Function at 0x40b2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43fb65
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4540fc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push dword [edx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40b366
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00409200
test eax, eax
je 0x40b610
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [edi], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b330
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004218aa
add esp, 4
mov ebx, eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
push 0
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40b3d4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004218b3
add esp, 4
jmp 0x40b339
push dword [ebp - 0x14]
push ebx
call fcn.0042ae37
add esp, 8
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x14]
jne 0x40b513
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40b610
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
test edx, edx
js 0x40b606
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x40b43b
push edx
lea ecx, [ebp - 0x18]
call fcn.004080b0
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [esi - 8]
jg 0x40b606
xor eax, eax
mov dword [esi - 0xc], edx
mov word [esi + edx*2], ax
cmp dword [esi - 4], 1
jle 0x40b461
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00408150
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, eax
je 0x40b4b5
test esi, esi
jne 0x40b4aa
call fcn.004268ad
mov dword [eax], 0x16
call fcn.0042672f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004218b3
add esp, 4
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40b5fc
mov eax, dword [ecx]
call dword [eax + 0xc]
add esi, 0xfffffff0
jmp 0x40b5c0
push eax
push ebx
push esi
call fcn.00422fd0
add esp, 0xc
mov eax, dword [esi - 0xc]
mov dword [ebp - 0x24], eax
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
test ecx, ecx
js 0x40b606
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or eax, edx
jge 0x40b4e9
push ecx
lea ecx, [ebp - 0x18]
call fcn.004080b0
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov word [esi + eax*2], dx
cmp ecx, dword [esi - 8]
jg 0x40b606
mov dword [esi - 0xc], ecx
xor eax, eax
mov word [esi + ecx*2], ax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
jmp 0x40b5ae
call fcn.00409200
mov ecx, eax
test ecx, ecx
je 0x40b610
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp - 0x24]
add ebx, 1
mov dword [ebp - 4], 1
js 0x40b5f5
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x40b55d
push ebx
lea ecx, [ebp - 0x18]
call fcn.004080b0
mov esi, dword [ebp - 0x18]
cmp ebx, dword [esi - 8]
jg 0x40b5f5
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
cmp dword [esi - 4], 1
jle 0x40b583
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.00408150
mov esi, dword [ebp - 0x18]
push dword [ebp - 0x1c]
push ebx
push esi
call fcn.0042afe7
add esp, 0xc
push dword [ebp - 0x10]
test eax, eax
je 0x40b5a5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1c]
jmp 0x40b486
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x1c]
call fcn.004218b3
add esi, 0xfffffff0
add esp, 4
mov ecx, esi
call fcn.00407e40
add eax, 0x10
mov dword [edi], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b352
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
jmp 0x40b601
push 0x80004005
call fcn.00408fe0
push 0x80070057
call fcn.00408fe0
push 0x80004005
call fcn.00408fe0
int3