Function at 0x40709b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x4741b0
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407142
cmp dword [ebp - 8], 2
jne 0x40712b
push 2
push 0x4741bc
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407126
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x407142
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741c0
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4071d8
cmp dword [ebp - 8], 2
jne 0x4071c1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4071bc
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x4071d8
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741c8
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40726e
cmp dword [ebp - 8], 2
jne 0x407257
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407252
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x40726e
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741d0
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407304
cmp dword [ebp - 8], 2
jne 0x4072ed
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4072e8
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x407304
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741d8
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40739a
cmp dword [ebp - 8], 2
jne 0x407383
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40737e
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x40739a
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741e0
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407430
cmp dword [ebp - 8], 2
jne 0x407419
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407414
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x407430
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741e8
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4074c6
cmp dword [ebp - 8], 2
jne 0x4074af
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4074aa
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x4074c6
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741f0
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40755c
cmp dword [ebp - 8], 2
jne 0x407545
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407540
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x40755c
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
push 0x4741f8
lea eax, [ebp - 0x48]
push eax
call fcn.0041d13c
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4075f3
cmp dword [ebp - 8], 2
jne 0x4075dc
push 5
push 0x474204
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4075d7
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
jmp 0x4075f3
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4075fa
xor eax, eax
jmp 0x4075fa
pop edi
pop esi
pop ebx
leave
ret