Function at 0x405440
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x517b80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x414]
push ebx
push 0x4e3ad8
push 0x104
push eax
mov dword [ebp - 0x428], 0
call fcn.00404e10
add esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x405818
push ebx
call fcn.00405140
add esp, 4
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x405818
push esi
push edi
mov dword [ebp - 0x424], eax
xor esi, esi
lea eax, [ebp - 0x424]
mov dword [ebp - 0x41c], 0x208
push eax
push 0x4e3cc0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edi, [esi + 1]
test eax, eax
jne 0x40558a
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push 0x4e3d1c
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405519
lea eax, [ebp - 0x20c]
push eax
push 0x4e3d34
call fcn.004aed57
add esp, 8
test eax, eax
cmove esi, edi
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40558a
push dword [0x5170c8]
xor edi, edi
xor esi, esi
call fcn.004059e0
add esp, 4
nop dword [eax + eax]
push 0x4e3de4
call fcn.004059b0
call fcn.004b4d87
mov bl, al
movsx eax, bl
push eax
push 0x4e3df8
call fcn.004059b0
add esp, 0xc
cmp bl, 0x79
je 0x40556c
cmp bl, 0x59
jne 0x405573
mov edi, 1
mov esi, edi
cmp bl, 0x6e
je 0x405582
cmp bl, 0x4e
je 0x405582
cmp esi, 1
jne 0x405540
mov dword [ebp + 0xc], edi
jmp 0x405810
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0
push eax
push 0x4e3d48
xor esi, esi
mov dword [ebp - 0x41c], 0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x420], 4
mov dword [ebp - 0x418], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40561c
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push 0x4e3dcc
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405608
cmp dword [ebp - 0x418], 4
jne 0x405608
cmp dword [ebp - 0x41c], edi
cmove esi, edi
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x405873
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 3
je 0x405873
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
push 1
push 0x4e3b0c
lea esi, [edi + 0x12]
call fcn.00402d00
xor eax, eax
mov dword [edi], 0x80c808d0
mov dword [edi + 0xa], eax
mov dword [edi + 0xe], 0xb40138
mov word [edi + 8], ax
mov dword [esi], eax
add esi, 4
push 0x4e3b28
push esi
call fcn.00404e40
push 0x4e3b4c
lea esi, [esi + eax*2]
mov eax, 8
mov word [esi], ax
add esi, 2
push esi
call fcn.00404e40
push 0x4e3b68
lea esi, [esi + eax*2]
mov eax, 0x82
add esi, 3
and esi, 0xfffffffc
mov dword [esi + 8], 0x30007
mov dword [esi + 0xc], 0xe012a
mov dword [esi + 0x10], 0xffff01f6
mov dword [esi], 0x50000000
mov word [esi + 0x14], ax
add esi, 0x16
push esi
call fcn.00404e40
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
push 0x4e3bfc
mov dword [esi + 8], 0x9f00c9
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff0001
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
push esi
call fcn.00404e40
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
push 0x4e3c0c
mov dword [esi + 8], 0x9f00ff
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff0002
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
push esi
call fcn.00404e40
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x80
and esi, 0xfffffffc
mov dword [esi + 8], 0x9f0007
mov dword [esi + 0xc], 0xe0032
mov dword [esi + 0x10], 0xffff01f5
mov dword [esi], 0x50010000
mov word [esi + 0x14], ax
add esi, 0x16
push 0x4e3c20
push esi
call fcn.00404e40
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
lea eax, [esi + eax*2]
lea esi, [eax + 5]
mov eax, 0x1f4
and esi, 0xfffffffc
push 0x4e3c30
mov dword [esi + 8], 0xe0007
mov dword [esi + 0xc], 0x8c012a
mov word [esi + 0x10], ax
mov dword [esi], 0x50a11844
add esi, 0x12
push esi
call fcn.00404e40
add esp, 0x40
lea esi, [esi + eax*2]
push 0x4e3c0c
push esi
call fcn.00404e40
add esp, 8
xor ecx, ecx
mov word [esi + eax*2], cx
inc word [edi + 8]
push ebx
push 0x404e90
push ecx
push edi
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.DLL_LocalFree]
cmp dword [ebp + 0xc], 0
pop edi
pop esi
je 0x40585c
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40585c
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push 0x4e3c44
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp + 0xc], eax
pop ebx
setne al
xor ecx, ebp
call fcn.004a71aa
mov esp, ebp
pop ebp
ret
call fcn.00405410
int3