Function at 0x40d95d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
mov esi, edx
push edi
xor edi, edi
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2a4], edi
mov ebx, edi
test eax, eax
je 0x40dc1b
lea eax, [ebp - 0x2a4]
push eax
push 0x20019
push edi
push 0x4017d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dc19
mov dword [ebp - 0x2ac], 1
mov edx, 0x104
push ecx
test esi, esi
je 0x40d9d1
push 0x401a60
jmp 0x40d9d6
push 0x401a80
push ecx
lea ecx, [ebp - 0x290]
call fcn.0040c1c3
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2a8], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x2ac]
push eax
push edi
lea eax, [ebp - 0x290]
push eax
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40dc0d
mov dword [ebp - 0x2b4], 1
lea eax, [ebp - 0x88]
mov dword [ebp - 0x294], edi
mov esi, edi
mov dword [ebp - 0x298], edi
mov dword [ebp - 0x29c], edi
mov dword [ebp - 0x2a0], edi
jmp 0x40da4d
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x40da49
mov eax, esi
sub eax, 1
je 0x40db84
sub eax, 1
je 0x40db58
sub eax, 1
je 0x40db25
lea eax, [ebp - 0x88]
test esi, esi
je 0x40da9a
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x29c], eax
jmp 0x40dba7
inc esi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x40da96
sub esi, 1
je 0x40db10
sub esi, 1
je 0x40daf4
sub esi, 1
je 0x40dad1
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x294], eax
jmp 0x40dba7
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push 0x404350
jmp 0x40db46
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push 0x404370
jmp 0x40db72
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push 0x404388
jmp 0x40db97
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push 0x404308
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x40dba7
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push 0x404328
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x40dba7
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x294]
push eax
push 0x404340
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x294]
xor edi, edi
mov ecx, dword [ebp - 0x298]
mov esi, dword [ebp - 0x2a0]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x29c]
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
add esi, eax
shld edi, ebx, 0x10
movzx eax, cx
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
mov eax, esi
shl ebx, 0x10
shr eax, 0x10
or ebx, eax
movzx eax, si
shld edi, ebx, 0x10
cdq
shl ebx, 0x10
or ebx, eax
mov eax, dword [ebp - 0x2b0]
or edi, edx
mov dword [eax], ebx
mov ebx, dword [ebp - 0x2b4]
mov dword [eax + 4], edi
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret