Function at 0x40bff7
Capabilities:
Access the windows event log
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2e4]
sub esp, 0x364
mov eax, dword [0x414050]
push ebx
xor ebx, ebx
push esi
push edi
push 0x405734
push 0xa
mov dword [ebp + 0x2e0], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x6c], ebx
call fcn.0040da55
cmp dword [0x4140c4], ebx
pop ecx
pop ecx
mov byte [ebp + 0x1d4], bl
mov byte [ebp + 0x2dc], bl
mov byte [ebp + 0xcc], bl
je 0x40c0e7
push 0x4056c8
push 0xa
call fcn.0040da55
mov eax, dword [0x4140a8]
xor esi, esi
pop ecx
inc esi
cmp eax, ebx
pop ecx
je 0x40c0d4
push esi
push eax
push 5
push esi
push dword [0x414094]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov edi, eax
cmp edi, ebx
jne 0x40c0a6
push 0x405678
push 0xa
call fcn.0040da55
pop ecx
pop ecx
mov dword [0x4140b8], esi
jmp 0x40c0d4
push edi
push 0x405620
push 0x14
call fcn.0040da55
add esp, 0xc
push edi
push 0x400007d4
call fcn.0040d5de
push 0x4055b0
push 0x14
call fcn.0040da55
pop ecx
pop ecx
call fcn.0040aaba
push 0x405560
push 0xa
call fcn.0040da55
mov eax, esi
jmp 0x40cff2
mov esi, 0x405528
push esi
push 0x405500
push 0xa
call fcn.0040da55
xor edi, edi
add esp, 0xc
inc edi
cmp dword [0x4140c0], ebx
je 0x40c112
cmp dword [0x414014], ebx
mov dword [ebp - 0x3c], edi
jne 0x40c115
mov dword [ebp - 0x3c], ebx
cmp dword [0x414094], ebx
jne 0x40c15a
push 0x414094
push 0x2001b
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
je 0x40c15a
push esi
push 0x4054b8
push 0x14
call fcn.0040da55
add esp, 0xc
push esi
push 0x800003e8
call fcn.0040d5de
jmp 0x40cfad
cmp dword [0x4140b4], ebx
jne 0x40c1cb
push 0x405468
push 0xa
call fcn.0040da55
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
mov dword [0x4140b4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [0x4140a8], eax
jne 0x40c1bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x405410
push 0x14
call fcn.0040da55
add esp, 0xc
push esi
push 0x800007d3
call fcn.0040d5de
push 0x4053a8
push 0x14
call fcn.0040da55
pop ecx
pop ecx
jmp 0x40c1cb
push eax
push 0x405360
push ebx
call fcn.0040da55
add esp, 0xc
mov eax, dword [0x4140a8]
cmp eax, ebx
je 0x40c22f
push edi
push eax
push 5
push edi
push dword [0x414094]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, eax
cmp esi, ebx
jne 0x40c201
push 0x405678
push 0xa
call fcn.0040da55
pop ecx
pop ecx
mov dword [0x4140b8], edi
jmp 0x40c22f
push esi
push 0x405620
push 0x14
call fcn.0040da55
add esp, 0xc
push esi
push 0x400007d4
call fcn.0040d5de
push 0x4055b0
push 0x14
call fcn.0040da55
pop ecx
pop ecx
call fcn.0040aaba
or dword [0x41401c], 0xffffffff
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xd0]
push eax
mov dword [ebp - 0x40], ebx
mov edi, 0x104
mov dword [0x414020], 0x270f
push ebx
jmp 0x40c6e7
cmp esi, ebx
jne 0x40c743
lea eax, [ebp + 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40c27a
sub eax, edx
push eax
lea eax, [ebp + 0xd0]
push eax
push 0x405320
push ebx
call fcn.0040da55
mov eax, dword [ebp - 0x50]
add esp, 0x10
dec eax
je 0x40c5cd
sub eax, 3
je 0x40c2cd
lea eax, [ebp + 0xd0]
push eax
push 0x4052e4
push ebx
call fcn.0040da55
push 0x405298
push ebx
call fcn.0040da55
add esp, 0x14
jmp 0x40c6c6
push 0x405260
push ebx
call fcn.0040da55
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
lea eax, [ebp + 0xd0]
push 0x405254
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x40c317
push 0x40521c
push ebx
call fcn.0040da55
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414024], eax
mov dword [ebp - 0x5c], 1
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x405210
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c354
push 0x4051d0
