Function at 0x4044f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push ebx
push esi
push edi
push 0x475078
lea eax, [ebp - 0x88]
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x40453d
push 0x47509c
lea eax, [ebp - 0x88]
push eax
call fcn.0041bfb0
add esp, 8
call fcn.0040b561
mov dword [ebp - 8], eax
jmp 0x40456a
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x40456a
push 0x4750a4
lea eax, [ebp - 0x88]
push eax
call fcn.0041bfb0
add esp, 8
push 3
call fcn.004128a8
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x118], 0
cmp dword [ebp + 0xc], 0x2b0
jbe 0x40459b
test byte [ebp - 8], 2
je 0x40459b
mov eax, dword [ebp + 8]
mov dword [eax + 0x118], 2
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404602
cmp dword [ebp - 0x28c], 2
jne 0x4045d9
jmp 0x4045fd
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10001
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x404de2
jmp 0x404dba
mov eax, dword [ebp + 8]
or dword [eax + 0x118], 1
mov dword [ebp - 4], 0x80
push 0x4750b0
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404670
push 0x4750b8
mov eax, dword [ebp + 8]
push eax
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 4], 0x14
push 0x4750c0
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4046de
push 0x4750c8
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 4], 0x80
push 0x4750d0
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x120
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x40474c
push 0x4750dc
mov eax, dword [ebp + 8]
add eax, 0x120
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x40479d
cmp dword [ebp - 0x28c], 6
je 0x40479d
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x404de2
push 0x4750e4
lea eax, [ebp - 0x88]
push eax
call fcn.0041bfb0
add esp, 8
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x404d12
mov dword [ebp - 4], 0x80
push 0x4750f0
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404840
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
jmp 0x4048a9
push 0x475100
lea eax, [ebp - 0x390]
push eax
call fcn.0041c3a0
add esp, 8
test eax, eax
jne 0x40486e
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 1
jmp 0x4048a9
push 0x475104
lea eax, [ebp - 0x390]
push eax
call fcn.0041c3a0
add esp, 8
test eax, eax
jne 0x40489c
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 2
jmp 0x4048a9
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
mov dword [ebp - 4], 0x80
push 0x475108
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404917
push 0x475118
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
call fcn.0041bfa0
add esp, 8
mov dword [ebp - 4], 0x80
push 0x475120
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x40497f
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
jmp 0x404a44
push 0x47512c
lea eax, [ebp - 0x390]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
je 0x4049ad
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 1
jmp 0x404a44
push 0x475134
lea eax, [ebp - 0x390]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
je 0x4049db
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 2
jmp 0x404a44
push 0x475138
lea eax, [ebp - 0x390]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
je 0x404a09
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 4
jmp 0x404a44
push 0x475140
lea eax, [ebp - 0x390]
push eax
call fcn.0041c320
add esp, 8
test eax, eax
je 0x404a37
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 8
jmp 0x404a44
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
cmp dword [ebp + 0xc], 0x2b4
jne 0x404b7e
mov dword [ebp - 4], 0x80
push 0x475148
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404ab9
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 0xffffffff
jmp 0x404b7e
push 0x475154
lea eax, [ebp - 0x390]
push eax
call fcn.0041d600
add esp, 8
test eax, eax
jne 0x404ae7
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 3
jmp 0x404b7e
push 0x475164
lea eax, [ebp - 0x390]
push eax
call fcn.0041d600
add esp, 8
test eax, eax
jne 0x404b15
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 2
jmp 0x404b7e
push 0x475170
lea eax, [ebp - 0x390]
push eax
call fcn.0041d600
add esp, 8
test eax, eax
jne 0x404b43
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 1
jmp 0x404b7e
push 0x475174
lea eax, [ebp - 0x390]
push eax
call fcn.0041d600
add esp, 8
test eax, eax
jne 0x404b71
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 4
jmp 0x404b7e
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 0xffffffff
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x404ce6
mov dword [ebp - 4], 0x80
push 0x47517c
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404bf2
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
jmp 0x404c01
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a4], eax
push 0x475184
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404c62
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
jmp 0x404c71
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a8], eax
push 0x47518c
lea eax, [ebp - 0x310]
push eax
call fcn.0041bfa0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404cd2
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
jmp 0x404ce1
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1ac], eax
jmp 0x404d0d
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
jmp 0x404d69
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
push 0x475194
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
call fcn.0041bfa0
add esp, 8
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x404dba
cmp dword [ebp - 0x28c], 6
je 0x404dba
push 0x2002000
call fcn.004042f8
add esp, 4
push 0x10002
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x404de2
mov eax, dword [ebp + 8]
mov dword [eax + 0x11c], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x1b0], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x230], 0
xor eax, eax
jmp 0x404de2
pop edi
pop esi
pop ebx
leave
ret