Function at 0x4103c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x414
lea eax, [esp + 0xc]
push esi
push edi
push eax
xor esi, esi
push 1
push esi
push 0x439dec
mov edi, ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4106ca
push ebx
lea ecx, [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
push esi
mov ebx, 4
push 0x439de4
push ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x410433
cmp dword [esp + 0x14], ebx
jne 0x410433
mov edx, dword [esp + 0x18]
mov dword [edi + 0x174], edx
jmp 0x410439
mov dword [edi + 0x174], esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
push esi
push 0x439dd8
push eax
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x41046f
cmp dword [esp + 0x14], ebx
jne 0x41046f
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x13c], ecx
jmp 0x410475
mov dword [edi + 0x13c], esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push 0x439dd0
push edx
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x4104ab
cmp dword [esp + 0x14], ebx
jne 0x4104ab
mov eax, dword [esp + 0x18]
mov dword [edi + 0x160], eax
jmp 0x4104b1
mov dword [edi + 0x160], esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
push esi
mov ebx, 0x400
push 0x439dc8
push ecx
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x4104e8
cmp dword [esp + 0x14], 1
jne 0x4104e8
lea edx, [esp + 0x24]
push edx
jmp 0x4104ed
push 0x43c740
lea ecx, [edi + 0x14c]
call fcn.0042322b
lea eax, [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
push esi
push 0x4395a4
push eax
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x41052a
cmp dword [esp + 0x14], 1
jne 0x41052a
lea ecx, [esp + 0x24]
push ecx
jmp 0x41052f
push 0x43c740
lea ecx, [edi + 0x148]
call fcn.0042322b
lea edx, [esp + 0x10]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push 0x439dc0
push edx
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x410572
cmp dword [esp + 0x14], 1
jne 0x410572
lea eax, [esp + 0x24]
lea ebx, [edi + 0x154]
push eax
jmp 0x41057d
lea ebx, [edi + 0x154]
push 0x43c740
mov ecx, ebx
call fcn.0042322b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push edx
push eax
push esi
push 0x4395cc
push ecx
mov dword [esp + 0x28], 0x400
call ebp
test eax, eax
jne 0x410648
cmp dword [esp + 0x14], 3
jne 0x410648
mov edx, dword [ebx]
lea ebp, [edi + 0x158]
push 0x43c740
mov ecx, ebp
mov eax, dword [edx - 8]
mov dword [esp + 0x24], eax
call fcn.0042322b
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x410605
mov eax, esi
mov ecx, dword [ebx]
cdq
idiv dword [esp + 0x20]
mov al, byte [esp + esi + 0x24]
mov dl, byte [edx + ecx]
mov ecx, ebp
sub al, dl
push eax
mov byte [esp + esi + 0x28], al
call fcn.0042343f
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x4105de
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor esi, esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
push esi
mov ebx, 4
push 0x439db0
push eax
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x41065a
cmp dword [esp + 0x14], ebx
jne 0x41065a
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x150], ecx
jmp 0x410660
push 0x43c740
lea ecx, [edi + 0x158]
call fcn.0042322b
jmp 0x41060d
mov dword [edi + 0x150], esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push 0x4393e0
push edx
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x4106aa
cmp dword [esp + 0x14], ebx
jne 0x4106aa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [edi + 0x15c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x414
ret
mov ecx, dword [esp + 0x1c]
mov dword [edi + 0x15c], 1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x414
ret
push 0x43c740
lea ecx, [edi + 0x14c]
mov dword [edi + 0x174], esi
mov dword [edi + 0x160], esi
mov dword [edi + 0x13c], esi
call fcn.0042322b
push 0x43c740
lea ecx, [edi + 0x148]
call fcn.0042322b
push 0x43c740
lea ecx, [edi + 0x154]
call fcn.0042322b
push 0x43c740
lea ecx, [edi + 0x158]
call fcn.0042322b
mov dword [edi + 0x150], esi
mov dword [edi + 0x15c], 1
pop edi
pop esi
add esp, 0x414
ret