push ebx
call fcn.0040da55
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x74], eax
sete cl
mov dword [0x414010], ecx
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x4051c4
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c38c
push 0x405184
push ebx
call fcn.0040da55
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414090], eax
mov dword [ebp - 0x78], 1
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x405178
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c3c9
push 0x405128
push ebx
call fcn.0040da55
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x80], eax
sete cl
mov dword [0x4140ac], ecx
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x405110
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c406
push 0x4050b0
push ebx
call fcn.0040da55
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x6c], eax
sete cl
mov dword [0x414014], ecx
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x402c6c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c443
push 0x405050
push ebx
call fcn.0040da55
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x7c], eax
sete cl
mov dword [0x4140c0], ecx
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x405040
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c47b
push 0x404fe0
push ebx
call fcn.0040da55
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414078], eax
mov dword [ebp - 0x60], 1
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x404fd0
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c4b3
push 0x404f70
push ebx
call fcn.0040da55
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414068], eax
mov dword [ebp - 0x4c], 1
jmp 0x40c6c6
cmp dword [0x414018], ebx
je 0x40c4ec
lea eax, [ebp + 0xd0]
push 0x404f5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c4ec
push 0x404f10
push ebx
call fcn.0040da55
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x4142e0], eax
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x404efc
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c54a
push 0x404ea0
push ebx
call fcn.0040da55
mov esi, dword [ebp + 0x1d8]
push esi
push 0x404e50
push ebx
call fcn.0040da55
add esp, 0x14
cmp esi, ebx
je 0x40c53d
cmp esi, 0x418937
ja 0x40c53d
imul esi, esi, 0x3e8
mov dword [0x41401c], esi
jmp 0x40c6c6
push dword [0x41401c]
push 0x404e08
jmp 0x40c59c
lea eax, [ebp + 0xd0]
push 0x404df0
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c5aa
push 0x404da8
push ebx
call fcn.0040da55
mov esi, dword [ebp + 0x1d8]
push esi
push 0x404d50
push ebx
call fcn.0040da55
add esp, 0x14
cmp esi, 0x7fffffff
ja 0x40c591
mov dword [0x414020], esi
jmp 0x40c6c6
push dword [0x414020]
push 0x404d08
push ebx
call fcn.0040da55
add esp, 0xc
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push eax
push 0x4052e4
push ebx
call fcn.0040da55
lea eax, [ebp + 0x1d8]
push eax
push 0x404cc8
jmp 0x40c6bd
push 0x404c90
push ebx
call fcn.0040da55
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
lea eax, [ebp + 0xd0]
push 0x404c7c
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x40c620
push 0x404c3c
push ebx
call fcn.0040da55
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x4140c8
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [ebp - 0x70], 1
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x404c2c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c661
push 0x404bf0
push ebx
call fcn.0040da55
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x4142f8
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [0x414508], 1
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push 0x404be0
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x40c69f
