Function at 0x4070bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
mov byte [ebp - 0x168], 0
cmp eax, ecx
je 0x4070e6
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ecx
je 0x4070ef
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x4070f8
mov byte [eax], cl
mov eax, dword [ebp + 0x18]
cmp eax, ecx
je 0x407101
mov byte [eax], cl
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x101
push ecx
mov ebx, 0xb7
push ebx
lea edi, [ebx - 0xe]
push edi
push 0x2e
push 0x4106c0
mov esi, 0x412390
push esi
call fcn.0040254d
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407221
call fcn.00406e33
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 4], eax
push eax
jmp 0x407204
test eax, eax
jne 0x4071d7
cmp dword [ebp - 0x14], eax
jbe 0x4071d7
cmp dword [ebp - 0xc], eax
jbe 0x4071d7
cmp dword [ebp - 0x18], 1
jne 0x4071d7
push ebx
push edi
push 9
push 0x4106b4
push esi
call fcn.0040254d
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040ef2c
add esp, 0x1c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0x407239
lea eax, [ebp - 0x3c]
push eax
call fcn.00406d1e
pop ecx
test eax, eax
je 0x4071c7
lea eax, [ebp - 0x3c]
push eax
call fcn.0040f200
pop ecx
cmp eax, dword [ebp - 0x1c]
je 0x407239
push 0x100
push 0
push esi
call fcn.0040ee85
add esp, 0xc
inc dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x40716c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push 0
push esi
call fcn.0040ee85
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push ebx
push edi
push 4
push 0x4106b0
push esi
call fcn.0040254d
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0040eef0
push 0x100
push 0
push esi
mov dword [ebp - 4], eax
call fcn.0040ee85
add esp, 0x28
cmp dword [ebp - 4], 0
je 0x407290
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x40728b
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0040ef5b
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x407234
cmp byte [ebp - 0x168], 0x22
jne 0x4072c4
lea eax, [ebp - 0x167]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0040ef5b
lea eax, [ebp - 0x168]
push 0x22
push eax
call fcn.0040ed7e
add esp, 0x10
test eax, eax
je 0x4072c4
mov byte [eax], 0
push ebx
push edi
push 5
push 0x4106a8
push esi
call fcn.0040254d
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0040eef0
push 0x100
xor ebx, ebx
push ebx
push esi
mov edi, eax
call fcn.0040ee85
add esp, 0x28
cmp edi, ebx
jne 0x407321
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0x407313
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0040ef5b
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x10], ebx
sete al
inc eax
jmp 0x407234
push dword [ebp + 8]
lea eax, [ebp - 0x168]
push eax
call fcn.0040edd2
pop ecx
pop ecx
test eax, eax
jne 0x407346
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x407234
lea eax, [ebp - 0x168]
push 0x5c
push eax
mov byte [edi], bl
call fcn.0040ed7e
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x40736a
lea eax, [ebp - 0x168]
mov dword [ebp - 4], eax
jmp 0x40736d
inc dword [ebp - 4]
push dword [ebp - 4]
call fcn.00406d1e
pop ecx
test eax, eax
jne 0x40739e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0x407396
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0040ef5b
pop ecx
pop ecx
mov byte [edi], 0x2e
jmp 0x407313
push dword [ebp - 4]
call fcn.0040f200
mov ebx, eax
mov esi, ebx
shr esi, 8
push ebx
mov dword [ebp - 0xc], ebx
and esi, 0xff
call fcn.00406d07
pop ecx
pop ecx
test eax, eax
jne 0x407430
lea eax, [esi - 0x40]
cmp eax, 0x3f
ja 0x407430
and ebx, 0xff
cmp ebx, 0x10
jge 0x407430
mov byte [edi], 0x2e
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
je 0x407400
lea eax, [ebp - 0x18c]
push eax
push ebx
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x407400
mov dword [edi], 1
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x407409
mov dword [eax], esi
cmp dword [ebp + 0x14], ebx
je 0x40741c
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0040ef5b
pop ecx
pop ecx
cmp dword [ebp + 0x18], ebx
je 0x407313
push dword [ebp - 4]
push dword [ebp + 0x18]
jmp 0x40730c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x40744d
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0040ef5b
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x10], eax
mov byte [edi], 0x2e
jmp 0x407318