Function at 0x40cab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541e62
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x594ca8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5704e4
lea ecx, [ebp - 0x120]
call fcn.004040f0
mov dword [ebp - 4], 0
call fcn.00417515
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40cb0f
push 0x80004005
call fcn.00404860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x11c], eax
push str.1905Client.exe
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
lea ecx, [ebp - 0x11c]
push 0x570bac
push ecx
mov byte [ebp - 4], 1
call fcn.00403cc0
push 0x103
lea edx, [ebp - 0x113]
push 0
push edx
mov dword [ebp - 0x130], 0x104
mov byte [ebp - 0x114], 0
call fcn.00518ea0
mov ebx, dword [ebp - 0x11c]
add esp, 0x1c
test ebx, ebx
je 0x40cbae
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x40cbae
lea edi, [eax + eax]
mov eax, edi
call fcn.0051b880
mov esi, esp
test esi, esi
je 0x40cbae
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x40cbb0
xor eax, eax
lea ecx, [ebp - 0x118]
push ecx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cc6e
mov ecx, dword [ebp - 0x118]
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push str.ClientVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cc6e
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jg 0x40cc47
lea eax, [edi + edi]
call fcn.0051b880
mov esi, esp
test esi, esi
je 0x40cc47
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x114]
xor ecx, ecx
push edx
push ecx
push 3
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40cc4d
xor esi, esi
xor eax, eax
jmp 0x40cc61
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cc52
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x120]
call fcn.004046e0
call fcn.00417515
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40cc88
push 0x80004005
call fcn.00404860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x118], eax
lea esi, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.00402240
mov esi, dword [ebp - 0x118]
push 0x5c
push esi
call fcn.00517280
add esp, 8
test eax, eax
jne 0x40ccc3
or eax, 0xffffffff
jmp 0x40ccc7
sub eax, esi
sar eax, 1
push eax
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x118]
call fcn.004037c0
push str.exe_
push eax
lea edx, [ebp - 0x12c]
push edx
mov byte [ebp - 4], 3
call fcn.00404260
push str.1905Client.exe
push eax
lea eax, [ebp - 0x124]
mov ebx, 4
push eax
mov byte [ebp - 4], bl
call fcn.00404260
add esp, 0x18
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x12c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x134]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
lea edx, [ebp - 0x118]
mov dword [ebp - 0x138], esp
mov ecx, esp
push edx
call fcn.00404900
lea eax, [ebp - 0x128]
push eax
call fcn.00402e00
mov ecx, dword [ebp - 0x120]
xor eax, eax
add esp, 8
test ecx, ecx
setne al
test eax, eax
jne 0x40cdcd
push 0x80004005
call fcn.00404860
mov esi, dword [ebp - 0x128]
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cdf9
test dx, dx
je 0x40cdf5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cdf9
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x40cdd5
xor eax, eax
jmp 0x40cdfd
sbb eax, eax
sbb eax, edi
test eax, eax
sete al
test al, al
lea eax, [esi - 0x10]
mov edx, edi
lea ecx, [eax + 0xc]
je 0x40ce9b
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce25
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x118]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x120]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40ce91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x40cf1c
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ceae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x118]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ced3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cef8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x120]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40cf1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
lea esp, [ebp - 0x148]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051553d
mov esp, ebp
pop ebp
ret