Function at 0x409d70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 8], eax
mov byte [ebp - 4], dl
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x24]
mov ecx, eax
lea eax, [ebp - 0x3c]
mov edx, eax
mov eax, 1
call fcn.004041a0
call fcn.004042a0
push eax
test eax, eax
jne 0x409ff2
cmp byte [ebp - 4], 0
jne 0x409db7
jmp 0x409eb6
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x44]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1cc]
mov eax, dword [0x417040]
call fcn.00412320
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x409dfd
mov eax, 0x419590
push eax
push 0x80000001
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
je 0x409e11
jmp 0x409eb1
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040bea0
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x417060]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040be80
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x417080]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040bd60
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x417090]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040bc90
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
mov eax, dword [0x4170b0]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 0xc]
call sub.advapi32.dll_RegCloseKey
jmp 0x409ff2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1d8]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x1d4]
call edx
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x48]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1cc]
mov eax, dword [str.Software_]
call fcn.00412320
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x409f08
mov eax, 0x419590
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x409f1c
jmp 0x409ff2
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x4170f0]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x409f4c
jmp 0x409f5a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040bce0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x417110]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x409f7c
jmp 0x409f8a
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040bdb0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x417120]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x409fac
jmp 0x409fba
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040c390
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x417140]
push eax
push dword [ebp - 0xc]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x409fdc
jmp 0x409fea
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0040bef0
push dword [ebp - 0xc]
call sub.advapi32.dll_RegCloseKey
call fcn.004043a0
lea edx, [ebp - 0x48]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x48], 0
lea edx, [ebp - 0x44]
mov eax, edx
call fcn.004042d0
mov dword [ebp - 0x44], 0
pop eax
test eax, eax
je 0x40a023
call fcn.00404430
leave
ret