Function at 0x4095ba
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov dword [ebp - 0x52c], 0
cmp dword [0x420a88], 0
je 0x40963c
cmp dword [ebp + 0x14], 0xffffffff
jne 0x40963c
mov eax, dword [ebp + 0x18]
and eax, 0xff
push eax
push 0x420bb4
push 0x420bb8
push 0x420bbc
push 0x420bc0
push 0x420bc4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406c95
add esp, 0xc
push eax
push 0x420bc8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406c95
add esp, 0xc
push eax
push 0
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040652e
add esp, 0x2c
mov dword [ebp + 0x14], eax
lea ecx, [ebp - 0x530]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
je 0x409671
mov eax, dword [ebp + 0x14]
jmp 0x4098db
push 0x104
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0x52c]
push edx
mov eax, dword [ebp - 0x530]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4098cb
lea ecx, [ebp - 0x20c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp - 0x530]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4098b7
mov dword [ebp - 0x318], 0
lea ecx, [ebp - 0x318]
push ecx
push 0
push 0
push 0
push str.Logon
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x409717
lea eax, [ebp - 0x318]
push eax
push 0
push 0
push 0
push str.StartShell
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4098aa
mov dword [ebp - 0x318], 0x104
lea edx, [ebp - 0x318]
push edx
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push str.Dllname
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4098aa
push 0
lea edx, [ebp - 0x208]
push edx
call fcn.00403360
add esp, 8
mov dword [ebp - 0x31c], eax
lea eax, [ebp - 0x314]
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x31c]
push edx
call fcn.004038ca
add esp, 0xc
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
push eax
push 0xffffffffffffffff
push 0
push 1
push 0x1002
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 0x528], eax
lea edx, [ebp - 0x524]
push edx
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x420]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00406381
add esp, 0x14
and eax, 0xff
test eax, eax
je 0x4098aa
cmp dword [ebp + 0x14], 0xffffffff
jne 0x40984c
mov ecx, dword [ebp + 0x18]
and ecx, 0xff
push ecx
push 0x420bcc
push 0x420bd0
push 0x420bd4
push 0x420bd8
push 0x420bdc
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406c95
add esp, 0xc
push eax
push 0x420be0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406c95
add esp, 0xc
push eax
push 0
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040652e
add esp, 0x2c
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0x18]
and edx, 0xff
push edx
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x314]
push ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x31c]
push eax
lea ecx, [ebp - 0x420]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406c95
add esp, 0xc
push eax
lea ecx, [ebp - 0x420]
push ecx
push 2
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x528]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040652e
add esp, 0x2c
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x52c]
add eax, 1
mov dword [ebp - 0x52c], eax
jmp 0x409671
mov ecx, dword [ebp - 0x530]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
mov esp, ebp
pop ebp
ret