Function at 0x40cb20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541e62
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x594ca8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5704e4
lea ecx, [ebp - 0x120]
call fcn.004040f0
mov dword [ebp - 4], 0
call fcn.00417597
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40cb7f
push 0x80004005
call fcn.00404860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x11c], eax
push str.1905Client.exe
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
lea ecx, [ebp - 0x11c]
push 0x570bc4
push ecx
mov byte [ebp - 4], 1
call fcn.00403cc0
push 0x103
lea edx, [ebp - 0x113]
push 0
push edx
mov dword [ebp - 0x130], 0x104
mov byte [ebp - 0x114], 0
call fcn.00518f10
mov ebx, dword [ebp - 0x11c]
add esp, 0x1c
test ebx, ebx
je 0x40cc1e
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jg 0x40cc1e
lea edi, [eax + eax]
mov eax, edi
call fcn.0051b8f0
mov esi, esp
test esi, esi
je 0x40cc1e
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 3
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x40cc20
xor eax, eax
lea ecx, [ebp - 0x118]
push ecx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ccde
mov ecx, dword [ebp - 0x118]
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push str.ClientVersion
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ccde
mov edx, dword [ebp - 0x118]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
cmp edi, 0x3fffffff
jg 0x40ccb7
lea eax, [edi + edi]
call fcn.0051b8f0
mov esi, esp
test esi, esi
je 0x40ccb7
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x114]
xor ecx, ecx
push edx
push ecx
push 3
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40ccbd
xor esi, esi
xor eax, eax
jmp 0x40ccd1
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ccc2
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [ebp - 0x120]
call fcn.004046e0
call fcn.00417597
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40ccf8
push 0x80004005
call fcn.00404860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x118], eax
lea esi, [ebp - 0x118]
mov byte [ebp - 4], 2
call fcn.00402240
mov esi, dword [ebp - 0x118]
push 0x5c
push esi
call fcn.005172f0
add esp, 8
test eax, eax
jne 0x40cd33
or eax, 0xffffffff
jmp 0x40cd37
sub eax, esi
sar eax, 1
push eax
lea ecx, [ebp - 0x134]
push ecx
lea ecx, [ebp - 0x118]
call fcn.004037c0
push str.exe_
push eax
lea edx, [ebp - 0x12c]
push edx
mov byte [ebp - 4], 3
call fcn.00404260
push str.1905Client.exe
push eax
lea eax, [ebp - 0x124]
mov ebx, 4
push eax
mov byte [ebp - 4], bl
call fcn.00404260
add esp, 0x18
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff0
or edi, 0xffffffff
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cdb4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x12c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cdd9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x134]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cdfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
lea edx, [ebp - 0x118]
mov dword [ebp - 0x138], esp
mov ecx, esp
push edx
call fcn.00404900
lea eax, [ebp - 0x128]
push eax
call fcn.00402e00
mov ecx, dword [ebp - 0x120]
xor eax, eax
add esp, 8
test ecx, ecx
setne al
test eax, eax
jne 0x40ce3d
push 0x80004005
call fcn.00404860
mov esi, dword [ebp - 0x128]
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40ce69
test dx, dx
je 0x40ce65
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40ce69
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x40ce45
xor eax, eax
jmp 0x40ce6d
sbb eax, eax
sbb eax, edi
test eax, eax
sete al
test al, al
lea eax, [esi - 0x10]
mov edx, edi
lea ecx, [eax + 0xc]
je 0x40cf0b
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x118]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ceba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cedf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x120]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40cf01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x40cf8c
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cf1e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x118]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cf43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x11c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cf68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x120]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x40cf8a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
lea esp, [ebp - 0x148]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005155a4
mov esp, ebp
pop ebp
ret