Function at 0x404cd4
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4227d6
call fcn.00419178
mov eax, 0x1080
call fcn.00418de0
push ebx
push esi
mov ebx, edx
mov esi, ecx
push str.Registry
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x404e13
mov ecx, esi
call fcn.0040a490
cmp eax, 2
jb 0x405125
push 0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.00401981
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 0x10
jb 0x404d35
mov eax, dword [eax + 4]
jmp 0x404d38
add eax, 4
push eax
lea ecx, [ebp - 0x50]
call fcn.00401640
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 1
call fcn.00407073
add esp, 0xc
mov bl, al
neg bl
sbb bl, bl
and byte [ebp - 4], 0
push 1
lea ecx, [ebp - 0x50]
inc bl
call fcn.004017f0
test bl, bl
je 0x404d7b
lea ecx, [ebp - 0x30]
jmp 0x40511e
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x404d87
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x404dac
xor bl, bl
push 1
lea ecx, [ebp - 0x30]
call fcn.004017f0
mov al, bl
jmp 0x405127
mov esi, dword [esi + 4]
add esi, 0x1c
mov dword [ebp - 0x10], 0xfff
cmp dword [esi + 0x18], 0x10
jb 0x404dc4
mov esi, dword [esi + 4]
jmp 0x404dc7
add esi, 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
mov ebx, eax
mov eax, dword [ebp - 0x10]
neg ebx
sbb bl, bl
and byte [ebp + eax - 0x108c], 0
inc bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x404d9b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108c]
push eax
call fcn.00401738
jmp 0x404d9b
push str.IfBool
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x404ee5
mov ecx, esi
call fcn.0040a490
push 2
pop ebx
cmp eax, ebx
jb 0x405125
push dword [esi + 4]
lea eax, [ebp - 0x50]
push eax
call fcn.004139a0
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], ebx
call fcn.00413320
add esp, 0x10
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.004017f0
push 0x426478
lea ecx, [ebp - 0x30]
call fcn.00404ad0
test eax, eax
je 0x404ecb
push str.TRUE
lea ecx, [ebp - 0x30]
call fcn.00404ad0
test eax, eax
je 0x404ecb
push 0x42646c
lea ecx, [ebp - 0x30]
call fcn.00404ad0
test eax, eax
je 0x404ecb
push 0x426468
lea ecx, [ebp - 0x30]
call fcn.00404ad0
test eax, eax
je 0x404ecb
mov eax, dword [esi + 4]
cmp dword [eax + 0x14], 0
jbe 0x404d99
cmp dword [eax + 0x18], 0x10
jb 0x404ebf
mov eax, dword [eax + 4]
jmp 0x404ec2
add eax, 4
cmp byte [eax], 1
jne 0x404d99
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0
add eax, 0x1c
push eax
call fcn.004016a9
mov bl, 1
jmp 0x404d9b
push str.IfSet
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x404f42
mov ecx, esi
call fcn.0040a490
cmp eax, 2
jb 0x405125
push dword [esi + 4]
lea eax, [ebp - 0x50]
push eax
call fcn.004139a0
mov ebx, dword [eax + 0x14]
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x50]
call fcn.004017f0
test ebx, ebx
je 0x405125
mov eax, dword [esi + 4]
add eax, 0x1c
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push eax
call fcn.004016a9
mov al, 1
jmp 0x405127
push str.IfEq
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x404f9d
mov ecx, esi
call fcn.0040a490
cmp eax, 3
jb 0x405125
mov eax, dword [esi + 4]
add eax, 0x1c
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004139a0
mov ebx, eax
push dword [esi + 4]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 4], 5
call fcn.004139a0
add esp, 0x10
push ebx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.0040abb1
test eax, eax
setne bl
jmp 0x404ff5
push str.IfContains
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x405020
mov ecx, esi
call fcn.0040a490
cmp eax, 3
jb 0x405125
mov eax, dword [esi + 4]
add eax, 0x1c
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004139a0
mov ebx, eax
push dword [esi + 4]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 4], 7
call fcn.004139a0
add esp, 0x10
push 0
push eax
mov eax, ebx
call fcn.0040a44a
cmp eax, 0xffffffff
sete bl
push 1
lea ecx, [ebp - 0x50]
call fcn.004017f0
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x30]
call fcn.004017f0
test bl, bl
jne 0x405125
mov eax, dword [esi + 4]
add eax, 0x38
jmp 0x404f2e
push str.Uppercase
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x405071
mov ecx, esi
call fcn.0040a490
cmp eax, 1
jb 0x405125
push dword [esi + 4]
lea eax, [ebp - 0x50]
push eax
call fcn.00413320
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push eax
mov dword [ebp - 4], 8
call fcn.004016a9
push 1
lea ecx, [ebp - 0x50]
call fcn.004017f0
jmp 0x404f3b
push str.Fail
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x4050ad
mov ecx, esi
call fcn.0040a490
cmp eax, 1
jb 0x405125
push dword [esi + 4]
call fcn.00404c39
mov ecx, dword [ebp + 8]
mov dword [esp], 0x426815
call fcn.00401738
jmp 0x404f3b
push str.IfFileExists
mov ecx, ebx
call fcn.00404ad0
test eax, eax
jne 0x4050d9
mov ecx, esi
call fcn.0040a490
cmp eax, 2
jb 0x405125
push dword [esi + 4]
call fcn.00412fa0
pop ecx
test al, al
jmp 0x404f22
push ebx
lea eax, [ebp - 0x8c]
push str.Invalid_define_command:_
push eax
call fcn.004049f1
push 0x4266a8
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], 9
call fcn.004049a5
push eax
mov byte [ebp - 4], 0xa
call fcn.00404c39
add esp, 0x1c
push 1
lea ecx, [ebp - 0x70]
call fcn.004017f0
lea ecx, [ebp - 0x8c]
push 1
call fcn.004017f0
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret