Function at 0x4042f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421522
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x432004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x37c], eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x290], ecx
test ecx, ecx
je 0x404344
mov eax, dword [ecx]
push ecx
call dword [eax]
add esp, 4
xor eax, eax
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x294], 7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x29c]
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
mov word [ebp - 0x28c], ax
call fcn.004020cd
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 1]
cmp ecx, eax
jae 0x4051c9
mov eax, dword [ebp + 8]
cmp word [eax + ecx*2], 0x5c
je 0x404467
mov eax, 0x42ee40
xor ebx, ebx
lea eax, [eax + 2]
inc ebx
cmp word [eax], 0
jne 0x4043c3
test ebx, ebx
je 0x404467
xor eax, eax
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
push ebx
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x29c]
call fcn.0040214d
mov ecx, dword [ebp - 0x298]
lea esi, [ebx + ebx]
mov eax, dword [ebp - 0x29c]
push esi
push 0x42ee40
lea edi, [eax + ecx*2]
push edi
call fcn.0040a280
add dword [ebp - 0x298], ebx
xor eax, eax
mov word [esi + edi], ax
add esp, 0xc
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x21c]
test esi, esi
je 0x404467
mov ecx, dword [ebp - 0x218]
test ecx, ecx
je 0x404467
mov ecx, dword [ecx]
test ecx, ecx
je 0x404457
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404467
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x2bc], eax
xor eax, eax
mov dword [ebp - 0x2b4], 7
mov word [ebp - 0x2ac], ax
lea eax, [ebp - 0x340]
mov byte [ebp - 4], 4
push eax
push fcn.004042f0
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x4044e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00401366
mov esi, eax
test esi, esi
js 0x4050e3
push dword [ebp - 0x340]
lea ecx, [ebp - 0x2bc]
call fcn.004029f5
mov esi, eax
add esp, 4
test esi, esi
js 0x4050e3
mov edx, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x35c], 0
mov dword [ebp - 0x340], 0x2f
lea edi, [edx + eax*2]
mov eax, 0x3a
mov ecx, edi
lea ebx, [eax + 0x22]
cmp edi, edx
je 0x40456e
lea esp, [esp]
movzx eax, word [ecx - 2]
cmp bx, ax
je 0x404556
cmp word [ebp - 0x340], ax
je 0x404556
xor al, al
jmp 0x404558
mov al, 1
test al, al
jne 0x404565
add ecx, 0xfffffffe
cmp ecx, edx
jne 0x404540
jmp 0x404569
cmp edx, ecx
jne 0x404583
mov eax, 0x3a
sub edi, edx
and edi, 0xfffffffe
cmp edi, 4
jl 0x404581
lea ecx, [edx + 4]
cmp ax, word [edx + 2]
je 0x404583
mov ecx, edx
mov eax, ecx
mov dword [ebp - 0x360], edx
sub eax, edx
mov dword [ebp - 0x35c], ecx
sar eax, 1
cmp eax, 1
jbe 0x4045cb
movzx eax, word [ecx - 2]
lea edx, [ecx - 2]
cmp bx, ax
je 0x4045b4
mov esi, 0x2f
cmp si, ax
je 0x4045b4
xor al, al
jmp 0x4045b6
mov al, 1
test al, al
je 0x4045cb
mov eax, 0x3a
cmp ax, word [ecx - 4]
je 0x4045cb
mov dword [ebp - 0x35c], edx
lea edx, [ebp - 0x360]
lea ecx, [ebp - 0x31c]
call fcn.00406840
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x2b8]
lea edi, [ecx + eax*2]
mov eax, edi
cmp edi, ecx
je 0x40461e
movzx edx, word [eax - 2]
cmp bx, dx
je 0x40460b
cmp word [ebp - 0x340], dx
je 0x40460b
xor dl, dl
jmp 0x40460d
mov dl, 1
test dl, dl
jne 0x40461a
add eax, 0xfffffffe
cmp eax, ecx
jne 0x4045f5
jmp 0x40461e
cmp ecx, eax
jne 0x40463a
mov eax, edi
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 4
jl 0x404638
mov eax, 0x3a
cmp ax, word [ecx + 2]
lea eax, [ecx + 4]
je 0x40463a
mov eax, ecx
lea edx, [ebp - 0x360]
mov dword [ebp - 0x360], eax
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x35c], edi
call fcn.00406840
mov byte [ebp - 4], 6
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x2d0], ecx
test ecx, ecx
je 0x404670
mov eax, dword [ecx]
push ecx
call dword [eax]
add esp, 4
xor eax, eax
mov dword [ebp - 0x2d8], 0
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d4], 7
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2dc]
