Function at 0x409ec0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push ebx
push esi
push edi
lea edi, [ebp - 0x45c]
mov ecx, 0x117
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4953e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x36c], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x45c], ecx
cmp dword [ebp - 0x45c], 1
je 0x409f61
cmp dword [ebp - 0x45c], 2
je 0x409f25
cmp dword [ebp - 0x45c], 4
je 0x409f31
jmp 0x409f72
mov dword [ebp - 0x36c], 0
jmp 0x409f72
cmp dword [ebp + 0xc], 0
jne 0x409f5f
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shl ecx, 0x1f
sar ecx, 0x1f
test ecx, ecx
jne 0x409f55
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shl ecx, 0x1e
sar ecx, 0x1f
test ecx, ecx
je 0x409f5f
mov dword [ebp - 0x36c], 1
jmp 0x409f72
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
shl ecx, 0x1f
sar ecx, 0x1f
mov dword [ebp - 0x36c], ecx
cmp dword [ebp - 0x36c], 0
jne 0x409f85
cmp dword [ebp + 0xc], 0
je 0x40a1cc
call fcn.00401163
test eax, eax
je 0x409f97
mov dword [ebp - 0xc], str.SYSTEMCurrentControlSetControlClass_
jmp 0x409f9e
mov dword [ebp - 0xc], str.SYSTEMCurrentControlSetServicesClass_
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.0040f930
test eax, eax
jne 0x40a1cc
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x384], 0x104
push 0x104
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.0040f9c0
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x394]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x384]
push ecx
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x378]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp esi, esp
call fcn.0040f930
test eax, eax
jne 0x40a1b9
lea eax, [ebp - 0x130]
push eax
call fcn.00410280
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040e6e0
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x130]
push ecx
call fcn.0040e6e0
add esp, 4
add esi, eax
cmp esi, 0x104
jae 0x40a185
push 0x104
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.0040f9c0
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push str._s_s
lea edx, [ebp - 0x348]
push edx
call fcn.00413720
add esp, 0x10
mov esi, esp
lea eax, [ebp - 0x24]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x348]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp esi, esp
call fcn.0040f930
test eax, eax
jne 0x40a185
mov dword [ebp - 0x384], 0x104
mov esi, esp
lea eax, [ebp - 0x384]
push eax
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x360]
push edx
push 0
push str.Class
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.0040f930
cmp dword [ebp - 0x36c], 0
je 0x40a11b
mov dword [ebp - 0x45c], 0
jmp 0x40a124
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x45c], eax
mov ecx, dword [ebp - 0x45c]
push ecx
lea edx, [ebp - 0x354]
push edx
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x23c]
push ecx
lea edx, [ebp - 0x348]
push edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
call fcn.0040107d
add esp, 0x18
cmp dword [ebp - 0x354], 0
je 0x40a172
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x354]
push ecx
call fcn.0040a3c0
add esp, 8
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.0040f930
push 0x104
push 0
lea eax, [ebp - 0x130]
push eax
call fcn.0040f9c0
add esp, 0xc
mov dword [ebp - 0x384], 0x104
mov eax, dword [ebp - 0x378]
add eax, 1
mov dword [ebp - 0x378], eax
jmp 0x409ff3
mov esi, esp
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.0040f930
mov eax, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x40a200]
call fcn.0040f8d0
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f960
add esp, 0x45c
cmp ebp, esp
call fcn.0040f930
mov esp, ebp
pop ebp
ret