Function at 0x408440
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
push ebx
push ebp
push esi
push edi
push 9
push str.softwaremicrosoftwindows_ntcurrentversionperflib
lea edx, [esp + 0x28]
push str._s_03x
mov dword [eax], 0
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x20], 0x100
mov dword [ecx], 0
call fcn.00413130
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4084ba
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0
push eax
push 0
push str.Counters
push ecx
call esi
test eax, eax
je 0x4084f6
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00413940
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x408521
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push ebp
push eax
push 0
push str.Counters
push ecx
call esi
test eax, eax
je 0x40855f
push ebp
call fcn.004138a0
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov byte [esp + 0x20], 0
mov al, byte [ebp]
test al, al
mov dword [esp + 0x1c], 0
mov ebx, ebp
je 0x408663
cmp ebx, ebp
jbe 0x4085a3
lea esi, [ebx - 2]
xor eax, eax
mov al, byte [esi]
push eax
call fcn.004130d0
add esp, 4
test eax, eax
je 0x4085a3
dec esi
xor ecx, ecx
mov cl, byte [esi]
push ecx
call fcn.004130d0
add esp, 4
test eax, eax
jne 0x408591
push str.System
push ebx
call fcn.004135f0
add esp, 8
test eax, eax
jne 0x408601
lea esi, [ebx - 2]
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.004130d0
add esp, 4
test eax, eax
je 0x4085db
dec esi
xor eax, eax
mov al, byte [esi]
push eax
call fcn.004130d0
add esp, 4
test eax, eax
jne 0x4085c9
lea edi, [esi + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x408647
push str.__Registry_Quota_In_Use
push ebx
call fcn.004135f0
add esp, 8
test eax, eax
jne 0x408647
lea esi, [ebx - 2]
xor ecx, ecx
mov cl, byte [esi]
push ecx
call fcn.004130d0
add esp, 4
test eax, eax
je 0x408639
dec esi
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.004130d0
add esp, 4
test eax, eax
jne 0x408627
inc esi
push esi
call fcn.00412f50
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ebx + ecx + 1]
lea ebx, [ebx + ecx + 1]
test al, al
jne 0x408579
push ebp
call fcn.004138a0
mov al, byte [esp + 0x24]
add esp, 4
test al, al
jne 0x40868c
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push 0x19000
mov dword [esp + 0x14], 0x19000
call fcn.00413940
mov esi, eax
add esp, 4
test esi, esi
jne 0x4086bf
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 3
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, ebx
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
lea edx, [esp + 0x2c]
push 0
push edx
push 0x80000004
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x408727
test ecx, ecx
jbe 0x408727
cmp word [esi], 0x50
jne 0x408727
cmp word [esi + 2], 0x45
jne 0x408727
cmp word [esi + 4], 0x52
jne 0x408727
cmp word [esi + 6], 0x46
je 0x408789
cmp eax, 0xea
jne 0x408765
add ecx, 0xc800
push ecx
push esi
mov dword [esp + 0x18], ecx
call fcn.00414410
mov ecx, dword [esp + 0x18]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x80000004
and ecx, ebx
rep stosb byte es:[edi], al
call ebp
jmp 0x4086df
push esi
call fcn.004138a0
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call ebp
push 0x80000004
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov edi, dword [esi + 0x18]
xor eax, eax
add edi, esi
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0x20]
add esi, edi
test ecx, ecx
jbe 0x4087af
mov edx, dword [esp + 0x1c]
mov ebx, dword [esi + 4]
cmp ebx, edx
je 0x4087af
add esi, 0x28
inc eax
cmp eax, ecx
jb 0x40879c
dec ecx
cmp eax, ecx
jae 0x4087c8
cmp eax, 0xffffffff
je 0x4087c8
inc eax
push eax
push edi
call fcn.00408410
add esp, 8
mov ebx, eax
jmp 0x4087ca
xor ebx, ebx
push esi
push edi
call fcn.004083f0
add esp, 8
mov esi, eax
test ebx, ebx
je 0x4087e6
push ebx
push edi
call fcn.004083f0
add esp, 8
jmp 0x4087ea
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x128]
mov eax, dword [eax]
push 0x80000004
mov dword [ecx], eax
mov eax, dword [esp + 0x128]
mov edx, dword [esi]
mov dword [eax], edx
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret