Function at 0x406040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4785c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1f4], ecx
lea ecx, [ebp - 0x58]
call fcn.00413170
lea ecx, [ebp - 0x58]
call fcn.00413400
movzx eax, al
test eax, eax
jne 0x406083
lea ecx, [ebp - 0x58]
call fcn.00413420
movzx ecx, al
test ecx, ecx
je 0x406162
lea edx, [ebp - 0x5c]
push edx
push 3
push 0
push 0x469f48
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4060c6
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1a4], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1a4]
jmp 0x4067c5
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 4
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x64]
push edx
push 0
push 0
push 0x469f84
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40611a
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1a8], 1
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1a8]
jmp 0x4067c5
cmp dword [ebp - 0x64], 0xb5
je 0x40612c
cmp dword [ebp - 0x64], 0xff
jne 0x406153
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1ac], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1ac]
jmp 0x4067c5
mov eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4067ad
lea ecx, [ebp - 0x58]
call fcn.00413440
movzx ecx, al
test ecx, ecx
je 0x40630c
lea edx, [ebp - 0x68]
push edx
push 3
push 0
push 0x469f98
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4061b8
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b0], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1b0]
jmp 0x4067c5
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x6c], 4
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x74]
push edx
push 0
push 0
push 0x469fdc
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40620c
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b4], 1
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1b4]
jmp 0x4067c5
cmp dword [ebp - 0x74], 1
jne 0x406239
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b8], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1b8]
jmp 0x4067c5
lea eax, [ebp - 0x68]
push eax
push 3
push 0
push str.SYSTEMCurrentControlSetServicesCdrom
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40627c
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1bc], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1bc]
jmp 0x4067c5
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x78], 4
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x70]
push eax
push 0
push 0
push str.AutoRun
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4062d0
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c0], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1c0]
jmp 0x4067c5
cmp dword [ebp - 0x70], 1
je 0x4062fd
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c4], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1c4]
jmp 0x4067c5
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4067ad
lea ecx, [ebp - 0x58]
call fcn.00413460
movzx edx, al
test edx, edx
je 0x4065ea
lea eax, [ebp - 0x7c]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlers
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406362
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c8], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1c8]
jmp 0x4067c5
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x80], 4
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x18c]
push eax
push 0
push 0
push str.DisableAutoplay
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4063bc
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1cc]
jmp 0x4067c5
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x7c]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlersEventHandlersDefaultSelectionAutorunINFLegacyArrival
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x406409
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1d0], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1d0]
jmp 0x4067c5
mov byte [ebp - 0x188], 0
push 0x103
push 0
lea eax, [ebp - 0x187]
push eax
call fcn.00446170
add esp, 0xc
mov dword [ebp - 0x80], 0x104
lea ecx, [ebp - 0x80]
push ecx
lea edx, [ebp - 0x188]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406473
mov ecx, dword [ebp - 0x7c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1d4], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1d4]
jmp 0x4067c5
mov edx, dword [ebp - 0x7c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1f8], str.MSAutoRun
lea eax, [ebp - 0x188]
mov dword [ebp - 0x1fc], eax
mov ecx, dword [ebp - 0x1fc]
mov dl, byte [ecx]
mov byte [ebp - 0x1fd], dl
mov eax, dword [ebp - 0x1f8]
cmp dl, byte [eax]
jne 0x4064f1
cmp byte [ebp - 0x1fd], 0
je 0x4064e5
mov ecx, dword [ebp - 0x1fc]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x1fe], dl
mov eax, dword [ebp - 0x1f8]
cmp dl, byte [eax + 1]
jne 0x4064f1
add dword [ebp - 0x1fc], 2
add dword [ebp - 0x1f8], 2
cmp byte [ebp - 0x1fe], 0
jne 0x406493
mov dword [ebp - 0x204], 0
jmp 0x4064fc
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x204], ecx
mov edx, dword [ebp - 0x204]
mov dword [ebp - 0x208], edx
cmp dword [ebp - 0x208], 0
je 0x4065a9
mov dword [ebp - 0x20c], str.MSPromptEachTime
lea eax, [ebp - 0x188]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
mov dl, byte [ecx]
mov byte [ebp - 0x211], dl
mov eax, dword [ebp - 0x20c]
cmp dl, byte [eax]
jne 0x406589
cmp byte [ebp - 0x211], 0
je 0x40657d
mov ecx, dword [ebp - 0x210]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x212], dl
mov eax, dword [ebp - 0x20c]
cmp dl, byte [eax + 1]
jne 0x406589
add dword [ebp - 0x210], 2
add dword [ebp - 0x20c], 2
cmp byte [ebp - 0x212], 0
jne 0x40652b
mov dword [ebp - 0x218], 0
jmp 0x406594
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x218], ecx
mov edx, dword [ebp - 0x218]
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x21c], 0
jne 0x4065c8
mov dword [ebp - 0x1d8], 1
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1d8]
jmp 0x4067c5
mov dword [ebp - 0x1dc], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1dc]
jmp 0x4067c5
lea eax, [ebp - 0x190]
push eax
push 3
push 0
push 0x46a10c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40661b
mov ecx, dword [ebp - 0x190]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4066b5
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 4
lea edx, [ebp - 0x19c]
push edx
lea eax, [ebp - 0x1a0]
push eax
push 0
push 0
push 0x46a148
mov ecx, dword [ebp - 0x190]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406666
mov edx, dword [ebp - 0x190]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4066b5
cmp dword [ebp - 0x1a0], 0xb5
je 0x40667e
cmp dword [ebp - 0x1a0], 0xff
jne 0x4066a8
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1e0], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1e0]
jmp 0x4067c5
mov ecx, dword [ebp - 0x190]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x190]
push edx
push 3
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4066fe
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1e4], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1e4]
jmp 0x4067c5
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x194], 4
lea ecx, [ebp - 0x194]
push ecx
lea edx, [ebp - 0x198]
push edx
push 0
push 0
push str.NoDriveTypeAutoRun
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406761
mov ecx, dword [ebp - 0x190]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1e8], 1
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1e8]
jmp 0x4067c5
cmp dword [ebp - 0x198], 0xb5
je 0x406779
cmp dword [ebp - 0x198], 0xff
jne 0x4067a0
mov edx, dword [ebp - 0x190]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1ec], 0
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1ec]
jmp 0x4067c5
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1f0], 1
lea ecx, [ebp - 0x58]
call fcn.00413250
mov eax, dword [ebp - 0x1f0]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441de6
mov esp, ebp
pop ebp
ret