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
mov word [ebp - 0x2cc], ax
call fcn.004020cd
mov bl, byte [ebp + 0x28]
lea eax, [ebp - 0x364]
push eax
movzx eax, bl
lea ecx, [ebp - 0x340]
shl eax, 9
add eax, 9
mov byte [ebp - 4], 8
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x340], 3
call fcn.00403980
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
call fcn.00401366
test eax, eax
jns 0x404720
mov esi, 0xa0010003
jmp 0x404f66
mov eax, dword [ebp - 0x364]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x380], eax
mov byte [ebp - 0x398], 0
mov dword [ebp - 0x394], esi
mov dword [ebp - 0x390], eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x374]
mov byte [ebp - 4], 9
push ecx
lea ecx, [ebp - 0x36c]
mov dword [ebp - 0x36c], 0
push ecx
push 0
push 0
push 0
push eax
mov dword [ebp - 0x374], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor edi, edi
mov dword [ebp - 0x340], edi
cmp dword [ebp - 0x36c], edi
jbe 0x404f51
jmp 0x4047a0
push 0x1fe
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00408d70
add esp, 0xc
mov dword [ebp - 0x378], 0xff
lea eax, [ebp - 0x378]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x364]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x404f3e
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x270], ecx
test ecx, ecx
je 0x404803
mov eax, dword [ecx]
push ecx
call dword [eax]
add esp, 4
xor eax, eax
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x274], 7
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x27c]
push dword [ebp - 0x298]
xor eax, eax
push dword [ebp - 0x29c]
mov word [ebp - 0x26c], ax
call fcn.004020cd
xor ecx, ecx
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x210]
cmp word [ebp - 0x210], cx
je 0x404880
lea eax, [eax + 2]
inc ecx
cmp word [eax], 0
jne 0x404876
push ecx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x27c]
call fcn.004020cd
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp - 0x250], ecx
test ecx, ecx
je 0x4048ab
mov eax, dword [ecx]
push ecx
call dword [eax]
add esp, 4
xor eax, eax
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x254], 7
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x25c]
push dword [ebp - 0x2f8]
xor eax, eax
push dword [ebp - 0x2fc]
mov word [ebp - 0x24c], ax
call fcn.004020cd
xor eax, eax
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x23c], eax
xor eax, eax
mov dword [ebp - 0x234], 7
mov word [ebp - 0x22c], ax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x368]
push eax
movzx eax, bl
shl eax, 9
inc eax
mov dword [ebp - 0x358], 3
push eax
push 0
push dword [ebp - 0x27c]
call fcn.00403980
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
call fcn.00401366
test eax, eax
jns 0x404aa9
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x234], 0
jbe 0x4049e1
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x22c]
cmp esi, eax
je 0x4049e1
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x4049d1
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x4049e1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x4049f4
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x254], 0
jbe 0x404a37
mov esi, dword [ebp - 0x25c]
lea eax, [ebp - 0x24c]
cmp esi, eax
je 0x404a37
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x404a27
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404a37
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x404a4a
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 9
cmp dword [ebp - 0x274], 0
jbe 0x404a8d
mov esi, dword [ebp - 0x27c]
lea eax, [ebp - 0x26c]
cmp esi, eax
je 0x404a8d
mov ecx, dword [ebp - 0x270]
test ecx, ecx
je 0x404a7d
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404a8d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x270]
test ecx, ecx
je 0x404f38
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
jmp 0x404f38
mov ebx, dword [ebp - 0x368]
mov byte [ebp - 0x38c], 0
mov dword [ebp - 0x388], esi
