Function at 0x402960
Capabilities:
Check os version
Delete registry key
Persist via aedebug registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1984
call fcn.00436be0
mov eax, dword [0x455008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1984]
mov dword [ebp - 0x1970], 0
push eax
lea eax, [ebp - 0x1970]
mov esi, ecx
push eax
push 0
push 0x103
push 0
push 0
push 0
push 0x445860
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
je 0x4029d7
push 0x4458d0
call fcn.00401380
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x1970]
lea eax, [ebp - 0x1050]
push 0x1000
xorps xmm0, xmm0
mov dword [ebp - 0x1978], edi
push 0
push eax
movq qword [ebp - 0x10], xmm0
mov word [ebp - 8], 0
call fcn.00417b90
add esp, 0xc
lea eax, [ebp - 0x1850]
push 0x800
push 0
push eax
call fcn.00417b90
add esp, 0xc
lea eax, [ebp - 0x1850]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x4030d5
lea eax, [ebp - 0x197c]
mov dword [ebp - 0x1974], 0
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x197c], 5
push eax
lea eax, [ebp - 0x1974]
push eax
push 0
push 0x4450fc
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402a80
cmp dword [ebp - 0x1974], 1
je 0x402a86
xor eax, eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x197c]
mov dword [ebp - 0x1974], 0
push eax
lea eax, [ebp - 0x1050]
mov dword [ebp - 0x197c], 0x800
push eax
lea eax, [ebp - 0x1974]
push eax
push 0
push 0x445108
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402aca
cmp dword [ebp - 0x1974], 1
je 0x402ad3
xor eax, eax
mov word [ebp - 0x1050], ax
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.00416e60
add esp, 8
test eax, eax
jne 0x402c93
mov dword [ebp - 0x196c], eax
lea eax, [ebp - 0x196c]
push eax
push 0x102
push 0
push 0x44511c
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402b6c
push dword [ebp - 0x196c]
call ebx
push 0x44511c
push edi
mov dword [ebp - 0x196c], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test edi, edi
je 0x402b66
push 0x44514c
push 0x445150
call fcn.00401380
add esp, 8
push dword [ebp - 0x1970]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x1978]
lea eax, [ebp - 0x1980]
mov dword [ebp - 0x196c], 0
push eax
lea eax, [ebp - 0x196c]
mov dword [ebp - 0x1980], 0
push eax
push 0
push 0x102
push 0
push 0
push 0
push 0x44511c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402c93
lea ecx, [ebp - 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402bb5
sub ecx, edx
sar ecx, 1
je 0x402c1a
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4450fc
push dword [ebp - 0x196c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x402c1a
push 0x44514c
push 0x445200
call fcn.00401380
add esp, 8
push dword [ebp - 0x1970]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1050]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402c23
sub ecx, edx
sar ecx, 1
je 0x402c8b
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1050]
push eax
push 1
push 0
push 0x445108
push dword [ebp - 0x196c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x402c8b
push 0x44514c
push 0x4452a8
call fcn.00401380
add esp, 8
push dword [ebp - 0x1970]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x196c]
call ebx
push 0x445354
lea eax, [ebp - 0x10]
push 5
push eax
call fcn.0041fa9e
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fa9e
add esp, 0xc
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x44535c
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x50], 0
je 0x402d2b
push 0x445378
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x51], 0
je 0x402d4a
push 0x445384
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x55], 0
je 0x402d69
push 0x445390
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x52], 0
je 0x402d88
push 0x44539c
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x53], 0
je 0x402de0
push dword [esi + 0x140]
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
push 0x4453a8
push 0x10
push eax
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call fcn.004013b0
push 0x4453b0
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0x1c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x54], 0
je 0x402e32
push 0x4453bc
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push dword [esi + 0x144]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x148], 0
je 0x402e54
push 0x4453cc
