Function at 0x406ad0
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539aa3
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x589c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0041ced4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406b18
push 0x80004005
call fcn.0040ab10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x634], eax
mov dword [ebp - 4], 0
call fcn.0041ced4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406b4b
push 0x80004005
call fcn.0040ab10
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x63c], ebx
mov byte [ebp - 4], 1
call fcn.0041c284
mov esi, dword [eax + 8]
push 0x567f70
push 0x56814c
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x406bb5
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test ebx, ebx
je 0x406baf
test eax, eax
je 0x406baf
push eax
lea ecx, [ebp - 0x63c]
push 0x567f8c
push ecx
call fcn.0040a810
add esp, 0xc
mov ebx, dword [ebp - 0x63c]
cmp dword [ebx - 0xc], 0
jne 0x406c0b
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406bdb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406c04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
jmp 0x40725e
push ebx
push 0x56822c
push 0xffffffffffffffff
lea ecx, [ebp - 0x420]
push 0x104
push ecx
mov dword [ebp - 0x654], 0x208
mov dword [ebp - 0x650], 0
call fcn.005128f5
add esp, 0x14
lea edx, [ebp - 0x650]
push edx
lea eax, [ebp - 0x420]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x650]
test eax, eax
je 0x406c98
lea ecx, [ebp - 0x654]
push ecx
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x644]
push ecx
push 0
push 0x568258
push eax
mov dword [ebp - 0x644], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x650]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x640]
call fcn.00409de0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x640]
cmp dword [eax - 0xc], 0
jne 0x406d03
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406cda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406bdb
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
jmp 0x406bdb
lea ecx, [ebp - 0x640]
push ecx
call fcn.00408030
add esp, 4
lea ecx, [ebp - 0x66c]
call fcn.0041fd9e
push 0x567f70
push str.WHRESOURCES
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x406d5a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test ebx, ebx
je 0x406d54
test edi, edi
jne 0x406db8
mov ebx, dword [ebp - 0x63c]
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 2
call fcn.0041ffdc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406d8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406bdb
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
jmp 0x406bdb
lea esi, [ebp - 0x64c]
call fcn.00408220
mov byte [ebp - 4], 4
mov esi, dword [ebp - 0x64c]
push ebx
call fcn.004074c0
add esp, 4
test eax, eax
jne 0x406e54
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406e00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 2
call fcn.0041ffdc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406e35
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x406bcf
lea ecx, [ebp - 0x638]
push ecx
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x644]
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x644], ebx
call fcn.00407750
add esp, 4
mov dword [ebp - 0x670], eax
test eax, eax
jne 0x406ecb
lea ecx, [ebp - 0x64c]
call fcn.0040aaf0
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 2
call fcn.0041ffdc
lea ecx, [ebp - 0x640]
call fcn.0040aaf0
lea ecx, [ebp - 0x63c]
call fcn.0040aaf0
lea ecx, [ebp - 0x634]
call fcn.0040aaf0
xor al, al
jmp 0x40725e
xor ebx, ebx
test eax, eax
je 0x407111
jmp 0x406ee6
mov ebx, dword [ebp - 0x644]
mov edx, dword [ebp - 0x638]
lea esi, [ebx + edx]
mov ecx, 0x84
lea edi, [ebp - 0x630]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x428]
push eax
add ebx, 0x210
call fcn.00413b60
mov ecx, dword [ebp - 0x428]
mov edx, dword [ebp - 0x638]
add esp, 4
mov esi, eax
push ecx
lea eax, [ebx + edx]
push eax
push esi
call fcn.005177b0
add ebx, dword [ebp - 0x428]
add esp, 0xc
mov dword [ebp - 0x644], ebx
call fcn.0041ced4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x406b0e
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x648], eax
lea ecx, [ebp - 0x630]
push ecx
lea edx, [ebp - 0x640]
push edx
lea eax, [ebp - 0x658]
mov bl, 5
push eax
mov byte [ebp - 4], bl
call fcn.00409660
add esp, 0xc
push eax
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 6
call fcn.00409960
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x658]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406fb6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ebx, [ebp - 0x648]
call fcn.00408a10
mov ecx, dword [ebp - 0x648]
push ecx
call fcn.00407280
add esp, 4
lea ecx, [ebp - 0x688]
call fcn.00420621
push 0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x648]
push 0x3002
push edx
lea ecx, [ebp - 0x688]
call fcn.00420b38
test eax, eax
je 0x407069
push 0
push 0
lea ecx, [ebp - 0x688]
call fcn.004204d7
mov eax, dword [ebp - 0x688]
mov edx, dword [eax + 0x2c]
push 0
push 0
push 0
lea ecx, [ebp - 0x688]
call edx
mov eax, dword [ebp - 0x428]
push eax
push esi
lea ecx, [ebp - 0x688]
call fcn.00420358
lea ecx, [ebp - 0x688]
call fcn.00420444
lea ecx, [ebp - 0x688]
call fcn.004205bc
cmp dword [ebp - 0x424], 0
je 0x407069
mov edx, dword [ebp - 0x664]
mov ecx, ebx
push ecx
push edx
lea ecx, [ebp - 0x66c]
call fcn.00420135
test esi, esi
je 0x407076
push esi
call fcn.00413b6b
add esp, 4
mov esi, dword [ebp - 0x644]
mov eax, esi
mov dword [ebp - 0x674], eax
fild dword [ebp - 0x674]
test eax, eax
jns 0x407094
fadd dword [0x569428]
mov edi, dword [ebp - 0x670]
mov ecx, edi
mov dword [ebp - 0x674], ecx
fild dword [ebp - 0x674]
test ecx, ecx
jns 0x4070b2
fadd dword [0x569428]
fdivp st(1)
fmul qword [0x569420]
call fcn.005163a0
push eax
lea edx, [ebp - 0x634]
push 0x568aac
push edx
call fcn.0040a810
add esp, 0xc
lea ecx, [ebp - 0x688]
mov byte [ebp - 4], 5
call fcn.0042078f
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x648]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407109
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, edi
jb 0x406ee0
mov eax, dword [ebp - 0x664]
xor edi, edi
test eax, eax
jle 0x4071b2
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
test edi, edi
js 0x40727a
cmp edi, eax
jge 0x40727a
mov ecx, dword [ebp - 0x668]
lea eax, [ecx + edi*4]
push eax
lea ecx, [ebp - 0x638]
call fcn.004095d0
mov byte [ebp - 4], 8
mov esi, dword [ebp - 0x638]
mov eax, esi
call fcn.00407fc0
test eax, eax
jne 0x407183
push 0x568668
lea ecx, [ebp - 0x638]
call fcn.0040a510
mov esi, dword [ebp - 0x638]
push 0x10
push 0x568270
push esi
push 0
call ebx
lea eax, [esi - 0x10]
mov byte [ebp - 4], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4071a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x664]
inc edi
cmp edi, eax
jl 0x407127
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x64c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4071d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x66c]
mov byte [ebp - 4], 2
call fcn.0041ffdc
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x640]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40720d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x63c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407233
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x634]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40725c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005121e3
mov esp, ebp
pop ebp
ret
call fcn.0041dc05
int3