Function at 0x408412
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x63c
mov eax, 0x446381
call fcn.0042bfea
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x648], ecx
cmp word [eax], 0x2e
je 0x40843d
xor al, al
jmp 0x4087c9
xor ebx, ebx
push eax
cmp byte [ebp + 0x14], bl
je 0x4087cf
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x62c], ebx
call fcn.004051c4
push eax
lea eax, [ebp - 0x630]
mov dword [ebp - 4], ebx
push 0x44b680
push eax
call fcn.0040819e
add esp, 0xc
mov ecx, dword [ebp - 0x640]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x408491
call fcn.00403368
mov dword [ebp - 0x640], ebx
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x40849f
mov eax, dword [eax]
jmp 0x4084a1
mov eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x63c]
push ecx
lea ecx, [ebp - 0x62c]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push SysReAllocString
call edi
cmp dword [ebp - 0x62c], 0
jne 0x4084e7
mov ecx, dword [ebp - 0x630]
test ecx, ecx
je 0x408436
call fcn.00403368
jmp 0x408436
cmp dword [ebp - 0x63c], 2
jne 0x40857a
xor eax, eax
mov ebx, 0x206
push ebx
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0042a420
add esp, 0xc
mov dword [ebp - 0x638], ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x44acc4
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x638]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x4085fc
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
cmp word [ebp - 0x218], cx
je 0x40857a
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.0042a0ec
pop ecx
pop ecx
test eax, eax
jne 0x4084cf
push esi
call fcn.0042a04b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0x44acc4
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x634], 0
lea ecx, [ebp - 0x644]
push esi
call fcn.004051c4
push eax
lea eax, [ebp - 0x638]
mov byte [ebp - 4], 3
push 0x44b680
push eax
call fcn.0040819e
add esp, 0xc
lea ecx, [ebp - 0x630]
push eax
call fcn.0040399c
mov ecx, dword [ebp - 0x638]
test ecx, ecx
je 0x408601
call fcn.00403368
xor esi, esi
mov dword [ebp - 0x638], esi
jmp 0x408603
call fcn.0042d2e6
xor esi, esi
mov ecx, dword [ebp - 0x644]
test ecx, ecx
je 0x408612
call fcn.00403368
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x408620
mov eax, dword [eax]
jmp 0x408622
mov eax, esi
lea ecx, [ebp - 0x63c]
push ecx
lea ecx, [ebp - 0x634]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push SysReAllocString
call edi
cmp dword [ebp - 0x634], 0
je 0x4084cf
mov esi, dword [ebp - 0x648]
push esi
call fcn.0042a04b
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0x44acc4
push dword [ebp - 0x634]
call ebx
lea eax, [ebp - 0x63c]
xor esi, esi
push eax
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x44b6a4
push dword [ebp - 0x634]
call edi
cmp dword [ebp - 0x62c], esi
je 0x4084cf
mov eax, dword [0x45cca0]
test eax, eax
je 0x4086b8
mov eax, dword [eax]
jmp 0x4086ba
mov eax, esi
push eax
push 0x44b6cc
lea eax, [ebp - 0x628]
push 0x208
push eax
call fcn.0042a3e6
lea eax, [ebp - 0x628]
push eax
call fcn.0042a04b
add esp, 0x14
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x628]
push eax
push 1
push 0x44acc4
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x63c]
xor ecx, ecx
push eax
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x44b6e8
push dword [ebp - 0x634]
call edi
cmp dword [ebp - 0x62c], 0
je 0x4084cf
mov eax, dword [0x45cca0]
test eax, eax
je 0x408752
mov eax, dword [eax]
jmp 0x408754
xor eax, eax
push eax
push 0x44b700
lea eax, [ebp - 0x628]
push 0x208
push eax
call fcn.0042a3e6
lea eax, [ebp - 0x628]
push eax
call fcn.0042a04b
add esp, 0x14
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x628]
push eax
push 1
push 0x44acc4
push dword [ebp - 0x62c]
call ebx
push dword [ebp - 0x62c]
call esi
push dword [ebp - 0x634]
call esi
mov ecx, dword [ebp - 0x630]
test ecx, ecx
je 0x4087b7
call fcn.00403368
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov al, 1
call fcn.0042bf99
ret
mov edi, SysReAllocString
push edi
call fcn.0040836c
push esi
push edi
call fcn.0040836c
add esp, 0x10
jmp 0x4087b9