push 0x404ba4
push ebx
call fcn.0040da55
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x4141d0
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [ebp - 0x68], 1
jmp 0x40c6c6
lea eax, [ebp + 0xd0]
push eax
push 0x4052e4
push ebx
call fcn.0040da55
lea eax, [ebp + 0x1d8]
push eax
push 0x404b64
push ebx
call fcn.0040da55
add esp, 0x18
inc dword [ebp - 0x40]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x40]
push dword [0x414094]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x54], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
cmp esi, 0x103
jne 0x40c269
cmp dword [0x4140b8], ebx
jne 0x40c714
call fcn.0040ab1c
push 0x404b18
push ebx
call fcn.0040da55
cmp dword [ebp - 0x70], ebx
pop ecx
pop ecx
jne 0x40c779
push 0x404ac8
push 0x14
call fcn.0040da55
pop ecx
pop ecx
push 0xc00003fa
call fcn.0040d56f
jmp 0x40cfad
push dword [ebp - 0x40]
push esi
push 0x404a68
push 0x14
call fcn.0040da55
add esp, 0x10
push dword [ebp - 0x40]
push esi
push 0xc00003f8
call fcn.0040d6c4
mov dword [0x4140b8], ebx
call fcn.0040aaba
call fcn.0040ab1c
jmp 0x40cfad
push 0x404a20
push ebx
call fcn.0040da55
cmp dword [ebp - 0x68], ebx
pop ecx
pop ecx
jne 0x40c7a0
push 0x4049d0
push 0x14
call fcn.0040da55
pop ecx
pop ecx
push 0xc00003fb
jmp 0x40c739
push 0x404988
push ebx
call fcn.0040da55
cmp dword [0x414508], ebx
pop ecx
pop ecx
push 0x4142f8
jne 0x40c7c1
push 0x404928
jmp 0x40c7c6
push 0x4048d8
push ebx
call fcn.0040da55
add esp, 0xc
push 0x404890
push ebx
call fcn.0040da55
cmp dword [ebp - 0x5c], ebx
pop ecx
pop ecx
push dword [0x414024]
jne 0x40c7ee
push 0x404830
jmp 0x40c7f3
push 0x4047e0
push ebx
call fcn.0040da55
add esp, 0xc
push 0x404798
push ebx
call fcn.0040da55
cmp dword [ebp - 0x78], ebx
pop ecx
pop ecx
jne 0x40c827
mov esi, 0x1000
push esi
push 0x404738
push ebx
call fcn.0040da55
mov dword [0x414090], esi
jmp 0x40c838
push dword [0x414090]
push 0x4046e8
push ebx
call fcn.0040da55
add esp, 0xc
mov esi, 0x4046a8
push esi
push ebx
call fcn.0040da55
cmp dword [ebp - 0x80], ebx
pop ecx
pop ecx
push dword [0x4140ac]
jne 0x40c85b
push 0x404650
jmp 0x40c860
push 0x404608
push ebx
call fcn.0040da55
add esp, 0xc
push esi
push ebx
call fcn.0040da55
cmp dword [ebp - 0x74], ebx
pop ecx
pop ecx
push dword [0x414010]
jne 0x40c884
push 0x4045a8
jmp 0x40c889
push 0x404558
push ebx
call fcn.0040da55
add esp, 0xc
push 0x404500
push ebx
call fcn.0040da55
cmp dword [ebp - 0x6c], ebx
pop ecx
pop ecx
jne 0x40c8bd
push 0x4044a0
push ebx
call fcn.0040da55
pop ecx
pop ecx
mov dword [0x414014], 1
jmp 0x40c8d1
push dword [0x414014]
push 0x404450
push ebx
call fcn.0040da55
add esp, 0xc
push 0x404400
push ebx
call fcn.0040da55
cmp dword [ebp - 0x7c], ebx
pop ecx
pop ecx
jne 0x40c8f8
push 0x4043a8
push ebx
call fcn.0040da55
pop ecx
pop ecx
mov dword [0x4140c0], ebx
jmp 0x40c90c
push dword [0x4140c0]
push 0x404358
push ebx
call fcn.0040da55
add esp, 0xc
push 0x404308
push ebx
call fcn.0040da55
cmp dword [ebp - 0x60], ebx
pop ecx
pop ecx
jne 0x40c93a
mov esi, 0x1f4
push esi
push 0x4042a8
push ebx
call fcn.0040da55
add esp, 0xc
mov dword [0x414078], esi
jmp 0x40c977
push dword [0x414078]
push 0x404258
push ebx
call fcn.0040da55
add esp, 0xc
push 2
pop esi
cmp dword [0x414078], esi
jae 0x40c977
push 0x4041f8
push ebx
call fcn.0040da55
pop ecx
pop ecx
push esi
push 0x800003f2
mov dword [0x414078], esi
call fcn.0040d5de
push 0x4041a8
push ebx
call fcn.0040da55
cmp dword [ebp - 0x4c], ebx
pop ecx
pop ecx
jne 0x40c9a5
mov esi, 0x12c
push esi
push 0x404148
push ebx
call fcn.0040da55
add esp, 0xc
mov dword [0x414068], esi
jmp 0x40c9e2
push dword [0x414068]
push 0x4040f8