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x77e], 0
je 0x402e76
push 0x4453d8
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
mov edi, dword [esi + 0xd4]
test edi, edi
je 0x402edc
push 0x3c
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.00417b90
mov eax, 0x10624dd3
add esp, 0xc
mul edi
lea eax, [ebp - 0x4c]
shr edx, 6
push edx
push 0x4453e0
push 0x1e
push eax
call fcn.004013b0
push 0x4453e8
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0x1c
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x79c], 0
je 0x402efe
push 0x4453f4
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x130], 0
je 0x402f20
push 0x445400
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
push 0x445408
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push dword [esi + 0x10]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1964]
push pe_nt_image_headers32
push 0
push eax
call fcn.00417b90
add esp, 0xc
mov dword [ebp - 0x1968], 0x114
lea eax, [ebp - 0x1968]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1964], 6
mov ecx, 0x44542c
mov eax, 0x445414
cmovb eax, ecx
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
lea ecx, [ebp - 0x10]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402fc5
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4450fc
push dword [ebp - 0x1978]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x403028
push 0x44514c
push 0x445448
call fcn.00401380
add esp, 8
push dword [ebp - 0x1970]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1050]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403031
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1050]
push eax
push 1
push 0
push 0x445108
push dword [ebp - 0x1978]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x403097
push 0x44514c
push 0x4454e8
call fcn.00401380
add esp, 8
push dword [ebp - 0x1970]
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
push 0x445590
call fcn.00401380
add esp, 4
push 0x44514c
push 0x4455a8
call fcn.00401380
lea eax, [ebp - 0x10]
push eax
push 0x445628
call fcn.00401380
lea eax, [ebp - 0x1050]
push eax
push 0x445660
call fcn.00401380
add esp, 0x18
push dword [ebp - 0x1970]
xor edi, edi
call ebx
push 0x447338
push 0x447348
mov dword [ebp - 0x1978], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x403112
lea eax, [ebp - 0x1978]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
cmp dword [ebp - 0x1978], edi
je 0x403803
lea eax, [ebp - 0x1984]
mov dword [ebp - 0x1970], edi
push eax
lea eax, [ebp - 0x1970]
push eax
push 0
push 0x203
push 0
push 0
push 0
push 0x445860
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
je 0x403175
push 0x445968
call fcn.00401380
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x1970]
lea eax, [ebp - 0x1050]
push 0x1000
xorps xmm0, xmm0
mov word [ebp - 8], 0
push 0
push eax
movq qword [ebp - 0x10], xmm0
call fcn.00417b90
add esp, 0xc
lea eax, [ebp - 0x1850]
push 0x800
push 0
push eax
call fcn.00417b90
add esp, 0xc
lea eax, [ebp - 0x1850]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test ebx, ebx
je 0x4037f5
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1978]
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1974], 0
push eax
lea eax, [ebp - 0x1974]
mov dword [ebp - 0x1978], 5
push eax
push 0
push 0x4450fc
push ebx
call edi
test eax, eax
jne 0x403214
cmp dword [ebp - 0x1974], 1
je 0x40321a
xor eax, eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1978]
mov dword [ebp - 0x1974], 0
push eax
lea eax, [ebp - 0x1050]
mov dword [ebp - 0x1978], 0x800
push eax
lea eax, [ebp - 0x1974]
push eax
push 0
push 0x445108
push ebx
call edi
test eax, eax
jne 0x40325a
cmp dword [ebp - 0x1974], 1
je 0x403263
xor eax, eax
mov word [ebp - 0x1050], ax
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x1050]
push eax
call fcn.00416e60
add esp, 8
test eax, eax
jne 0x4033ee
mov dword [ebp - 0x197c], eax
lea eax, [ebp - 0x197c]
push eax
push 0x202
push 0
push 0x44511c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4032e4
push dword [ebp - 0x197c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x44511c
push ebx
mov dword [ebp - 0x197c], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
test edi, edi
je 0x4032e4
push 0x445130
push 0x445150
call fcn.00401380
add esp, 8
jmp 0x4037f7
lea eax, [ebp - 0x1980]
mov dword [ebp - 0x196c], 0
push eax
