Function at 0x405009
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa74
mov eax, dword [0x462074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa70], edx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa6c], eax
mov edi, ecx
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0xa68], 0x28
mov dword [ebp - 0xa74], 0x208
call fcn.0040bb9e
mov ecx, edi
mov esi, eax
call fcn.0040bd8c
lea ebx, [eax + 0x14]
lea ecx, [ebx + ebx]
call fcn.00401cbf
mov dword [ebp - 0xa64], eax
test eax, eax
je 0x40523b
push 0x208
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x644]
call fcn.0040bfdc
cmp esi, 9
je 0x40527f
cmp esi, 0xffffffff
je 0x40527f
mov ebx, 0x208
cmp esi, 0xa
jae 0x4050cf
imul edx, esi, 0x30
lea ecx, [ebp - 0x644]
push ebx
mov edx, dword [edx + 0x437fe0]
call fcn.0040c02b
push ebx
mov edx, str..exe
lea ecx, [ebp - 0x644]
call fcn.0040c02b
mov edi, dword [ebp - 0xa64]
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x644]
mov ecx, 0x80000002
call fcn.0040c5c8
test eax, eax
jne 0x405135
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4051f0
cmp esi, 9
je 0x405234
cmp esi, 0xffffffff
je 0x405234
cmp esi, 0xa
jae 0x405234
imul esi, esi, 0x30
cmp dword [esi + 0x43800c], 0
je 0x405234
push ebx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0xa54]
call fcn.0040bfdc
mov edx, dword [esi + 0x43800c]
lea ecx, [ebp - 0xa54]
push ebx
call fcn.0040c02b
push ebx
mov edx, str..exe
lea ecx, [ebp - 0xa54]
call fcn.0040c02b
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0xa54]
mov ecx, 0x80000002
call fcn.0040c5c8
test eax, eax
jne 0x405234
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405234
cmp dword [ebp - 0xa58], 1
jne 0x40521b
mov edx, 0x437910
lea ecx, [ebp - 0x2c]
call fcn.0040be37
test eax, eax
jne 0x40522a
mov edx, 0x437914
lea ecx, [ebp - 0x2c]
call fcn.0040be37
test eax, eax
jne 0x40522a
cmp dword [ebp - 0xa58], 4
jne 0x405234
cmp dword [ebp - 0x2c], 0
je 0x405234
mov dword [ebp - 0xa6c], 1
mov ecx, edi
call fcn.00401cf4
cmp dword [ebp - 0xa60], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x405252
push dword [ebp - 0xa60]
call esi
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0xa5c], 0
je 0x40526a
push dword [ebp - 0xa5c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa6c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0043182e
leave
ret
mov edx, edi
mov edi, dword [ebp - 0xa64]
push ebx
mov ecx, edi
call fcn.0040bfdc
push ebx
mov edx, str._shell_
mov ecx, edi
call fcn.0040c02b
mov edx, dword [ebp - 0xa70]
mov ecx, edi
push ebx
call fcn.0040c02b
push ebx
mov edx, 0x4378fc
mov ecx, edi
call fcn.0040c02b
lea eax, [ebp - 0xa60]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040c5c8
test eax, eax
jne 0x405234
movzx eax, byte [ebp - 0x234]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x234], al
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push ecx
push dword [ebp - 0xa60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405234
mov edx, str..exe
lea ecx, [ebp - 0x234]
call fcn.0040c108
mov edx, eax
test edx, edx
je 0x405234
xor eax, eax
mov word [edx + 8], ax
jmp 0x405373
movzx eax, word [edx - 2]
cmp eax, 0x61
jb 0x40534c
cmp eax, 0x7a
jbe 0x405365
cmp eax, 0x41
jb 0x405356
cmp eax, 0x5a
jbe 0x405365
cmp eax, 0x30
jb 0x405360
cmp eax, 0x39
jbe 0x405365
cmp eax, 0x5f
jne 0x40536a
xor eax, eax
inc eax
jmp 0x40536c
xor eax, eax
test eax, eax
je 0x40537d
add edx, 0xfffffffe
lea eax, [ebp - 0x234]
cmp edx, eax
ja 0x40533e
mov ebx, 0x208
lea ecx, [ebp - 0x644]
push ebx
call fcn.0040c02b
jmp 0x4050d5