Function at 0x40787b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x4883ac
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407922
cmp dword [ebp - 8], 2
jne 0x40790b
push 2
push 0x4883b8
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407906
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407922
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883bc
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4079b8
cmp dword [ebp - 8], 2
jne 0x4079a1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40799c
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x4079b8
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883c4
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407a4e
cmp dword [ebp - 8], 2
jne 0x407a37
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407a32
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407a4e
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883cc
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407ae4
cmp dword [ebp - 8], 2
jne 0x407acd
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407ac8
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407ae4
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883d4
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407b7a
cmp dword [ebp - 8], 2
jne 0x407b63
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407b5e
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407b7a
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883dc
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407c10
cmp dword [ebp - 8], 2
jne 0x407bf9
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407bf4
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407c10
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883e4
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407ca6
cmp dword [ebp - 8], 2
jne 0x407c8f
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407c8a
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407ca6
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883ec
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407d3c
cmp dword [ebp - 8], 2
jne 0x407d25
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407d20
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407d3c
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
push 0x4883f4
lea eax, [ebp - 0x48]
push eax
call fcn.004202d0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407dd3
cmp dword [ebp - 8], 2
jne 0x407dbc
push 5
push 0x488400
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x407db7
push 0x10003
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
jmp 0x407dd3
push 0x10006
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407dda
xor eax, eax
jmp 0x407dda
pop edi
pop esi
pop ebx
leave
ret