Function at 0x403fa0
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov eax, dword [0x41a0a8]
sub esp, 0xa68
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xa74]
push ebp
mov ebp, dword [esp + 0xa74]
push eax
push ebx
push ecx
push 0x52c
push edx
push ebp
call fcn.00404a50
add esp, 0x18
test al, al
jne 0x403fe2
pop ebp
pop ebx
add esp, 0xa68
ret
lea eax, [esp + 0x18]
push eax
call fcn.00403e40
add esp, 4
test eax, eax
jne 0x403ffe
pop ebp
xor al, al
pop ebx
add esp, 0xa68
ret
lea ecx, [esp + 0xc]
lea edx, [esp + 0x38]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40401e
pop ebp
xor al, al
pop ebx
add esp, 0xa68
ret
push esi
push edi
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x240]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x344]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push 0
push 0x422abc
push eax
mov dword [esp + 0x30], 0x100
mov dword [esp + 0x28], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4040b3
mov edi, 0x41a27c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x344]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x41a27c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x544], ecx
mov dword [esp + 0x240], 1
jmp 0x4040be
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x544], ecx
mov edi, 0x41a274
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x244]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x41a0a8]
push ecx
push ebx
push edx
push 0x52c
push eax
push ebp
call fcn.004049c0
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x38]
add esp, 0x18
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0x344]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push ecx
lea eax, [esp + 0x244]
xor esi, esi
push edx
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push esi
lea edx, [esp + 0x254]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x30], 0x200
call ebp
cmp eax, 0x103
je 0x404216
mov ecx, dword [esp + 0x10]
lea edi, [esp + 0x244]
mov dword [esp + 0x544], ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4041c1
lea edx, [esp + 0x344]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x41a0a8]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0xa80]
push ebx
push ecx
lea edx, [esp + 0x2c]
push 0x52c
push edx
push eax
call fcn.004049c0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xf5555555
je 0x404216
mov ecx, 0x14b
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x344]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
lea eax, [esp + 0x240]
push ecx
push edx
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x254]
inc esi
push ecx
push edx
push esi
push eax
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x30], 0x200
call ebp
cmp eax, 0x103
jne 0x404162
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x14a
xor eax, eax
lea edi, [esp + 0x54e]
mov edx, dword [0x41a0a8]
mov byte [esp + 0x54c], 1
mov byte [esp + 0x54d], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
mov edx, dword [esp + 0xa80]
lea eax, [esp + 0x20]
push ebx
push eax
lea ecx, [esp + 0x558]
push 0x52c
push ecx
push edx
call fcn.004049c0
add esp, 0x18
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa68
ret