Function at 0x40ba363b
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ebp - 0x2bc]
mov dword [esi + 0x40], eax
jmp 0x40ba3762
push 0xb
jmp 0x40ba50e1
mov dword [edx + 0x38], esi
jmp 0x40ba37a6
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [0x40bb1020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2bc], edx
test eax, eax
je 0x40ba506c
and dword [eax], 0
push edi
mov edi, dword [ebp + 0x1c]
test edi, 0x3ffffff0
jne 0x40ba5074
mov ecx, edi
mov eax, edi
shr ecx, 3
and eax, 7
and ecx, 1
mov dword [ebp - 0x2d0], eax
dec eax
push ebx
mov dword [ebp - 0x2c8], ecx
jne 0x40ba3dc0
test edx, edx
je 0x40ba3017
push edx
mov ebx, 0x90
push ebx
lea eax, [ebp - 0x124]
push eax
call fcn.40ba2f04
push edi
push dword [ebp - 0x2bc]
push dword [ebp - 0x2b0]
call fcn.40ba35c3
test eax, eax
jne 0x40ba50d7
push 0x174
call fcn.40ba2ab2
mov esi, eax
test esi, esi
je 0x40ba50df
mov eax, dword [ebp - 0x2b0]
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x2bc]
mov dword [esi + 0x1c], eax
lea eax, [ebp - 0x124]
push eax
push ebx
lea eax, [esi + 0x4c]
push eax
mov dword [esi], 1
mov dword [esi + 0x20], edi
call fcn.40ba2f04
mov eax, edi
and eax, 0x40000000
mov ecx, eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, 0x40ba2cec
xor edi, edi
mov dword [esi + 0x48], ecx
cmp eax, edi
jne 0x40ba50e7
mov eax, dword [ebp - 0x2d0]
dec eax
dec eax
je 0x40ba5285
dec eax
je 0x40ba3009
dec eax
je 0x40ba526f
cmp dword [ebp - 0x2c8], edi
je 0x40ba5297
mov dword [esi + 0x18], edi
cmp dword [ebp - 0x2c8], edi
je 0x40ba52ac
mov edx, dword [ebp - 0x2b0]
mov eax, dword [edx + 0x38]
cmp eax, edi
je 0x40ba362e
mov ecx, dword [eax + 0x10]
cmp ecx, edi
je 0x40ba379b
mov eax, ecx
cmp eax, edi
jne 0x40ba378e
cmp eax, edi
je 0x40ba362e
mov dword [eax + 0x10], esi
push esi
call fcn.40ba3b5d
cmp eax, edi
jne 0x40ba37dc
mov eax, dword [ebp - 0x2d4]
mov dword [eax], esi
mov eax, dword [ebp - 0x2b0]
mov eax, dword [eax + 0x30]
cmp eax, edi
jne 0x40ba52ce
xor eax, eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.40ba1e8c
leave
ret 0x18
push edi
push esi
call fcn.40ba3241
mov ebx, eax
cmp ebx, edi
je 0x40ba37b0
jmp 0x40ba52c0
dec eax
je 0x40ba3dd4
dec eax
jne 0x40ba507c
cmp dword [ebp + 0x18], 0
jne 0x40ba3017
test edx, edx
je 0x40ba3017
test esi, esi
je 0x40ba3017
mov ebx, 0x90
push ebx
lea eax, [ebp - 0x124]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40ba3017
lea eax, [ebp - 0x124]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40ba3e09
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x40ba36c6
push 0xb
pop eax
jmp 0x40ba37cd
push 0xa
pop eax
jmp 0x40ba37cc
dec eax
jne 0x40ba3017
test ecx, ecx
jne 0x40ba3017
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40ba509a
push 5
jmp 0x40ba50e1
test esi, esi
je 0x40ba3017
mov ebx, 0x90
push ebx
lea eax, [ebp - 0x124]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40ba3017
lea eax, [ebp - 0x124]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
je 0x40ba3e13
jmp 0x40ba50c7
xor eax, eax
inc eax
jmp 0x40ba37cb
push 7
pop eax
jmp 0x40ba37cb
lea eax, [ebp - 0x124]
push eax
push 0x40ba2bc0
push 0x40ba52d8
lea eax, [ebp - 0x2ac]
push 0xc4
push eax
mov dword [ebp - 0x2c0], edi
mov dword [esi + 0x16c], edi
call fcn.40ba2f77
add esp, 0x14
lea eax, [ebp - 0x2b4]
push eax
push 1
push edi
lea eax, [ebp - 0x2ac]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, edi
jne 0x40ba5254
lea eax, [ebp - 0x2cc]
push eax
lea eax, [esi + 0x170]
push eax
lea eax, [ebp - 0x2b8]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x40ba62f8
push dword [ebp - 0x2b4]
mov dword [ebp - 0x2cc], 4
call edi
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x40ba5204
cmp dword [ebp - 0x2b8], 4
je 0x40ba518f
cmp dword [ebp - 0x2b8], 3
jne 0x40ba51ff
cmp dword [ebp - 0x2cc], 4
jne 0x40ba51ff
lea ecx, [ebp - 0x2c4]
push ecx
push eax
push eax
push eax
push 0x40ba52e4
push dword [ebp - 0x2b4]
call edi
mov ebx, eax
test ebx, ebx
jne 0x40ba5204
push dword [ebp - 0x2c4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x2c0], eax
test eax, eax
jne 0x40ba51d2
push 0xe
pop ebx
jmp 0x40ba5204
lea ecx, [ebp - 0x2c4]
push ecx
push eax
lea eax, [ebp - 0x2b8]
push eax
push 0
push 0x40ba52e4
push dword [ebp - 0x2b4]
call edi
mov ebx, eax
test ebx, ebx
jne 0x40ba5204
cmp dword [ebp - 0x2b8], 1
je 0x40ba5204
mov ebx, 0x3f3
push dword [ebp - 0x2b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x40ba5254
mov edi, dword [ebp - 0x2c4]
shr edi, 1
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi + 0x16c], eax
test eax, eax
jne 0x40ba5237
push 0xe
pop ebx
jmp 0x40ba5244
push dword [ebp - 0x2c0]
push edi
push eax
call fcn.40ba2f04
push dword [ebp - 0x2c0]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x40ba5268
xor eax, eax
cmp ebx, 0xe
sete al
dec eax
and eax, 0xfffffffa
add eax, 7
jmp 0x40ba37cb
xor edi, edi
jmp 0x40ba3746
mov eax, dword [ebp + 0x18]
or dword [esi + 0x24], 0x10000000
or dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], eax
jmp 0x40ba3762
mov eax, dword [ebp + 0x18]
or dword [esi + 0x24], 0x10000000
mov dword [esi + 0x44], eax
jmp 0x40ba3009
or dword [esi + 0x24], 0x40000000
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x18], eax
jmp 0x40ba3771
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [eax + 0x38]
mov dword [esi + 0x10], ecx
mov dword [eax + 0x38], esi
jmp 0x40ba37a6
push edi
push esi
call fcn.40ba1f8f
mov eax, ebx
jmp 0x40ba37cb
inc dword [eax]
jmp 0x40ba37c9