Function at 0x404870
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416788
push 0x407eec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffc98
mov eax, dword [0x41b2c0]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x358], 1
mov dword [ebp - 0x354], 0
mov dword [ebp - 0x34c], 0x104
mov dword [ebp - 0x348], 0x104
push 0x104
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x230]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0
lea edx, [ebp - 0x350]
push edx
lea eax, [ebp - 0x230]
push eax
call fcn.00407800
add esp, 4
push eax
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x350]
push eax
push 0x4163f4
call fcn.00407800
add esp, 4
push eax
push 0x4163f8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x350]
push edx
push 2
push 0x4163fc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0x230]
push ecx
push 0x41bc40
call fcn.00407700
add esp, 8
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x2d
push 0x41bc40
call fcn.00407900
add esp, 0xc
push 0
lea edx, [ebp - 0x350]
push edx
push 0x41bc40
call fcn.00407800
add esp, 4
push eax
push 0x41bc40
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x350]
push ecx
push 2
push 0x416400
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x230]
push eax
call fcn.00408378
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x238]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x230]
push edx
push SQLCancel
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x404a3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
je 0x404a2e
mov eax, dword [ebp - 0x35c]
push eax
call fcn.00405c70
add esp, 4
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [ebp + 0x10], 0
je 0x404b5e
mov dword [ebp - 0x348], 0x418
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x234]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x404aa3
mov eax, dword [ebp - 0x360]
push eax
call fcn.00405c70
add esp, 4
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x25], 0
push 0
lea ecx, [ebp - 0x350]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00407800
add esp, 4
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x350]
push edx
push 0x416404
call fcn.00407800
add esp, 4
push eax
push 0x416408
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x350]
push ecx
push 2
push 0x41640c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x350]
push eax
mov ecx, dword [ebp - 0x348]
push ecx
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x350]
push ecx
push 2
push 0x416410
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x404da0
mov dword [ebp - 0x34c], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x340]
push ecx
mov edx, dword [ebp - 0x354]
push edx
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x404da0
mov dword [ebp - 0x348], 0x418
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x234]
push eax
push 0
lea ecx, [ebp - 0x340]
push ecx
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404c0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
je 0x404bf7
mov eax, dword [ebp - 0x364]
push eax
call fcn.00405c70
add esp, 4
push 0
push 0
push 0
push 0xe0000101
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x25], 0
cmp dword [ebp - 0x234], 1
je 0x404c29
cmp dword [ebp - 0x234], 7
je 0x404c29
cmp dword [ebp - 0x234], 2
jne 0x404c38
mov ecx, dword [ebp - 0x348]
sub ecx, 1
mov dword [ebp - 0x348], ecx
push 0
lea edx, [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x340]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x350]
push eax
push 0x416414
call fcn.00407800
add esp, 4
push eax
push 0x416418
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x350]
push edx
push 2
push 0x41641c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x378], ecx
cmp dword [ebp - 0x378], 1
je 0x404cbc
cmp dword [ebp - 0x378], 4
je 0x404ce2
jmp 0x404d68
push 0
lea edx, [ebp - 0x350]
push edx
mov eax, dword [ebp - 0x348]
push eax
lea ecx, [ebp - 0x128]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x404d68
mov byte [ebp - 0x370], 0
xor eax, eax
mov dword [ebp - 0x36f], eax
mov dword [ebp - 0x36b], eax
mov word [ebp - 0x367], ax
mov byte [ebp - 0x365], al
mov dword [ebp - 0x374], 0
push 4
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x374]
push edx
call fcn.004084a0
add esp, 0xc
push 0xa
lea eax, [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x374]
push ecx
call fcn.004080c8
add esp, 0xc
push 0
lea edx, [ebp - 0x350]
push edx
lea eax, [ebp - 0x370]
push eax
call fcn.00407800
add esp, 4
push eax
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x350]
push eax
push 2
push 0x416420
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x354]
add edx, 1
mov dword [ebp - 0x354], edx
mov dword [ebp - 0x34c], 0x104
jmp 0x404b68
push 0
lea eax, [ebp - 0x350]
push eax
push 2
push 0x416424
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 0xffffffff
jmp 0x404ddd
cmp dword [ebp - 0x238], 0
je 0x404df3
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.00407d96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret