b40
pop ecx
push eax
push ebx
push str.Rev_
lea ecx, [ebp - 0x4234]
call fcn.004042a7
mov dword [ebp - 0x4334], eax
push str.Rev_
call fcn.00407b40
pop ecx
push eax
push ebx
push str.Rev_
lea ecx, [ebp - 0x4234]
call fcn.004042a7
mov ecx, dword [ebp - 0x4338]
sub ecx, dword [ebp - 0x4334]
push ecx
push eax
lea eax, [ebp - 0x426c]
push eax
lea ecx, [ebp - 0x4234]
call fcn.0040465f
mov byte [ebp - 4], 8
push esi
call fcn.00407b40
pop ecx
push eax
push ebx
push esi
lea ecx, [ebp - 0x426c]
call fcn.00404334
push eax
push ebx
lea eax, [ebp - 0x42dc]
push eax
lea ecx, [ebp - 0x426c]
call fcn.0040465f
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x426c]
call fcn.004046a3
mov byte [ebp - 4], 8
push ebx
push 1
lea ecx, [ebp - 0x42dc]
call fcn.004014f7
mov eax, dword [ebp - 0x425c]
add eax, 0xfffffffc
push eax
push 4
lea eax, [ebp - 0x4314]
push eax
lea ecx, [ebp - 0x426c]
call fcn.0040465f
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x426c]
call fcn.004046a3
mov byte [ebp - 4], 8
push ebx
push 1
lea ecx, [ebp - 0x4314]
call fcn.004014f7
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x426c]
push eax
mov ecx, dword [ebp - 0x4344]
call fcn.00401baa
mov byte [ebp - 4], 3
push ebx
push 1
lea ecx, [ebp - 0x426c]
call fcn.004014f7
jmp 0x4052a9
push str.Unknown
call fcn.00407b40
pop ecx
push eax
push str.Unknown
mov ecx, dword [ebp - 0x4344]
call fcn.0040456e
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x4288]
call fcn.004014f7
mov dword [ebp - 4], ebx
jmp 0x4052ea
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x4234]
call fcn.004014f7
push 0x413948
lea eax, [ebp - 0x4218]
push eax
call fcn.004087c0
pop ecx
pop ecx
test eax, eax
jne 0x40536e
mov eax, dword [ebp - 0x4360]
mov byte [eax], 1
mov dword [ebp - 0x4334], ebx
push 4
pop eax
mov dword [ebp - 0x4338], eax
mov dword [ebp - 0x4368], eax
lea eax, [ebp - 0x4338]
push eax
lea eax, [ebp - 0x4334]
push eax
lea eax, [ebp - 0x4368]
push eax
push ebx
push 0x413948
push dword [ebp - 0x4350]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40536e
cmp dword [ebp - 0x4334], 1
jne 0x40536e
mov eax, dword [ebp - 0x4364]
mov byte [eax], 1
inc dword [ebp - 0x433c]
jmp 0x404da4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004064be
leave
ret 0x18