Function at 0x404ad0
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
mov eax, 0x1378
call fcn.00435d80
mov eax, dword [0x452504]
mov dword [esp + 0x1374], eax
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x45370e
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404767
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x18], al
lea eax, [esp + 0x10]
push eax
push 0
push 0x45380e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40477c
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x1374]
call fcn.00435083
add esp, 0x1378
ret
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00415fa0
mov cl, byte [eax + 0x12533]
test cl, cl
jne 0x404809
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x4536e6
push 0x4536d1
lea ecx, [esp + 0x124]
push str._ID_s__PWD_s
push ecx
call esi
push 0x63
push 0x30783135
lea edx, [esp + 0x260]
push edx
lea eax, [esp + 0x138]
push eax
call fcn.0041d560
add esp, 0x20
test eax, eax
jne 0x4047ed
pop esi
mov ecx, dword [esp + 0x1374]
call fcn.00435083
add esp, 0x1378
ret
lea ecx, [esp + 0x248]
push ecx
lea edx, [esp + 0x378]
push str._ENC_s__HANGAME
push edx
call esi
add esp, 0xc
jmp 0x404858
push 2
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x37c]
push ecx
mov word [esp + 0x10], 0x22
call fcn.00435f00
call fcn.00415fa0
push 0x1000
add eax, 0x7162
push eax
lea edx, [esp + 0x388]
push edx
call fcn.00435dc0
push 2
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x394]
push ecx
call fcn.00435dc0
add esp, 0x24
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 5
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x20]
push 0x453841
push ecx
call fcn.0041a9a0
mov ecx, dword [esp + 0x138c]
add esp, 0x14
neg eax
sbb eax, eax
neg eax
pop esi
call fcn.00435083
add esp, 0x1378
ret
mov eax, 0x1378
call fcn.00435d80
mov eax, dword [0x452504]
mov dword [esp + 0x1374], eax
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x45370e
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404aae
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x18], al
lea eax, [esp + 0x10]
push eax
push 0
push 0x45380e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404930
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x1374]
call fcn.00435083
add esp, 0x1378
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4536c6
push str.PSTALE
call fcn.0043bc84
add esp, 8
test eax, eax
jne 0x404a9a
push esi
call fcn.00415fa0
mov cl, byte [eax + 0x12533]
test cl, cl
jne 0x4049f5
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x4536e6
push 0x4536d1
lea ecx, [esp + 0x124]
push str._ID_s__PWD_s
push ecx
call esi
push 0x63
push 0x30783135
lea edx, [esp + 0x260]
push edx
lea eax, [esp + 0x138]
push eax
call fcn.0041d560
add esp, 0x20
test eax, eax
jne 0x4049d4
push eax
push 0xdc
push 0x180007
call fcn.0041a7d0
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1374]
call fcn.00435083
add esp, 0x1378
ret
lea ecx, [esp + 0x248]
push ecx
push 0x453874
lea edx, [esp + 0x37c]
push str._URL_s__ENC_s__HANGAME
push edx
call esi
add esp, 0x10
jmp 0x404a44
push 2
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x37c]
push ecx
mov word [esp + 0x10], 0x22
call fcn.00435f00
call fcn.00415fa0
push 0x1000
add eax, 0x7162
push eax
lea edx, [esp + 0x388]
push edx
call fcn.00435dc0
push 2
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x394]
push ecx
call fcn.00435dc0
add esp, 0x24
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 5
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x20]
push 0x453841
push ecx
call fcn.0041a9a0
add esp, 0x14
test eax, eax
jne 0x404a81
push eax
push 0xdc
push 0xa0002
jmp 0x4049b6
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1374]
call fcn.00435083
add esp, 0x1378
ret
push 0
push 0xdc
push 0x180007
call fcn.0041a7d0
add esp, 0xc
mov ecx, dword [esp + 0x1374]
xor eax, eax
call fcn.00435083
add esp, 0x1378
ret
mov al, byte [0x4541fc]
cmp al, 0x67
je 0x404ae5
cmp al, 0x70
je 0x404ae0
xor eax, eax
ret
jmp 0x4046f0
jmp 0x4048a0