Function at 0x40c840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb44
mov eax, dword [0x447044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x18e
push eax
lea ecx, [ebp - 0xb36]
push ecx
mov word [ebp - 0xb38], ax
call fcn.004272d0
add esp, 0xc
xor edx, edx
push 0x18e
push edx
lea eax, [ebp - 0x39e]
push eax
mov word [ebp - 0x3a0], dx
call fcn.004272d0
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x5a6]
push edx
mov word [ebp - 0x5a8], cx
call fcn.004272d0
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.004272d0
add esp, 0xc
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SystemCurrentControlSetServicesWin_Win7]
mov word [ebp + eax - 0xb38], cx
add eax, 2
test cx, cx
jne 0x40c8d0
lea edx, [ebp - 0xb3c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0xb38]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40cc4d
lea ecx, [ebp - 0xb40]
push ecx
mov ecx, dword [ebp - 0xb3c]
lea edx, [ebp - 0x3a0]
push edx
lea eax, [ebp - 0xb44]
push eax
push 0
push 0x434a48
push ecx
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0xb40], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0xb3c]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40c969
push str._CheckWinWin7Exist__Win_Win7_without_ImagePath_
jmp 0x40cc52
lea eax, [ebp - 0x3a0]
push 0x5c
push eax
call fcn.0041faf1
add esp, 8
cmp word [eax], 0
je 0x40cc46
lea ecx, [ebp - 0x3a0]
push 0x5c
push ecx
call fcn.0041faf1
add eax, 2
lea edx, [ebp - 0x210]
add esp, 8
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40c9a0
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
jmp 0x40c9c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40c9c0
sub eax, edx
sar eax, 1
cmp word [ebp + eax*2 - 0x212], 0x22
lea eax, [ebp + eax*2 - 0x212]
jne 0x40c9e6
xor edx, edx
mov word [eax], dx
xor eax, eax
cmp word [ebp - 0x3a0], 0x22
jne 0x40ca20
jmp 0x40ca00
movzx ecx, word [ebp + eax - 0x39e]
mov word [ebp + eax - 0x5a8], cx
add eax, 2
test cx, cx
jne 0x40ca00
jmp 0x40ca38
movzx ecx, word [ebp + eax - 0x3a0]
mov word [ebp + eax - 0x5a8], cx
add eax, 2
test cx, cx
jne 0x40ca20
lea eax, [ebp - 0x5a8]
push 0x5c
push eax
call fcn.0041faf1
add esp, 8
cmp word [eax], 0
je 0x40ca66
lea ecx, [ebp - 0x5a8]
push 0x5c
push ecx
call fcn.0041faf1
add esp, 8
xor edx, edx
mov word [eax + 2], dx
lea eax, [ebp - 0x210]
push 0x434920
push eax
call fcn.0041f6d7
add esp, 8
test eax, eax
je 0x40caf3
lea ecx, [ebp - 0x210]
push str.wmcSystem7X.exe
push ecx
call fcn.0041f6d7
add esp, 8
test eax, eax
je 0x40caf3
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0x9a6]
push eax
mov word [ebp - 0x9a8], dx
call fcn.004272d0
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x9a8]
push str._CheckWinWin7Exist__Service_File_Name__ls__is_not_wmcSystem7_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x9a8]
add esp, 0xc
push eax
call fcn.004042f0
add esp, 4
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f53e
mov esp, ebp
pop ebp
ret
cmp dword [0x10847ac], 0
jne 0x40cb1c
xor esi, esi
mov edi, edi
mov edx, dword [esi*4 + 0x4389d4]
lea ecx, [ebp - 0x5a8]
call fcn.0040c750
test eax, eax
je 0x40cb92
inc esi
cmp esi, 7
jl 0x40cb00
lea eax, [ebp - 0x210]
push str.wmcSystem7X.exe
push eax
call fcn.0041f6d7
add esp, 8
test eax, eax
jne 0x40cbd6
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x7ae]
push edx
mov dword [0x108b75c], 1
mov word [ebp - 0x7b0], cx
call fcn.004272d0
add esp, 0xc
lea eax, [ebp - 0x7b0]
push str._CheckWinWin7Exist__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x7b0]
push ecx
call fcn.004042f0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f53e
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x7ae]
push edx
mov word [ebp - 0x7b0], cx
call fcn.004272d0
mov eax, dword [esi*4 + 0x4389d4]
add esp, 0xc
push eax
lea ecx, [ebp - 0x7b0]
push 0x43c4b4
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x7b0]
push edx
jmp 0x40cc52
call fcn.00403820
test eax, eax
jne 0x40cbe6
push str._CheckWinWin7Exist__wmcUpdater_Service_not_exist_
jmp 0x40cc52
push 0x208
lea edx, [ebp - 0x210]
push 0
push edx
call fcn.004272d0
add esp, 0xc
push 0x10884a0
lea eax, [ebp - 0x210]
push str._swmcUpdater.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x210]
push 0
push ecx
call fcn.0041fb1f
add esp, 8
test eax, eax
je 0x40cc32
push str._CheckWinWin7Exist__wmcUpdater_File_not_exist_
jmp 0x40cc52
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f53e
mov esp, ebp
pop ebp
ret
push str._CheckWinWin7Exist__ImagePath_ERROR_
jmp 0x40cc52
push str._CheckWinWin7Exist__Win_Win7_not_exist_
call fcn.004042f0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041f53e
mov esp, ebp
pop ebp
ret