Function at 0x405fb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], str.kNT3rfecee42t96b2872ta3y_101ar469c_00aa00341d071
mov eax, 0x95
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx]
sub eax, 0x2c
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov edx, 0x88
mov eax, dword [ebp - 8]
mov word [eax + 0x12], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x12]
sub edx, 0x2c
mov eax, dword [ebp - 8]
mov word [eax + 0x12], dx
mov ecx, 0x91
mov edx, dword [ebp - 8]
mov word [edx + 6], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 6]
sub ecx, 0x2c
mov edx, dword [ebp - 8]
mov word [edx + 6], cx
mov eax, 0x92
mov ecx, dword [ebp - 8]
mov word [ecx + 0xa], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0xa]
sub eax, 0x2c
mov ecx, dword [ebp - 8]
mov word [ecx + 0xa], ax
mov edx, 0x65
mov eax, dword [ebp - 8]
mov word [eax + 0xc], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0xc]
sub edx, 4
mov eax, dword [ebp - 8]
mov word [eax + 0xc], dx
mov ecx, 0xa7
mov edx, dword [ebp - 8]
mov word [edx + 0x14], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x14]
sub ecx, 0x2c
mov edx, dword [ebp - 8]
mov word [edx + 0x14], cx
mov eax, 0x8b
mov ecx, dword [ebp - 8]
mov word [ecx + 0x16], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x16]
sub eax, 0x29
mov ecx, dword [ebp - 8]
mov word [ecx + 0x16], ax
mov edx, 0x5a
mov eax, dword [ebp - 8]
mov word [eax + 0x18], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x18]
sub edx, 0x29
mov eax, dword [ebp - 8]
mov word [eax + 0x18], dx
mov ecx, 0x59
mov edx, dword [ebp - 8]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x26]
sub ecx, 0x2c
mov edx, dword [ebp - 8]
mov word [edx + 0x26], cx
mov eax, 0x8e
mov ecx, dword [ebp - 8]
mov word [ecx + 0x28], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x28]
sub eax, 0x2c
mov ecx, dword [ebp - 8]
mov word [ecx + 0x28], ax
mov edx, 0x8e
mov eax, dword [ebp - 8]
mov word [eax + 0x2c], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x2c]
sub edx, 0x2c
mov eax, dword [ebp - 8]
mov word [eax + 0x2c], dx
mov ecx, 0x60
mov edx, dword [ebp - 8]
mov word [edx + 0x2e], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x2e]
sub ecx, 0x2c
mov edx, dword [ebp - 8]
mov word [edx + 0x2e], cx
mov eax, 0x59
mov ecx, dword [ebp - 8]
mov word [ecx + 0x3a], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x3a]
sub eax, 0x2c
mov ecx, dword [ebp - 8]
mov word [ecx + 0x3a], ax
mov edx, 0x8e
mov eax, dword [ebp - 8]
mov word [eax + 0x3c], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x3c]
sub edx, 0x2c
mov eax, dword [ebp - 8]
mov word [eax + 0x3c], dx
mov ecx, pe_nt_image_headers32
mov edx, dword [ebp - 8]
mov word [edx + 0x5e], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x5e]
sub ecx, 3
mov edx, dword [ebp - 8]
mov word [edx + 0x5e], cx
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0xc], eax
push 0x801434
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x7ff158]
sub edx, 0x3018
push edx
call dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4061a2
mov eax, 1
test eax, eax
je 0x4061a2
jmp 0x406197
mov ecx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [0x801438], ecx
mov eax, 0x403190
call eax
mov dword [0x7ff140], 0
mov edx, dword [0x7ff140]
mov dword [0x7ff144], edx
mov dword [0x7ff13c], 0x613
mov esp, ebp
pop ebp
ret