Function at 0x401580
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49dd47
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x4bfdd0]
xor eax, esp
mov dword [esp + 0x170], eax
push ebx
push esi
push edi
mov eax, dword [0x4bfdd0]
xor eax, esp
push eax
lea eax, [esp + 0x188]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0046d898
mov eax, dword [esi + 0x164]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x4a5578
xor ebx, ebx
push ebx
push 0x14a
push eax
call edi
mov ecx, dword [esi + 0x164]
push 0x4a5584
push 1
push 0x14a
push ecx
call edi
mov edx, dword [esi + 0x164]
push ebx
push 1
push 0x14e
push edx
call edi
push 0x4a5590
lea ecx, [esi + 0x1ec]
call fcn.0046df9b
mov eax, dword [esi + 0x3b0]
push 0x4a5590
push ebx
push 0x14a
push eax
call edi
mov ecx, dword [esi + 0x3b0]
push 0x4a55a0
push 1
push 0x14a
push ecx
call edi
mov edx, dword [esi + 0x3b0]
push str.Internet
push 2
push 0x14a
push edx
call edi
mov eax, dword [esi + 0x3b0]
push str.ArcGIS_Server_Object_Manager_SOM_
push 3
push 0x14a
push eax
call edi
mov ecx, dword [esi + 0x3b0]
push ebx
push ebx
push 0x14e
push ecx
call edi
mov edx, dword [esi + 0x308]
push 0x21
push ebx
push 0x1036
push edx
call edi
mov eax, dword [esi + 0x35c]
push 0x21
push ebx
push 0x1036
push eax
call edi
push str.8128
lea ecx, [esi + 0x240]
call fcn.0046df9b
mov eax, 0x4a55f4
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x4a55fc
mov dword [esp + 0x3c], 0x4a5608
mov dword [esp + 0x40], 0x4a5614
mov dword [esp + 0x44], 0x4a561c
mov dword [esp + 0x48], 0x4a5628
mov dword [esp + 0x4c], 0x4a5634
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x58], ebx
cmp ebx, 6
jne 0x401706
mov dword [esp + 0x5c], 0
jmp 0x401716
mov ecx, ebx
neg ecx
sbb ecx, ecx
and ecx, 0x32
add ecx, 0x32
mov dword [esp + 0x5c], ecx
lea edx, [esp + 0x54]
push edx
push ebx
mov dword [esp + 0x68], eax
mov eax, dword [esi + 0x308]
push 0x101b
push eax
call edi
mov eax, dword [esp + ebx*4 + 0x38]
add ebx, 1
test eax, eax
jne 0x4016f7
xor ebx, ebx
mov dword [esp + 0x34], 0x4a55f4
mov dword [esp + 0x38], 0x4a563c
mov dword [esp + 0x3c], 0x4a5644
mov dword [esp + 0x40], 0x4a5650
mov dword [esp + 0x44], ebx
mov eax, 0x4a55f4
mov ecx, ebx
neg ecx
lea edx, [esp + 0x54]
push edx
sbb ecx, ecx
push ebx
and ecx, 0x73
mov dword [esp + 0x68], eax
mov eax, dword [esi + 0x35c]
push 0x101b
add ecx, 0x32
push eax
mov dword [esp + 0x6c], ecx
call edi
mov eax, dword [esp + ebx*4 + 0x38]
add ebx, 1
test eax, eax
jne 0x401764
push esi
mov dword [esi + 0x98], eax
call fcn.00401be0
test eax, eax
je 0x401b22
lea ebx, [esi + 0xf0]
push 1
mov ecx, ebx
call fcn.0046e071
xor eax, eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x1c]
push ecx
push 0x2001f
push eax
push str.SYSTEMCurrentControlSetServices_
mov dword [esp + 0x1a0], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401b74
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.Start
push ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401852
cmp dword [esp + 0x18], 4
jne 0x401852
cmp dword [esp + 0x24], 2
push eax
jne 0x401842
mov edx, dword [esi + 0xbc]
push 1
push 0xf1
push edx
jmp 0x401850
mov eax, dword [esi + 0xbc]
push 0
push 0xf1
push eax
call edi
push 0x103
lea ecx, [esp + 0x79]
push 0
push ecx
mov byte [esp + 0x80], 0
call fcn.00487460
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ImagePath
push ebx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401aed
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x4018ad
cmp eax, 2
jne 0x401aed
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4018c1
cmp byte [esp + eax + 0x73], 0
je 0x4018c6
jmp 0x401aed
mov byte [esp + 0x74], 0
cmp dword [esi + 0x78], 0
je 0x401aed
push 0x4a6221
lea ecx, [esp + 0x18]
call fcn.004051c0
push 0x4a6221
lea ecx, [esp + 0x1c]
mov byte [esp + 0x194], 1
call fcn.004051c0
lea edi, [esp + 0x2c]
mov byte [esp + 0x190], 2
call fcn.0040da60
push str.XSvr.exe
push eax
lea edx, [esp + 0x30]
push edx
mov byte [esp + 0x19c], 3
call fcn.00405010
add esp, 0xc
mov byte [esp + 0x190], 4
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x18]
push str.__s_
push ecx
call fcn.004051a0
mov byte [esp + 0x19c], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401965
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x190], 2
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40198d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x1c]
push 0x4a6224
push edx
call fcn.004051a0
mov eax, dword [esp + 0x24]
add esp, 0xc
lea ebx, [esp + 0x14]
mov dword [esp + 0x30], eax
call fcn.00404290
mov edi, eax
call fcn.00404f70
mov ecx, dword [esp + 0x30]
mov eax, dword [eax]
push ecx
push eax
call fcn.00483f37
add esp, 8
test eax, eax
je 0x401a99
push 0x34
push 0x4a56b4
push 0x4a56c0
mov ecx, esi
call fcn.00468b72
cmp eax, 7
jne 0x401a99
push 0
lea ecx, [esi + 0xf0]
call fcn.0046e071
push 0
lea ecx, [esi + 0x534]
call fcn.0046e071
push 0
lea ecx, [esi + 0x438]
call fcn.0046e071
push 0
lea ecx, [esi + 0x4e0]
call fcn.0046e071
push 0
lea ecx, [esi + 0x48c]
call fcn.0046e071
mov byte [esp + 0x190], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x401a59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x190], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401a81
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x401b4b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401b4b
mov byte [esp + 0x190], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ac1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x190], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ae9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x401b00
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], 0
push 0
push esi
call fcn.00401f40
mov dword [esp + 0x190], 0xffffffff
mov eax, dword [esp + 0x20]
test eax, eax
je 0x401b22
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea ecx, [esi + 0xf0]
call fcn.0046e071
mov ecx, esi
call fcn.00403c40
mov ecx, dword [esi + 0x7c]
mov edx, dword [esi + 0x20]
push 0
push 0x7d0
push ecx
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
mov ecx, dword [esp + 0x188]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x170]
xor ecx, esp
call fcn.00483c76
mov esp, ebp
pop ebp
ret
push 0x34
push 0x4a56b4
push 0x4a5708
mov ecx, esi
call fcn.00468b72
cmp eax, 7
jne 0x401b00
push 0
mov ecx, ebx
call fcn.0046e071
push 0
lea ecx, [esi + 0x534]
call fcn.0046e071
push 0
lea ecx, [esi + 0x438]
call fcn.0046e071
push 0
lea ecx, [esi + 0x4e0]
call fcn.0046e071
push 0
lea ecx, [esi + 0x48c]
call fcn.0046e071
jmp 0x401b4b