lea eax, [ebp - 0x196c]
mov dword [ebp - 0x1980], 0
push eax
push 0
push 0x202
push 0
push 0
push 0
push 0x44511c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4033ee
lea ecx, [ebp - 0x10]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403330
sub ecx, edx
sar ecx, 1
je 0x40337f
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4450fc
push dword [ebp - 0x196c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x40337f
push 0x445130
push 0x445200
call fcn.00401380
add esp, 8
jmp 0x4037f7
lea ecx, [ebp - 0x1050]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403390
sub ecx, edx
sar ecx, 1
je 0x4033e2
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1050]
push eax
push 1
push 0
push 0x445108
push dword [ebp - 0x196c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x4033e2
push 0x445130
push 0x4452a8
call fcn.00401380
add esp, 8
jmp 0x4037f7
push dword [ebp - 0x196c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x445354
lea eax, [ebp - 0x10]
push 5
push eax
call fcn.0041fa9e
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fa9e
add esp, 0xc
lea eax, [ebp - 0x1850]
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x44535c
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x50], 0
je 0x403486
push 0x445378
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x51], 0
je 0x4034a5
push 0x445384
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x55], 0
je 0x4034c4
push 0x445390
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x52], 0
je 0x4034e3
push 0x44539c
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x53], 0
je 0x40353b
push dword [esi + 0x140]
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
push 0x4453a8
push 0x10
push eax
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call fcn.004013b0
push 0x4453b0
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0x1c
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x54], 0
je 0x40358d
push 0x4453bc
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push dword [esi + 0x144]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x148], 0
je 0x4035af
push 0x4453cc
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x77e], 0
je 0x4035d1
push 0x4453d8
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
mov edi, dword [esi + 0xd4]
test edi, edi
je 0x403637
push 0x3c
lea ecx, [ebp - 0x4c]
push 0
push ecx
call fcn.00417b90
mov eax, 0x10624dd3
add esp, 0xc
mul edi
lea eax, [ebp - 0x4c]
shr edx, 6
push edx
push 0x4453e0
push 0x1e
push eax
call fcn.004013b0
push 0x4453e8
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0x1c
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x79c], 0
je 0x403659
push 0x4453f4
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
cmp byte [esi + 0x130], 0
je 0x40367b
push 0x445400
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
push 0x445408
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push dword [esi + 0x10]
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1050]
push 0x445358
push 0x800
push eax
call fcn.0041fb02
add esp, 0xc
lea eax, [ebp - 0x1964]
push pe_nt_image_headers32
push 0
push eax
call fcn.00417b90
add esp, 0xc
mov dword [ebp - 0x1968], 0x114
lea eax, [ebp - 0x1968]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1964], 6
mov ecx, 0x44542c
mov eax, 0x445414
cmovb eax, ecx
push eax
lea eax, [ebp - 0x1050]
push 0x800
push eax
call fcn.0041fb02
lea ecx, [ebp - 0x10]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403720
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4450fc
push ebx
call esi
mov edi, eax
test edi, edi
je 0x40376a
push 0x445130
push 0x445448
call fcn.00401380
add esp, 8
jmp 0x4037f7
lea ecx, [ebp - 0x1050]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403773
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1050]
push eax
push 1
push 0
push 0x445108
push ebx
call esi
mov edi, eax
test edi, edi
je 0x4037b7
push 0x445130
push 0x4454e8
call fcn.00401380
add esp, 8
jmp 0x4037f7
push 0x445590
call fcn.00401380
add esp, 4
push 0x445130
push 0x4455a8
call fcn.00401380
lea eax, [ebp - 0x10]
push eax
push 0x445628
call fcn.00401380
lea eax, [ebp - 0x1050]
push eax
push 0x445660
call fcn.00401380
add esp, 0x18
xor edi, edi
push dword [ebp - 0x1970]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415f69
mov esp, ebp
pop ebp
ret