Function at 0x404796
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, 0x21c
mov dword [ebp - 0x350], eax
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x320]
push ecx
push eax
mov dword [ebp - 0x340], ebx
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], ecx
call fcn.004122f1
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x318]
mov dword [ebp - 0x320], edi
push 0x80
push eax
mov dword [ebp - 0x31c], 0xf
call fcn.004165bf
add esp, 0x1c
mov dword [ebp - 0x32c], 4
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x425780
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404dd4
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 4
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push str.DefaultDrive
push dword [ebp - 0x340]
call ebx
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404dd4
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 4
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.Priority
push dword [ebp - 0x340]
call ebx
movzx esi, ax
mov ebx, 0x80070000
or esi, ebx
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404dd4
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x33c]
push dword [ebp - 0x34c]
call fcn.00404718
mov esi, eax
test esi, esi
js 0x404dd4
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push str.Properties
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, ebx
test eax, eax
cmovle esi, eax
xor eax, eax
inc eax
cmp esi, 0x80070002
cmove esi, eax
test esi, esi
js 0x404dd4
jne 0x404ad5
mov ebx, 0x100
lea eax, [ebp - 0x338]
push ebx
push eax
call fcn.0040e280
mov esi, eax
test esi, esi
js 0x404dd4
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x32c], 0x200
push eax
push dword [ebp - 0x338]
xor ecx, ecx
lea eax, [ebp - 0x328]
push ecx
push ecx
push eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0x33c], ecx
push eax
push ecx
jmp 0x404aa0
cmp eax, 0xea
jne 0x404a31
mov ecx, dword [ebp - 0x32c]
lea eax, [ecx + ecx]
cmp ebx, eax
jae 0x404b44
lea ebx, [ecx*2 + 0x32]
push ebx
lea eax, [ebp - 0x338]
push eax
call fcn.0040e280
mov esi, eax
test esi, esi
js 0x404dd4
lea eax, [ebx + ebx]
mov dword [ebp - 0x328], 0x80
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x328]
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x33c]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404dd4
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x104]
push dword [ebp - 0x338]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
js 0x404dd4
mov esi, dword [ebp - 0x33c]
lea eax, [ebx + ebx]
mov dword [ebp - 0x32c], eax
inc esi
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x33c], esi
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x328]
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4049b7
push dword [ebp - 0x324]
call edi
and dword [ebp - 0x324], 0
mov ebx, 0x80070000
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push str.Sources
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, ebx
test eax, eax
push 1
cmovle esi, eax
cmp esi, 0x80070002
pop eax
cmove esi, eax
test esi, esi
js 0x404dd4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x404c4f
xor esi, esi
lea eax, [ebp - 0x358]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x328]
mov dword [ebp - 0x33c], esi
push eax
lea eax, [ebp - 0x104]
push eax
push esi
jmp 0x404c05
mov esi, 0x8000ffff
jmp 0x404dd4
lea eax, [ebp - 0x330]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404dd4
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x348]
push edx
push dword [ebp - 0x34c]
lea edx, [ebp - 0x104]
push dword [ebp - 0x330]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x348]
test ecx, ecx
je 0x404bcf
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor esi, esi
mov dword [ebp - 0x348], esi
jmp 0x404bd1
xor esi, esi
push dword [ebp - 0x330]
call edi
mov eax, dword [ebp - 0x33c]
lea ecx, [ebp - 0x358]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x330], esi
push ecx
lea ecx, [ebp - 0x104]
inc eax
push ecx
mov dword [ebp - 0x33c], eax
push eax
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
test eax, eax
je 0x404b4e
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
xor eax, eax
cmp esi, 0x80070103
cmove esi, eax
test esi, esi
js 0x404dd4
push dword [ebp - 0x324]
call edi
and dword [ebp - 0x324], 0
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push str.Resources
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
push 1
cmovle esi, eax
cmp esi, 0x80070002
pop eax
cmove esi, eax
test esi, esi
js 0x404dd4
jne 0x404db1
xor esi, esi
lea eax, [ebp - 0x358]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x328]
mov ebx, esi
push eax
lea eax, [ebp - 0x104]
push eax
push esi
jmp 0x404d67
lea eax, [ebp - 0x330]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x404dd4
mov eax, dword [ebp - 0x334]
lea edx, [ebp - 0x344]
push edx
push dword [ebp - 0x330]
lea edx, [ebp - 0x104]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
js 0x404dd4
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404d3d
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
xor esi, esi
mov dword [ebp - 0x344], esi
jmp 0x404d3f
xor esi, esi
push dword [ebp - 0x330]
call edi
lea eax, [ebp - 0x358]
mov dword [ebp - 0x330], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x328]
inc ebx
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x404cb8
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
xor eax, eax
cmp esi, 0x80070103
cmove esi, eax
test esi, esi
js 0x404dd4
push dword [ebp - 0x324]
call edi
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x334]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov ecx, dword [ebp - 0x350]
mov eax, dword [ebp - 0x334]
and dword [ebp - 0x334], 0
xor esi, esi
mov dword [ecx], eax
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404def
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x348]
test ecx, ecx
je 0x404e0a
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x338], 0
je 0x404e1e
push dword [ebp - 0x338]
call fcn.0040e63e
cmp dword [ebp - 0x330], 0
je 0x404e2f
push dword [ebp - 0x330]
call edi
cmp dword [ebp - 0x324], 0
je 0x404e40
push dword [ebp - 0x324]
call edi
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x404e6b
mov eax, dword [ecx]
push ecx
call dword [eax + 0x7c]
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x404e6b
mov eax, dword [ecx + 4]
add ecx, 4
mov eax, dword [eax + 4]
add eax, ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411786
mov esp, ebp
pop ebp
ret 0x14