Function at 0x406220
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43113e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
push eax
mov esi, ecx
push 0x66
mov dword [esp + 0x24], esi
call fcn.004287d4
push fcn.004017c0
push 0x4017f0
push 0x36
push 8
lea ecx, [esi + 0x70]
xor edi, edi
push ecx
mov dword [esp + 0x3c], edi
mov dword [esi], method.CDialog.virtual_0
call fcn.004148a9
mov ebx, vtable.CBitmap.0
mov dword [esi + 0x224], edi
mov dword [esi + 0x220], ebx
mov dword [esi + 0x22c], edi
mov dword [esi + 0x228], ebx
lea ecx, [esi + 0x244]
mov byte [esp + 0x28], 3
call fcn.00407e60
push fcn.004017c0
push 0x4017f0
push 5
push 8
lea edx, [esi + 0x324]
push edx
mov byte [esp + 0x3c], 4
call fcn.004148a9
lea ebp, [esi + 0x354]
mov ecx, ebp
mov byte [esp + 0x28], 5
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x3c4]
mov ecx, ebp
mov byte [esp + 0x28], 6
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x434]
mov ecx, ebp
mov byte [esp + 0x28], 7
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x4a4]
mov ecx, ebp
mov byte [esp + 0x28], 8
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
mov byte [esp + 0x28], 9
call fcn.00429279
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x520], eax
mov byte [esp + 0x28], 0xa
call fcn.00429279
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x530], eax
mov byte [esp + 0x28], 0xb
call fcn.00429279
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 0x574], eax
lea ebp, [esi + 0x57c]
mov ecx, ebp
mov byte [esp + 0x28], 0xc
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x5ec]
mov ecx, ebp
mov byte [esp + 0x28], 0xd
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x66c]
mov ecx, ebp
mov byte [esp + 0x28], 0xe
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x6dc]
mov ecx, ebp
mov byte [esp + 0x28], 0xf
call fcn.00424e3c
mov dword [ebp], 0x432628
lea ebp, [esi + 0x74c]
mov ecx, ebp
mov byte [esp + 0x28], 0x10
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x7bc]
mov ecx, ebp
mov byte [esp + 0x28], 0x11
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x82c]
mov ecx, ebp
mov byte [esp + 0x28], 0x12
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x89c]
mov ecx, ebp
mov byte [esp + 0x28], 0x13
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x90c]
mov ecx, ebp
mov byte [esp + 0x28], 0x14
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
lea ebp, [esi + 0x97c]
mov byte [esp + 0x28], 0x15
mov ecx, ebp
call fcn.00424e3c
mov dword [ebp], 0x432cb0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x5c], edi
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], ebx
mov byte [esp + 0x28], 0x16
call fcn.0042e354
call fcn.0042e354
mov eax, dword [eax + 0xc]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0x4325f8
lea ecx, [esi + 0x520]
mov dword [esi + 0x34c], eax
call fcn.00402940
push edi
push 0x4325f8
lea ecx, [esi + 0x530]
call fcn.00402940
push edi
push edi
push edi
push edi
lea eax, [esi + 0x65c]
push eax
mov dword [esi + 0x538], 0x55a05
mov dword [esi + 0x524], edi
mov dword [esi + 0x53c], edi
mov dword [esi + 0x544], edi
mov dword [esi + 0x534], edi
mov dword [esi + 0x548], edi
mov dword [esi + 0x514], edi
mov dword [esi + 0x54c], edi
call dword [sym.imp.USER32.dll_SetRect]
push 8
call fcn.00427ea4
add esp, 4
cmp eax, edi
je 0x406641
mov dword [eax + 4], edi
mov dword [eax], ebx
jmp 0x406643
xor eax, eax
lea ecx, [esp + 0x30]
push ecx
push 0x20019
push edi
push 0x432ee8
push SysReAllocString
mov dword [esi + 0x350], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebp, 0x3e8
je 0x4066a4
push edi
lea edx, [esp + 0x1c]
push edx
push edi
push 0x20006
push edi
push edi
push edi
push 0x432ee8
push SysReAllocString
mov dword [esi + 0x518], ebp
mov dword [esi + 0x51c], edi
mov dword [esi + 0x528], edi
mov dword [esi + 0x52c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x28
call fcn.00427ed4
mov edx, dword [esp + 0x34]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0x432ee0
push edx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4066e8
mov dword [esi + 0x518], ebp
jmp 0x406723
push ebx
lea ecx, [esp + 0x1c]
call fcn.00406100
mov eax, dword [esp + 0x18]
push eax
call fcn.004147c5
mov dword [esi + 0x518], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406723
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edx, dword [esp + 0x30]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0x432ec0
push edx
call ebp
test eax, eax
je 0x40674d
mov dword [esi + 0x51c], edi
jmp 0x406788
push ebx
lea ecx, [esp + 0x1c]
call fcn.00406100
mov eax, dword [esp + 0x18]
push eax
call fcn.004147c5
mov dword [esi + 0x51c], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406788
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0x432ebc
push edx
call ebp
test eax, eax
je 0x4067ac
mov dword [esi + 0x528], edi
jmp 0x4067e7
push ebx
lea ecx, [esp + 0x1c]
call fcn.00406100
mov eax, dword [esp + 0x18]
push eax
call fcn.004147c5
mov dword [esi + 0x528], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4067e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push 0x432eb8
push edx
call ebp
test eax, eax
je 0x40680b
mov dword [esi + 0x52c], edi
jmp 0x406846
push ebx
lea ecx, [esp + 0x1c]
call fcn.00406100
mov eax, dword [esp + 0x18]
push eax
call fcn.004147c5
mov dword [esi + 0x52c], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406846
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ebx
call fcn.00427ecf
mov eax, dword [esp + 0x34]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4