push ebx
call fcn.0040da55
xor esi, esi
inc esi
add esp, 0xc
cmp dword [0x414068], esi
jae 0x40c9e2
push 0x4040a0
push ebx
call fcn.0040da55
pop ecx
pop ecx
push esi
push 0x800003f4
mov dword [0x414068], esi
call fcn.0040d5de
cmp dword [0x414014], ebx
je 0x40c9f2
cmp dword [0x4140c0], ebx
jne 0x40ca47
cmp dword [ebp - 0x3c], ebx
je 0x40ca64
push 0x404048
push 0xa
call fcn.0040da55
pop ecx
pop ecx
push 0x40000bc8
call fcn.0040d56f
cmp dword [0x4140bc], ebx
je 0x40ca37
xor esi, esi
cmp dword [0x414088], ebx
jbe 0x40ca37
mov eax, dword [0x414080]
push dword [eax + esi*4]
call fcn.0040ac86
inc esi
cmp esi, dword [0x414088]
jb 0x40ca21
cmp dword [0x414014], ebx
je 0x40ca64
cmp dword [0x4140c0], ebx
je 0x40ca64
cmp dword [ebp - 0x3c], ebx
jne 0x40ca64
push 0x403fe8
push 0xa
call fcn.0040da55
pop ecx
pop ecx
push 0x40000bc9
call fcn.0040d56f
push 0x4140c8
push 0x403fb0
push ebx
call fcn.0040da55
push 0x4141d0
push 0x403f80
push ebx
call fcn.0040da55
push dword [0x4140ac]
push 0x403f38
push ebx
call fcn.0040da55
push dword [0x414010]
push 0x403ee0
push ebx
call fcn.0040da55
add esp, 0x30
cmp dword [0x4140bc], ebx
je 0x40cad0
push 0x403e98
push ebx
call fcn.0040da55
push 0x403e50
push 0xa
call fcn.0040da55
add esp, 0x10
jmp 0x40ceca
mov esi, 0x403e24
push esi
push 0x405500
push 0xa
mov dword [0x4140bc], 1
call fcn.0040da55
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 9
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
je 0x40cb23
push esi
push 0x403de0
push 0x14
call fcn.0040da55
add esp, 0xc
push esi
push 0xc00003e9
jmp 0x40c150
mov esi, 0x105
push esi
lea eax, [ebp + 0x1d8]
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], esi
push ebx
jmp 0x40ce4f
cmp dword [ebp - 0x3c], ebx
jne 0x40ced2
call fcn.0040bf2f
lea eax, [ebp + 0x1d8]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
cmp eax, ebx
mov dword [ebp - 0x3c], eax
jne 0x40cba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x403da4
push 0x14
mov dword [ebp - 0x4c], eax
call fcn.0040da55
lea eax, [ebp + 0x1d8]
push eax
push 0x403d74
push 0x14
call fcn.0040da55
add esp, 0x18
push dword [ebp - 0x4c]
lea eax, [ebp + 0x1d8]
push eax
push 0x80000bbf
call fcn.0040d7f8
jmp 0x40ce42
push dword [ebp - 0x3c]
call fcn.0040ac86
test eax, eax
je 0x40cf05
mov eax, dword [0x414088]
lea eax, [eax*4 + 4]
push eax
push dword [0x414080]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x40cf3b
push eax
push 0x403d34
push ebx
mov dword [0x414080], eax
call fcn.0040da55
mov eax, dword [0x414088]
mov ecx, dword [0x414080]
mov edx, dword [ebp - 0x3c]
mov dword [ecx + eax*4], edx
mov eax, dword [0x41408c]
add esp, 0xc
add eax, 0x105
push eax
push dword [0x41407c]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x40cf50
push eax
push 0x403cf0
push ebx
mov dword [0x41407c], eax
call fcn.0040da55
add dword [0x41408c], esi
mov eax, dword [0x41407c]
mov ecx, dword [0x41408c]
mov byte [eax + ecx - 1], bl
push edi
lea eax, [ebp + 0x1d8]
push eax
mov eax, dword [0x414088]
imul eax, eax, 0x105
add eax, dword [0x41407c]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
mov eax, dword [0x414088]
add esp, 0x18
lea eax, [eax*4 + 4]
push eax
push dword [0x414084]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x40cf6a
push eax
push 0x403ca0
push ebx
mov dword [0x414084], eax
call fcn.0040da55
push edi
lea eax, [ebp - 0x38]
push 0x403e24
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
lea eax, [ebp - 0x38]
add esp, 0x18
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ccaa
sub eax, esi
lea ecx, [ebp + 0x1d8]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40ccbe
sub ecx, eax
lea eax, [ecx + esi + 1]
