Function at 0x40589a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push ebx
push esi
push edi
mov dword [ebp - 0x288], 0
cmp dword [ebp + 8], 0
je 0x4058c4
cmp dword [ebp + 0xc], 0
jne 0x4058e5
push 0x2000001
call fcn.00405434
add esp, 4
push 0
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x406098
call fcn.00405594
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0xffffffff
jne 0x405905
mov eax, 0xffffffff
jmp 0x406098
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x405922
mov eax, dword [ebp + 8]
push eax
call fcn.00412dc7
add esp, 4
jmp 0x406098
push 0x42a1b8
lea eax, [ebp - 0x84]
push eax
call fcn.0041a850
add esp, 8
mov eax, dword [ebp + 0xc]
cmp dword [eax], 2
jne 0x40595b
push 0x42a1dc
lea eax, [ebp - 0x84]
push eax
call fcn.0041a84c
add esp, 8
jmp 0x40597b
mov eax, dword [ebp + 0xc]
cmp dword [eax], 1
jne 0x40597b
push str.VxdHasp95
lea eax, [ebp - 0x84]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4059ef
cmp dword [ebp - 0x28c], 2
jne 0x4059c6
mov eax, dword [ebp + 8]
mov dword [eax + 0x118], 0
jmp 0x4059ea
push 0x2002000
call fcn.00405434
add esp, 4
push 0x10001
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x406098
jmp 0x406070
mov eax, dword [ebp + 8]
mov dword [eax + 0x118], 1
mov dword [ebp - 4], pe_nt_image_headers32
push 0x42a1f0
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405a60
push 0x42a1f8
mov eax, dword [ebp + 8]
push eax
call fcn.0041a850
add esp, 8
mov dword [ebp - 4], 0x14
push 0x42a200
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405ace
push 0x42a208
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
call fcn.0041a850
add esp, 8
mov dword [ebp - 4], pe_nt_image_headers32
push 0x42a210
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x120
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405b3c
push 0x42a21c
mov eax, dword [ebp + 8]
add eax, 0x120
push eax
call fcn.0041a850
add esp, 8
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405b8d
cmp dword [ebp - 0x28c], 6
je 0x405b8d
push 0x2002000
call fcn.00405434
add esp, 4
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x406098
push 0x42a224
lea eax, [ebp - 0x84]
push eax
call fcn.0041a84c
add esp, 8
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x84]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x405fc8
mov dword [ebp - 4], pe_nt_image_headers32
push 0x42a230
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405c30
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
jmp 0x405c99
push 0x42a240
lea eax, [ebp - 0x390]
push eax
call fcn.0041ad20
add esp, 8
test eax, eax
jne 0x405c5e
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 1
jmp 0x405c99
push 0x42a244
lea eax, [ebp - 0x390]
push eax
call fcn.0041ad20
add esp, 8
test eax, eax
jne 0x405c8c
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 2
jmp 0x405c99
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
mov dword [ebp - 4], pe_nt_image_headers32
push 0x42a248
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405d07
push 0x42a258
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
call fcn.0041a850
add esp, 8
mov dword [ebp - 4], pe_nt_image_headers32
push 0x42a260
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405d6f
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
jmp 0x405e34
push 0x42a26c
lea eax, [ebp - 0x390]
push eax
call fcn.0041acc0
add esp, 8
test eax, eax
je 0x405d9d
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 1
jmp 0x405e34
push 0x42a274
lea eax, [ebp - 0x390]
push eax
call fcn.0041acc0
add esp, 8
test eax, eax
je 0x405dcb
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 2
jmp 0x405e34
push 0x42a278
lea eax, [ebp - 0x390]
push eax
call fcn.0041acc0
add esp, 8
test eax, eax
je 0x405df9
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 4
jmp 0x405e34
push 0x42a280
lea eax, [ebp - 0x390]
push eax
call fcn.0041acc0
add esp, 8
test eax, eax
je 0x405e27
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 8
jmp 0x405e34
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
mov eax, dword [ebp + 0xc]
cmp dword [eax], 2
jne 0x405f9c
mov dword [ebp - 4], pe_nt_image_headers32
push 0x42a288
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405ea8
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
jmp 0x405eb7
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a4], eax
push 0x42a290
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405f18
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
jmp 0x405f27
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a8], eax
push 0x42a298
lea eax, [ebp - 0x310]
push eax
call fcn.0041a850
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x284]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x405f88
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
jmp 0x405f97
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1ac], eax
jmp 0x405fc3
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
jmp 0x40601f
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
push 0x42a2a0
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
call fcn.0041a850
add esp, 8
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x406070
cmp dword [ebp - 0x28c], 6
je 0x406070
push 0x2002000
call fcn.00405434
add esp, 4
push 0x10002
call fcn.004054a2
add esp, 4
mov eax, 0xffffffff
jmp 0x406098
mov eax, dword [ebp + 8]
mov dword [eax + 0x11c], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x1b0], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x230], 0
xor eax, eax
jmp 0x406098
pop edi
pop esi
pop ebx
leave
ret 8