Function at 0x404336
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 0x110], 0x100
mov dword [ebp - 0x10c], 1
lea eax, [ebp - 0x108]
push eax
push GetSystemTime
push 0
push str.SYSTEMCurrentControlSetServicesUSBSTORENUM
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4045c9
mov dword [ebp - 0x114], 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
push str.Count
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
movsx edx, byte [ebp - 0x104]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x114]
jge 0x4045c2
call fcn.00403c72
test eax, eax
jle 0x4045ae
mov dword [ebp - 0x110], 0x100
mov byte [ebp - 0x11c], 0
xor ecx, ecx
mov word [ebp - 0x11b], cx
mov byte [ebp - 0x119], cl
push 0xa
lea edx, [ebp - 0x11c]
push edx
mov eax, dword [ebp - 0x118]
push eax
call fcn.00415a02
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40445e
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040bd10
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040c940
add esp, 4
cmp eax, 1
jbe 0x4044e8
mov dword [ebp - 0x120], 0
mov edx, dword [ebp + 8]
push edx
call fcn.0040c940
add esp, 4
sub eax, 1
cmp dword [ebp - 0x120], eax
jae 0x4044de
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x120]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x4044cd
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x120]
mov byte [edx], 0x2d
mov eax, dword [ebp - 0x120]
add eax, 1
mov dword [ebp - 0x120], eax
jmp 0x404499
mov eax, 1
jmp 0x4045e9
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x104
push 0
lea edx, [ebp - 0x238]
push edx
call fcn.0040be20
add esp, 0xc
mov eax, dword [ebp - 0x12e]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x132]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x134]
and edx, 0xffff
push edx
push str._d__d__d
lea eax, [ebp - 0x238]
push eax
call fcn.0040c1d5
add esp, 0x14
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040bd10
add esp, 8
mov dword [ebp - 0x124], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040c940
add esp, 4
sub eax, 1
cmp dword [ebp - 0x124], eax
jae 0x4045a7
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x124]
movsx edx, byte [ecx]
cmp edx, 0x5c
jne 0x404596
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x124]
mov byte [eax], 0x2d
mov ecx, dword [ebp - 0x124]
add ecx, 1
mov dword [ebp - 0x124], ecx
jmp 0x404562
mov eax, 1
jmp 0x4045e9
mov edx, dword [ebp - 0x118]
add edx, 1
mov dword [ebp - 0x118], edx
jmp 0x4043c6
mov eax, 1
jmp 0x4045e9
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.cant_query_value
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040bd10
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret