Function at 0x4084e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x415004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x4c], 0
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
push ecx
call fcn.00409710
test al, al
je 0x408549
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x7c], 1
jne 0x40c4fa
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x20], 0xffffffff
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x34], 0xffffffff
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x38], 0xffffffff
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x40], 0xffffffff
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], 0xffffffff
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x48], 0xffffffff
push eax
lea eax, [ebp - 0x20]
mov edx, ebx
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00409490
mov edi, eax
test edi, edi
jne 0x408878
push esi
lea eax, [ebp - 0x48]
push eax
push 0x20019
push edi
push 0x4014d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40c515
mov ecx, dword [ebp - 0x20]
cmp ecx, 2
je 0x40c561
cmp ecx, 5
jne 0x40c56d
mov dword [ebp - 0x20], 3
mov esi, dword [ebp - 0x38]
cmp esi, 0xffffffff
jne 0x40c57b
mov byte [ebp - 0x21], 1
lea eax, [ebp - 0x4c]
push eax
push ecx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004088e0
mov ebx, dword [ebp - 0x4c]
mov edi, eax
test edi, edi
jne 0x40c74c
or eax, 0xffffffff
cmp esi, eax
jg 0x40c584
mov ecx, dword [ebp - 0x3c]
cmp ecx, eax
jg 0x40c58b
mov ecx, dword [ebp - 0x40]
cmp ecx, eax
jg 0x40c592
mov ecx, dword [ebp - 0x44]
inc eax
cmp dword [ebp - 0x20], 2
mov ebx, 3
mov dword [ebp - 0x48], eax
mov eax, 1
cmove ebx, eax
mov dword [ebp - 0x34], ecx
test ecx, ecx
jne 0x40c599
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x30]
xor edi, edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0
test eax, eax
je 0x40c683
lea eax, [ebp - 0x50]
test eax, eax
je 0x40c683
lea eax, [ebp - 0x54]
test eax, eax
je 0x40c683
lea eax, [ebp - 0x60]
test eax, eax
je 0x40c683
test esi, esi
je 0x40c5c1
push esi
mov dword [ebp - 0x40], edi
call fcn.004088b0
test al, al
jne 0x40c683
cmp ebx, 4
je 0x40c5e6
cmp ebx, 5
je 0x40c5e6
push 0xa
push 0xb
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.msvcrt.dll__itow_s]
add esp, 0x10
xor edi, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x3c], edi
push esi
call fcn.004088b0
test al, al
jne 0x40c634
lea eax, [ebp - 0x1c]
push eax
call fcn.004088b0
test al, al
jne 0x40c634
lea eax, [ebp - 0x1c]
push eax
push 0x17
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x401450
push 0x41579c
call fcn.004091d0
mov ebx, dword [ebp - 0x44]
add esp, 0x18
test al, al
je 0x40c5f0
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c5fa
test ebx, ebx
je 0x408777
push ebx
call sub.msvcrt.dll_free
add esp, 4
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x40878c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x3c], 0
test edi, edi
jne 0x40c68f
lea eax, [ebp - 0x1c]
push eax
push 0x17
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x4012c8
push 0x41579c
call fcn.004091d0
add esp, 0x18
test al, al
je 0x40c683
mov ebx, dword [ebp - 0x40]
lea eax, [ebp - 0x30]
push eax
push 0x20019
push edi
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
jne 0x40c63e
add byte ds:[eax], al
cmp word [ebp - 0x78], 0
je 0x408549
lea ecx, [ebp - 0xa8]
call fcn.0040dbfc
jmp 0x408549
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20]
cmp ecx, 1
je 0x40c52f
cmp ecx, 2
jne 0x4085da
mov eax, dword [0x415798]
sub esp, 8
fld qword [0x407a78]
mov edi, 0x23
mov esi, dword [eax]
fstp qword [esp]
push ecx
push edi
mov esi, dword [esi + 4]
mov ecx, esi
push 0
push eax
call dword [0x41626c]
call esi
add esp, 0x18
jmp 0x408877
mov dword [ebp - 0x20], 1
jmp 0x4085ea
cmp ecx, 4
je 0x4085e3
jmp 0x4085ea
mov byte [ebp - 0x21], 0
jmp 0x4085fa
mov eax, esi
jmp 0x40862b
mov eax, ecx
jmp 0x408636
mov eax, ecx
jmp 0x408641
mov eax, dword [0x415798]
push ecx
push 0x24
push 0
mov esi, dword [eax]
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x41626c]
call esi
mov eax, dword [ebp - 0x2c]
add esp, 0x10
mov dword [ebp - 0x38], eax
jmp 0x40866d
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00408e60
mov ebx, dword [ebp - 0x50]
test al, al
je 0x40c685
jmp 0x4087df
mov ebx, 3
jmp 0x4086e8
mov edi, 0xfffb0000
jmp 0x40876a
push dword [ebp - 0x28]
lea edi, [eax - 2]
mov eax, dword [0x4157a0]
neg edi
push 0x19
sbb edi, edi
mov esi, dword [eax]
and edi, 0x10000
push 0
push eax
add edi, 0xfffa0000
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x41626c]
call esi
mov esi, dword [ebp - 0x28]
add esp, 0x10
jmp 0x40876a
mov edi, 0xfffb0000
jmp 0x40878c
cmp ecx, 2
jne 0x40c665
mov eax, dword [0x4157a0]
push dword [ebp - 0x28]
push ebx
mov esi, dword [eax]
push 0x27
push 0
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x41626c]
call esi
add esp, 0x14
jmp 0x40c680
mov edi, dword [0x4157a0]
push ebx
push 0x14
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x41626c]
mov ecx, edi
call esi
mov esi, dword [ebp - 0x28]
xor ebx, ebx
mov edi, 0xfffb0000
jmp 0x4087df
xor ebx, ebx
jmp 0x4087df
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
jmp 0x408853