Function at 0x4054a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x432adc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push str.Start
push 0x429490
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
call fcn.004039c0
push 0x848
push ebx
push esi
call fcn.00413850
add esp, 0x14
lea eax, [ebp - 0x50c]
push eax
push 0xf013f
push ebx
push 0x4294a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40552f
push str._Error_opening_KEY
push str.FillRelogonData
call fcn.004039c0
add esp, 8
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412803
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x429504
push ecx
mov dword [ebp - 0x508], 2
call edi
test eax, eax
jne 0x405586
lea edx, [ebp - 0x514]
push edx
lea eax, [esi + 8]
push 2
push eax
mov dword [esi + 4], 1
call fcn.0041378a
add esp, 0xc
jmp 0x405589
mov dword [esi + 4], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x429514
push ecx
mov dword [ebp - 0x508], 2
call edi
test eax, eax
jne 0x4055d9
lea edx, [ebp - 0x518]
push edx
lea eax, [esi + 0x10]
push 2
push eax
mov dword [esi + 0xc], 1
call fcn.0041378a
add esp, 0xc
jmp 0x4055dc
mov dword [esi + 0xc], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x51c]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x429524
push ecx
mov dword [ebp - 0x508], 2
call edi
test eax, eax
jne 0x40562c
lea edx, [ebp - 0x51c]
push edx
lea eax, [esi + 0x18]
push 2
push eax
mov dword [esi + 0x14], 1
call fcn.0041378a
add esp, 0xc
jmp 0x40562f
mov dword [esi + 0x14], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x304]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x42953c
push ecx
mov dword [ebp - 0x508], 0x100
call edi
test eax, eax
jne 0x405682
lea edx, [ebp - 0x304]
push edx
lea eax, [esi + 0x20]
push 0x100
push eax
mov dword [esi + 0x1c], 1
call fcn.0041378a
add esp, 0xc
jmp 0x405685
mov dword [esi + 0x1c], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x404]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x42954c
push ecx
mov dword [ebp - 0x508], 0x100
call edi
test eax, eax
jne 0x4056de
lea edx, [ebp - 0x404]
push edx
lea eax, [esi + 0x32c]
push 0x100
push eax
mov dword [esi + 0x328], 1
call fcn.0041378a
add esp, 0xc
jmp 0x4056e4
mov dword [esi + 0x328], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x504]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x429560
push ecx
mov dword [ebp - 0x508], 0x100
call edi
test eax, eax
jne 0x40573d
lea edx, [ebp - 0x504]
push edx
lea eax, [esi + 0x124]
push 0x100
push eax
mov dword [esi + 0x120], 1
call fcn.0041378a
add esp, 0xc
jmp 0x405743
mov dword [esi + 0x120], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x429570
push ecx
mov dword [ebp - 0x508], 0x100
call edi
test eax, eax
jne 0x40579c
lea edx, [ebp - 0x204]
push edx
lea eax, [esi + 0x228]
push 0x100
push eax
mov dword [esi + 0x224], 1
call fcn.0041378a
add esp, 0xc
jmp 0x4057a2
mov dword [esi + 0x224], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x429584
push ecx
mov dword [ebp - 0x508], 0x100
call edi
test eax, eax
jne 0x4057fb
lea edx, [ebp - 0x104]
push edx
lea eax, [esi + 0x430]
push 0x100
push eax
mov dword [esi + 0x42c], 1
call fcn.0041378a
add esp, 0xc
jmp 0x405801
mov dword [esi + 0x42c], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x520]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x42959c
push ecx
mov dword [ebp - 0x508], 4
call edi
test eax, eax
jne 0x40584b
mov edx, dword [ebp - 0x520]
mov dword [esi + 0x530], 1
mov dword [esi + 0x534], edx
jmp 0x405851
mov dword [esi + 0x530], ebx
mov eax, dword [ebp - 0x50c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x50c]
push ecx
push 0xf013f
push ebx
push 0x4295a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405930
lea edx, [ebp - 0x508]
push edx
mov edx, dword [ebp - 0x50c]
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x510]
push ecx
push ebx
push 0x4295e4
push edx
mov dword [ebp - 0x508], 4
call edi
test eax, eax
jne 0x4058cd
mov eax, dword [ebp - 0x528]
mov dword [esi + 0x538], 1
mov dword [esi + 0x53c], eax
jmp 0x4058d3
mov dword [esi + 0x538], ebx
lea ecx, [ebp - 0x508]
push ecx
mov ecx, dword [ebp - 0x50c]
lea edx, [ebp - 0x524]
push edx
lea eax, [ebp - 0x510]
push eax
push ebx
push 0x4295f0
push ecx
mov dword [ebp - 0x508], 4
call edi
test eax, eax
jne 0x40591d
mov edx, dword [ebp - 0x524]
mov dword [esi + 0x540], 1
mov dword [esi + 0x544], edx
jmp 0x405923
mov dword [esi + 0x544], ebx
mov eax, dword [ebp - 0x50c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi], 1
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00412803
mov esp, ebp
pop ebp
ret