Function at 0x406140
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x409a2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov eax, dword [esp + 0x70]
push ebx
push ebp
push esi
push edi
push eax
mov edi, ecx
push 0x66
mov dword [esp + 0x24], edi
call sub.MFC70.DLL_Ordinal_300
xor esi, esi
lea ecx, [edi + 0x74]
mov dword [esp + 0x78], esi
mov dword [edi], 0x40af78
call fcn.004041d0
lea ecx, [edi + 0x90]
mov byte [esp + 0x78], 1
call fcn.00401900
lea ebp, [edi + 0x118]
mov ecx, ebp
mov byte [esp + 0x78], 2
call sub.MFC70.DLL_Ordinal_518
mov dword [ebp], 0x40ae10
lea ecx, [edi + 0x16c]
mov byte [esp + 0x78], 3
call fcn.00401900
lea ebp, [edi + 0x1f4]
mov ecx, ebp
mov byte [esp + 0x78], 4
call sub.MFC70.DLL_Ordinal_518
mov dword [ebp], 0x40ae10
lea ebp, [edi + 0x248]
mov ecx, ebp
mov byte [esp + 0x78], 5
call sub.MFC70.DLL_Ordinal_518
mov dword [ebp], 0x40ae10
lea ebp, [edi + 0x29c]
mov ecx, ebp
mov byte [esp + 0x78], 6
call sub.MFC70.DLL_Ordinal_518
mov dword [ebp], 0x40a640
lea ecx, [edi + 0x2f0]
mov byte [esp + 0x78], 7
call fcn.00401900
lea ecx, [edi + 0x378]
mov byte [esp + 0x78], 8
call fcn.00401900
mov dword [edi + 0x408], esi
mov dword [edi + 0x404], 0x40ade0
lea ebx, [edi + 0x418]
mov ecx, ebx
mov byte [esp + 0x78], 0xa
call sub.MFC70.DLL_Ordinal_503
lea ecx, [edi + 0x42c]
mov byte [esp + 0x78], 0xb
call sub.MFC70.DLL_Ordinal_519
lea ecx, [edi + 0x544]
mov byte [esp + 0x78], 0xc
call sub.MFC70.DLL_Ordinal_509
mov byte [esp + 0x78], 0xd
call sub.MFC70.DLL_Ordinal_977
push 0x80
push 0xe
push 0x80
call sub.MFC70.DLL_Ordinal_956
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x104
lea ebp, [edi + 0x440]
push ebp
push esi
mov dword [edi + 0x400], eax
mov word [edi + 0x410], si
mov word [edi + 0x412], si
mov dword [edi + 0x40c], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x2e
push ebp
call dword [sym.imp.MSVCR70.dll_strrchr]
mov ecx, dword [str..ini]
add esp, 8
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [eax], ecx
mov dl, byte [0x40b208]
push 0x40b1f4
push 0x40b1e8
mov byte [eax + 4], dl
call esi
push ebp
push 0
push 0x40b10c
push 0x40b0e8
mov dword [esp + 0x20], eax
call esi
mov word [edi + 0x410], ax
mov eax, dword [esp + 0x10]
mov esi, 1
cmp eax, esi
jl 0x4063c5
call sub.MFC70.DLL_Ordinal_982
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x80], eax
push esi
lea eax, [esp + 0x84]
push 0x40b1dc
push eax
mov byte [esp + 0x84], 0xe
call fcn.00404a40
mov edx, dword [esp + 0x8c]
add esp, 0xc
push ebp
push 0x50
lea ecx, [esp + 0x28]
push ecx
push 0x40a8e0
push edx
push 0x40b1e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + 0x20]
test al, al
je 0x406392
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x20]
push ecx
push eax
mov ecx, ebx
call sub.MFC70.DLL_Ordinal_5474
mov eax, dword [edi + 0x434]
lea ecx, [edi + 0x42c]
push esi
push eax
call sub.MFC70.DLL_Ordinal_5476
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
mov byte [esp + 0x78], 0xd
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4063b8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jle 0x406313
xor ebx, ebx
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x80]
push eax
push 0x20019
push ebx
push str.SoftWareHuDongSHIPDES
push 0x80000001
mov byte [esp + 0x8c], 0xf
mov dword [esp + 0x94], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x406409
mov ebx, dword [esp + 0x80]
xor eax, eax
mov dword [esp + 0x10], ebx
test eax, eax
mov esi, eax
jne 0x406450
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push esi
push str.CurrentSpecialty
push ebx
mov dword [esp + 0x98], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test ebx, ebx
mov esi, eax
je 0x406450
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 0x10], ebx
test esi, esi
mov dword [edi + 0x414], 0xffffffff
jne 0x406491
mov edx, dword [edi + 0x434]
xor eax, eax
test edx, edx
jle 0x406487
mov ecx, dword [edi + 0x430]
movzx esi, word [ecx]
cmp dword [esp + 0x18], esi
je 0x406487
mov esi, dword [edi + 0x434]
inc eax
add ecx, 2
cmp eax, esi
jl 0x406470
cmp eax, edx
jge 0x406491
mov dword [edi + 0x414], eax
push ebp
lea esi, [edi + 0x74]
call fcn.00405ef0
push esi
call fcn.00404350
add esp, 8
test ebx, ebx
mov dword [edi + 0x88], eax
je 0x4064b4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x70]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret 4