cmp eax, edi
ja 0x40cf7f
lea eax, [ebp + 0x1d8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ccdb
lea edi, [ebp - 0x38]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x40cce8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x38]
push eax
and ecx, 3
push 0x403c58
push 0xa
rep movsb byte es:[edi], byte [esi]
call fcn.0040da55
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x40cfb1
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x403c48
push dword [ebp - 0x58]
mov dword [ebp - 0x48], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40cd8f
push eax
mov eax, dword [0x414088]
imul eax, eax, 0x105
add eax, dword [0x41407c]
push eax
push 0x403be8
push 0x14
call fcn.0040da55
add esp, 0x10
mov eax, dword [0x414088]
mov ecx, dword [0x414084]
mov dword [ecx + eax*4], ebx
jmp 0x40cdd1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp - 0x58]
mov dword [ebp - 0x64], 1
call fcn.0040dbc9
cmp eax, ebx
je 0x40cdbf
push eax
push 0x403b98
push 0x14
call fcn.0040da55
add esp, 0xc
jmp 0x40cd7f
mov eax, dword [ebp - 0x60]
mov ecx, dword [0x414088]
mov edx, dword [0x414084]
mov dword [edx + ecx*4], eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x414088]
imul eax, eax, 0x105
add eax, dword [0x41407c]
push eax
push 0x403b64
push ebx
call fcn.0040da55
push dword [ebp - 0x3c]
push dword [0x414088]
push 0x403b30
push ebx
call fcn.0040da55
mov eax, dword [0x414088]
mov ecx, dword [0x414084]
push dword [ecx + eax*4]
push eax
push 0x403af0
push ebx
call fcn.0040da55
add esp, 0x2c
inc dword [0x414088]
inc dword [ebp - 0x40]
mov dword [ebp - 0x48], 0x105
mov esi, 0x105
mov edi, 0x104
push dword [ebp - 0x48]
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
mov dword [ebp - 0x3c], eax
jne 0x40cb3c
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x414088]
push 0x403ab0
push ebx
call fcn.0040da55
add esp, 0xc
xor edi, edi
cmp dword [0x414088], ebx
jbe 0x40cec4
mov dword [ebp - 0x3c], ebx
mov eax, dword [0x41407c]
mov ecx, dword [ebp - 0x3c]
add eax, ecx
push eax
mov eax, dword [0x414080]
push dword [eax + edi*4]
push edi
push 0x403a80
push ebx
call fcn.0040da55
add dword [ebp - 0x3c], esi
add esp, 0x14
inc edi
cmp edi, dword [0x414088]
jb 0x40ce90
cmp dword [0x414088], ebx
je 0x40cfe4
xor eax, eax
inc eax
jmp 0x40cff4
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0x403a20
push 0x14
call fcn.0040da55
add esp, 0x10
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0xc00003f9
call fcn.0040d6c4
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40cfad
push 0x4039d0
push 0x14
call fcn.0040da55
pop ecx
pop ecx
push 0x80000bb9
call fcn.0040d56f
push 0xc00007e3
call fcn.0040d56f
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x40cfad
push 0x403990
push 0x14
call fcn.0040da55
pop ecx
pop ecx
push 0xc0000bc2
jmp 0x40cf22
push 0x40394c
push 0x14
call fcn.0040da55
pop ecx
pop ecx
push 0xc0000bc4
call fcn.0040d56f
jmp 0x40cf9e
push 0x403900
push 0x14
call fcn.0040da55
pop ecx
pop ecx
push 0xc0000bc5
jmp 0x40cf63
lea eax, [ebp - 0x38]
push eax
push 0x4038c8
push 0x14
call fcn.0040da55
push 0x403880
push 0xa
call fcn.0040da55
add esp, 0x14
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [0x414088]
xor eax, eax
jmp 0x40cff4
push esi
lea eax, [ebp - 0x38]
push eax
push 0x403818
push 0x14
call fcn.0040da55
add esp, 0x10
push esi
lea eax, [ebp - 0x38]
push eax
push 0x80001393
call fcn.0040d7f8
push 0x403880
push 0xa
call fcn.0040da55
pop ecx
pop ecx
jmp 0x40cf9e
push 0x4037c8
push 0x14
call fcn.0040da55
xor eax, eax
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2e0]
pop edi
pop esi
pop ebx
call fcn.00412af8
add ebp, 0x2e4
leave
ret