Function at 0x43619c
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1638
call fcn.004a98b0
mov eax, dword [0x4dd52c]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp dword [ebx + 0x1dfa8], esi
mov dword [ebp - 4], eax
jne 0x43661e
push edi
xor eax, eax
mov edx, 0x81
mov word [ebp - 0x161c], si
mov ecx, edx
lea edi, [ebp - 0x161a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x414], si
mov ecx, edx
lea edi, [ebp - 0x412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x20c], si
mov ecx, edx
lea edi, [ebp - 0x20a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1414], si
mov ecx, 0x3ff
lea edi, [ebp - 0x1412]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x405e8c
lea eax, [ebp - 0x161c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebx + 0x5010]
mov dword [ebp - 0x1620], esi
mov dword [ebp - 0x1624], esi
call fcn.00480395
push 0x405c38
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x1624]
push eax
call fcn.004805f0
test eax, eax
jne 0x43661d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
mov dword [ebp - 0x1638], esi
pop esi
lea eax, [ebp - 0x1620]
push eax
lea eax, [ebp - 0x1638]
push eax
push 0
push 0
push 0x407230
push dword [ebp - 0x1624]
mov dword [ebp - 0x1620], esi
call edi
test eax, eax
jne 0x436611
xor ecx, ecx
cmp dword [ebp - 0x1638], ecx
je 0x436611
lea edx, [ebp - 0x1620]
push edx
lea eax, [ebx + 0x1dfac]
push eax
push ecx
push ecx
push 0x407204
push dword [ebp - 0x1624]
mov dword [ebp - 0x1620], esi
call edi
test eax, eax
je 0x4362e5
and dword [ebx + 0x1dfac], 0
lea eax, [ebp - 0x1620]
push eax
mov dword [ebp - 0x1620], esi
lea esi, [ebx + 0x1dfa0]
push esi
push 0
push 0
push 0x4071d4
push dword [ebp - 0x1624]
call edi
test eax, eax
jne 0x4364fa
cmp word [esi], ax
jne 0x436437
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0x4071b0
push dword [ebp - 0x1624]
call fcn.004807ae
mov edi, eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
test edi, edi
pop ecx
jne 0x4364fa
lea eax, [ebp - 0x20c]
push 0x407194
push eax
call dword [sym.imp.msvcrt.dll__wfopen]
test eax, eax
pop ecx
pop ecx
mov dword [ebx + 0x1dfa4], eax
je 0x4364fa
mov eax, dword [ebx + 0x1dfac]
xor ecx, ecx
inc ecx
test eax, eax
mov dword [ebx + 0x1dfa8], ecx
je 0x4364fa
cmp eax, ecx
jb 0x4364fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x407138
mov ecx, 0x400
lea edi, [ebp - 0x1414]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1626]
push 0x407104
push eax
movzx eax, word [ebp - 0x1628]
push eax
movzx eax, word [ebp - 0x162a]
push eax
movzx eax, word [ebp - 0x162c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1414]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi], 1
lea eax, [ebp - 0x1414]
push eax
jne 0x43641b
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x4364fa
push 0x4060a8
push dword [ebx + 0x1dfa4]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [ebx + 0x1dfa4]
jmp 0x4364f1
mov eax, dword [ebx + 0x1dfac]
test eax, eax
mov dword [ebx + 0x1dfa8], 1
je 0x4364fa
cmp eax, 1
jb 0x4364fa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x4070a0
mov ecx, 0x400
lea edi, [ebp - 0x1414]
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1626]
push 0x407104
push eax
movzx eax, word [ebp - 0x1628]
push eax
movzx eax, word [ebp - 0x162a]
push eax
movzx eax, word [ebp - 0x162c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1414]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi], 1
lea eax, [ebp - 0x1414]
push eax
je 0x436410
lea edi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [edi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [edi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
mov eax, dword [ebx + 0x1dfac]
dec eax
je 0x4365cd
dec eax
je 0x436538
dec eax
jne 0x436611
cmp dword [ebx + 0x1dfa8], 1
jne 0x436611
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x407060
jmp 0x43655d
cmp dword [ebx + 0x1dfa8], 1
jne 0x436611
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x407020
xor eax, eax
lea edi, [ebp - 0x1414]
mov ecx, 0x400
rep stosd dword es:[edi], eax
movzx eax, word [ebp - 0x1626]
push 0x407104
push eax
movzx eax, word [ebp - 0x1628]
push eax
movzx eax, word [ebp - 0x162a]
push eax
movzx eax, word [ebp - 0x162c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4065a0
lea eax, [ebp - 0x1414]
push 0x800
push eax
call fcn.00431bde
add esp, 0x2c
cmp word [esi], 1
lea eax, [ebp - 0x1414]
push eax
jne 0x4365f3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x436611
cmp dword [ebx + 0x1dfa8], 1
jne 0x436611
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x1634]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x406fe4
jmp 0x43655d
lea esi, [ebx + 0x1dfa4]
push 0x4060a8
push dword [esi]
call dword [sym.imp.msvcrt.dll_fwprintf]
push dword [esi]
call dword [sym.imp.msvcrt.dll_fflush]
add esp, 0x10
push dword [ebp - 0x1624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004a9585
leave
ret 4