mov dword [ebp - 0x384], ebx
lea eax, [ebp - 0x354]
mov dword [ebp - 0x354], 0
push eax
push eax
push 0
push 0
push dword [ebp - 0x25c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x404e28
mov esi, dword [ebp - 0x354]
test esi, 1
jne 0x404e28
mov dword [ebp - 0x358], 0
lea eax, [ebp - 0x350]
shr esi, 1
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x344], 0
mov byte [ebp - 4], 0x12
jne 0x404b3a
xor eax, eax
mov dword [ebp - 0x350], 0
xor ecx, ecx
jmp 0x404b4f
push esi
lea ecx, [ebp - 0x344]
call fcn.00406a40
mov dword [ebp - 0x350], eax
lea ecx, [eax + esi*2]
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x34c], eax
mov byte [ebp - 4], 0x13
test esi, esi
je 0x404b93
lea edi, [esi + esi]
sub ecx, eax
cmp ecx, edi
jb 0x404b80
push edi
push 0
push eax
call fcn.00408d70
add esp, 0xc
add dword [ebp - 0x34c], edi
jmp 0x404b8d
push esi
push ecx
lea ecx, [ebp - 0x350]
call fcn.00406ca0
mov edi, dword [ebp - 0x340]
mov dword [ebp - 0x3a0], 0
mov dword [ebp - 0x39c], 0
lea eax, [ebp - 0x354]
push eax
push dword [ebp - 0x350]
push 0
push 0
push dword [ebp - 0x25c]
push dword [ebp - 0x368]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
call fcn.00401366
lea ecx, [ebp - 0x3a0]
mov esi, eax
call fcn.00401d10
test esi, esi
jns 0x404cb3
mov byte [ebp - 4], 0xf
mov esi, dword [ebp - 0x350]
mov dword [ebp - 0x34c], esi
test esi, esi
je 0x404c20
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404c10
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404c20
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404c33
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
push ebx
mov byte [ebp - 4], 0x17
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x234], 0
jbe 0x404c81
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x22c]
cmp esi, eax
je 0x404c81
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x404c71
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404c81
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x404c94
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
lea ecx, [ebp - 0x25c]
call fcn.00401e11
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 9
call fcn.00401e11
jmp 0x404f35
mov edx, dword [ebp - 0x350]
mov eax, edx
mov ecx, dword [ebp - 0x34c]
cmp eax, ecx
je 0x404cd2
cmp word [eax], 0
je 0x404cd2
add eax, 2
cmp eax, ecx
jne 0x404cc5
mov dword [ebp - 0x358], 0
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
sub eax, edx
mov byte [ebp - 4], 0x1a
sar eax, 1
cmp word [edx], 0
jne 0x404d0a
mov edx, 0x42ede8
lea ecx, [ebp - 0x358]
push ecx
push eax
push edx
lea ecx, [ebp - 0x33c]
call fcn.00401e24
mov eax, dword [ebp - 0x370]
or eax, 8
mov dword [ebp - 4], 0x15
and eax, 0xfffffff7
or eax, 4
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x37c], eax
lea eax, [ebp - 0x33c]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x23c]
call fcn.00406030
lea ecx, [ebp - 0x33c]
call fcn.00401e11
push 1
mov byte [ebp - 4], 0x1c
call fcn.0041d6a4
mov dword [ebp - 0x3a4], eax
lea eax, [ebp - 0x3a8]
mov byte [ebp - 4], 0x1d
push eax
lea edx, [ebp - 0x2bc]
lea ecx, [ebp - 0x23c]
call fcn.00406720
add esp, 8
lea ecx, [ebp - 0x3a8]
mov bl, al
call fcn.00403380
mov byte [ebp - 4], 0xf
mov esi, dword [ebp - 0x350]
mov dword [ebp - 0x34c], esi
test bl, bl
jne 0x404fa4
test esi, esi
je 0x404de0
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404dd0
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404de0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404df3
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
lea ecx, [ebp - 0x38c]
call fcn.00405ff0
lea ecx, [ebp - 0x23c]
call fcn.00401e11
lea ecx, [ebp - 0x25c]
call fcn.00401e11
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 9
call fcn.00401e11
jmp 0x404f35
push ebx
mov byte [ebp - 4], 0x10
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x234], 0
jbe 0x404e76
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x22c]
cmp esi, eax
je 0x404e76
