Function at 0x403d50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a9ed
mov eax, dword fs:[0]
push eax
sub esp, 0x48c
mov eax, dword [0x432110]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x48c], 0
push str.SOFTWAREMicrosoftSQMClient_
lea ecx, [ebp - 0x458]
call fcn.00403130
mov dword [ebp - 4], 1
push 0x42c36e
lea ecx, [ebp - 0x34]
call fcn.00403130
mov byte [ebp - 4], 2
mov dword [ebp - 0x43c], 1
lea eax, [ebp - 0x14]
push eax
push 0x101
push 0
lea ecx, [ebp - 0x458]
call fcn.004031f0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x403ea7
mov dword [ebp - 0x10], 0x400
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x43c]
push eax
push 0
push str.MachineId
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 0
jne 0x403e4e
push 0x42c37c
call fcn.0040efcc
add esp, 4
lea edx, [ebp - 0x434]
push edx
push str._s_n
call fcn.0040efcc
add esp, 8
jmp 0x403e96
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403170
mov edx, dword [ebp - 0x48c]
or edx, 1
mov dword [ebp - 0x48c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004031b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x458]
call fcn.004031b0
mov eax, dword [ebp + 8]
jmp 0x404011
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x34]
call fcn.004031d0
jmp 0x403f09
push str._n_GetMachineId_INFO_
call fcn.0040efcc
add esp, 4
push str.UNKNOWN_n
call fcn.0040efcc
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403170
mov eax, dword [ebp - 0x48c]
or eax, 1
mov dword [ebp - 0x48c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004031b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x458]
call fcn.004031b0
mov eax, dword [ebp + 8]
jmp 0x404011
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x34]
call fcn.00402c70
cmp eax, 2
jbe 0x403fd8
lea edx, [ebp - 0x46c]
push edx
lea ecx, [ebp - 0x34]
call fcn.00405e10
lea ecx, [ebp - 0x46c]
call fcn.00405e70
mov al, byte [eax]
mov byte [ebp - 0x461], al
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00405e40
lea ecx, [ebp - 0x460]
call fcn.00405e90
mov ecx, eax
call fcn.00405e70
mov dl, byte [eax]
mov byte [ebp - 0x462], dl
movsx eax, byte [ebp - 0x461]
cmp eax, 0x7b
jne 0x403fd8
movsx ecx, byte [ebp - 0x462]
cmp ecx, 0x7d
jne 0x403fd8
lea ecx, [ebp - 0x34]
call fcn.00402c70
sub eax, 2
push eax
push 1
lea edx, [ebp - 0x488]
push edx
lea ecx, [ebp - 0x34]
call fcn.00402d10
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x498], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x498]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00402c30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x488]
call fcn.004031b0
lea edx, [ebp - 0x34]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403170
mov eax, dword [ebp - 0x48c]
or eax, 1
mov dword [ebp - 0x48c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.004031b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x458]
call fcn.004031b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040a92b
mov esp, ebp
pop ebp
ret 4