Function at 0x412eb0
Capabilities:
Query or enumerate registry value
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
mov eax, 0x5cbf84
call fcn.00496be4
mov word [ebp - 0x20], 0x14
mov edx, 0x5c2902
lea eax, [ebp - 4]
call fcn.004a44ec
inc dword [ebp - 0x14]
mov word [ebp - 0x20], 8
mov dword [ebp - 0x38], 0x320
lea edx, [ebp - 0x3c]
push edx
push 0xf003f
push 0
mov word [ebp - 0x20], 0x20
push dword [ebp - 4]
lea eax, [ebp - 8]
call fcn.00401af8
push eax
inc dword [ebp - 0x14]
call fcn.004106e8
add esp, 8
lea eax, [ebp - 8]
call fcn.00401b28
push eax
push reloc.WSOCK32.DLL_accept
call sub.ADVAPI32.DLL_RegOpenKeyExA
dec dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004a4690
lea ecx, [ebp - 0x38]
push ecx
lea eax, [ebp - 0x168]
push eax
push 0
push 0
push 0x5c292c
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_RegQueryValueExA
push dword [ebp - 0x3c]
call sub.ADVAPI32.DLL_RegCloseKey
push 0
push 0x80
push 4
push 0
push 1
push closesocket
lea edx, [ebp - 0x168]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov dword [ebp - 0x34], eax
xor ecx, ecx
mov dword [ebp - 0x40], ecx
mov word [ebp - 0x20], 8
push 0
push 0
push 0
push 2
push 0
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CreateFileMappingA
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x412fc7
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x413188
push 0
push 0
push 0
push 4
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_MapViewOfFile
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x413013
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
jmp 0x413188
mov ecx, dword [ebp - 0x40]
movsx eax, byte [ecx + 0x64]
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x40]
mov cl, byte [edx + 0x62]
mov byte [ebp - 0x49], cl
mov eax, dword [ebp - 0x40]
mov dl, byte [eax + 0x63]
mov byte [ebp - 0x4a], dl
mov cl, byte [ebp - 0x49]
and cl, 0xff
xor eax, eax
mov al, cl
mov dl, byte [ebp - 0x4a]
and dl, 0xff
xor ecx, ecx
mov cl, dl
shl ecx, 8
or ax, cx
mov word [ebp - 0x4c], ax
mov eax, dword [ebp - 0x40]
mov dl, byte [eax + 0x60]
mov byte [ebp - 0x49], dl
mov ecx, dword [ebp - 0x40]
mov al, byte [ecx + 0x61]
mov byte [ebp - 0x4a], al
mov dl, byte [ebp - 0x49]
and dl, 0xff
xor ecx, ecx
mov cl, dl
mov al, byte [ebp - 0x4a]
and al, 0xff
xor edx, edx
mov dl, al
shl edx, 8
or cx, dx
mov word [ebp - 0x4e], cx
mov cx, word [ebp - 0x4e]
and cx, 0xffff
movzx eax, cx
mov dx, word [ebp - 0x4c]
and dx, 0xffff
movzx ecx, dx
shl ecx, 0x10
or eax, ecx
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x5c], eax
xor edx, edx
mov dword [ebp - 0x60], edx
jmp 0x413145
xor ecx, ecx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x54]
lea ecx, [eax + edx]
mov eax, dword [ebp - 0x5c]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x60]
mov al, byte [edx + ecx]
mov edx, dword [ebp - 0x58]
mov byte [ebp + edx - 0x294], al
add dword [ebp - 0x5c], 2
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0x44
jle 0x4130b0
mov byte [ebp - 0x250], 0
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
lea eax, [ebp - 0x294]
push eax
call fcn.00412e5c
pop ecx
test eax, eax
jne 0x413141
mov edx, dword [0x5da0b8]
mov ecx, dword [edx + 0x2d4]
add ecx, 0x208
mov dword [ebp - 0x64], ecx
mov word [ebp - 0x20], 0x2c
lea edx, [ebp - 0x294]
lea eax, [ebp - 0xc]
call fcn.004a44ec
inc dword [ebp - 0x14]
mov edx, dword [eax]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x34]
dec dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004a4690
add dword [ebp - 0x60], 0x44
imul ecx, dword [ebp - 0x48], 0x44
cmp ecx, dword [ebp - 0x60]
jg 0x4130ab
push dword [ebp - 0x40]
call sub.KERNEL32.DLL_UnmapViewOfFile
push dword [ebp - 0x44]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 0x34]
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
push eax
dec dword [ebp - 0x14]
lea eax, [ebp - 4]
mov edx, 2
call fcn.004a4690
pop eax
mov edx, dword [ebp - 0x30]
mov dword fs:[0], edx
mov esp, ebp
pop ebp
ret