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x404e66
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404e76
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x404e89
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x254], 0
jbe 0x404ecc
mov esi, dword [ebp - 0x25c]
lea eax, [ebp - 0x24c]
cmp esi, eax
je 0x404ecc
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x404ebc
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404ecc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x250]
test ecx, ecx
je 0x404edf
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 9
cmp dword [ebp - 0x274], 0
jbe 0x404f22
mov esi, dword [ebp - 0x27c]
lea eax, [ebp - 0x26c]
cmp esi, eax
je 0x404f22
mov ecx, dword [ebp - 0x270]
test ecx, ecx
je 0x404f12
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404f22
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x270]
test ecx, ecx
je 0x404f35
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov bl, byte [ebp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov dword [ebp - 0x340], edi
cmp edi, dword [ebp - 0x36c]
jb 0x4047a0
mov esi, 0xa0010001
mov byte [ebp - 4], 0x1e
push dword [ebp - 0x380]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 6
cmp dword [ebp - 0x2d4], 0
jbe 0x405024
mov edi, dword [ebp - 0x2dc]
lea eax, [ebp - 0x2cc]
cmp edi, eax
je 0x405024
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x405014
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x405024
test esi, esi
je 0x404fce
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404fbe
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x404fce
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x404fe1
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
lea ecx, [ebp - 0x38c]
call fcn.00405ff0
lea ecx, [ebp - 0x23c]
call fcn.00401e11
lea ecx, [ebp - 0x25c]
call fcn.00401e11
lea ecx, [ebp - 0x27c]
call fcn.00401e11
xor esi, esi
jmp 0x404f56
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x2d0]
test ecx, ecx
je 0x405037
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 5
cmp dword [ebp - 0x2f4], 0
jbe 0x40507a
mov edi, dword [ebp - 0x2fc]
lea eax, [ebp - 0x2ec]
cmp edi, eax
je 0x40507a
mov ecx, dword [ebp - 0x2f0]
test ecx, ecx
je 0x40506a
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x40507a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x2f0]
test ecx, ecx
je 0x40508d
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x314], 0
jbe 0x4050d0
mov edi, dword [ebp - 0x31c]
lea eax, [ebp - 0x30c]
cmp edi, eax
je 0x4050d0
mov ecx, dword [ebp - 0x310]
test ecx, ecx
je 0x4050c0
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x4050d0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x310]
test ecx, ecx
je 0x4050e3
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2b4], 0
jbe 0x405126
mov edi, dword [ebp - 0x2bc]
lea eax, [ebp - 0x2ac]
cmp edi, eax
je 0x405126
mov ecx, dword [ebp - 0x2b0]
test ecx, ecx
je 0x405116
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x14]
add esp, 8
jmp 0x405126
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x2b0]
test ecx, ecx
je 0x405139
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov byte [ebp - 4], 0
cmp dword [ebp - 0x294], 0
jbe 0x405165
mov eax, dword [ebp - 0x29c]
lea ecx, [ebp - 0x28c]
cmp eax, ecx
je 0x405165
sub esp, 8
lea ecx, [ebp - 0x290]
push eax
call fcn.004012a0
mov ecx, dword [ebp - 0x290]
test ecx, ecx
je 0x405178
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], 0
jbe 0x40519b
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0x18]
cmp eax, ecx
je 0x40519b
sub esp, 8
lea ecx, [ebp + 0x14]
push eax
call fcn.004012a0
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4051ab
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040753d
mov esp, ebp
pop ebp
ret
push str.eka::basic_string_t::at__
lea ecx, [ebp - 0x398]
call fcn.00403220
push 0x430ac4
lea eax, [ebp - 0x398]
push eax
call fcn.00408aa5
int3