Function at 0x408ba0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42e4bc
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x439004]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x234]
push str.GIX_SYSTEM
mov dword [ebp - 0x288], edi
call fcn.00403fb0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0x26
jb 0x408c3d
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x4c
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0x26]
push str.ControlSet001ControlMUIUILanguages
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [ebp - 0x288]
jmp 0x408c5e
push 0x26
push str.ControlSet001ControlMUIUILanguages
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x28c]
push 0x26
call fcn.00404100
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x294]
push ecx
push 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40920d
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], 0x104
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], 7
mov word [ebp - 0x268], ax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x408fcb
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408cf0
mov ecx, dword [ebp - 0x254]
sub eax, edx
sar eax, 1
cmp eax, ecx
ja 0x408d3b
lea esi, [eax + eax]
mov dword [ebp - 0x258], eax
cmp ecx, 8
lea eax, [ebp - 0x21c]
push esi
lea edi, [ebp - 0x268]
cmovae edi, dword [ebp - 0x268]
push eax
push edi
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
jmp 0x408d5b
lea ecx, [ebp - 0x21c]
mov byte [ebp - 0x29c], 0
push ecx
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x268]
push eax
call fcn.004042b0
mov eax, dword [ebp - 0x220]
cmp eax, 0xa
jb 0x408d98
cmp eax, 8
mov dword [ebp - 0x224], 0xa
push 0x14
lea esi, [ebp - 0x234]
cmovae esi, dword [ebp - 0x234]
push str.GIX_SYSTEM
push esi
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + 0x14], ax
jmp 0x408db7
push str.GIX_SYSTEM
mov byte [ebp - 0x2a0], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x2a0]
push 0xa
call fcn.004042b0
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0x27
jb 0x408e00
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x4e
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0x27]
push str.ControlSet001ControlMUIUILanguages_
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x408e21
push 0x27
push str.ControlSet001ControlMUIUILanguages_
mov byte [ebp - 0x2a4], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x2a4]
push 0x27
call fcn.00404100
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408e30
mov ebx, dword [ebp - 0x220]
sub ecx, edx
mov edx, dword [ebp - 0x224]
mov eax, ebx
sar ecx, 1
sub eax, edx
cmp ecx, eax
ja 0x408e8b
cmp ebx, 8
lea eax, [ecx + ecx]
push eax
lea esi, [ebp - 0x234]
cmovae esi, dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
push eax
lea edi, [edx + ecx]
mov dword [ebp - 0x224], edi
lea eax, [esi + edx*2]
push eax
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x408eac
push ecx
lea eax, [ebp - 0x21c]
mov byte [ebp - 0x2a8], 0
push eax
push dword [ebp - 0x2a8]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00404100
xor eax, eax
mov dword [ebp - 0x238], 7
push 8
mov word [ebp - 0x24c], ax
lea eax, [ebp - 0x24c]
push str.LCID
push eax
mov dword [ebp - 0x23c], 4
call fcn.00415ee0
add esp, 0xc
lea ecx, [ebp - 0x298]
xor eax, eax
cmp dword [ebp - 0x220], 8
mov word [ebp - 0x244], ax
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408f66
cmp dword [ebp - 0x238], 8
lea ecx, [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x284], 4
push ecx
push 0
lea eax, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x24c]
push 0
push eax
push dword [ebp - 0x298]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x298]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x24c]
call fcn.004019e0
mov edi, dword [ebp - 0x288]
lea eax, [ebp - 0x268]
push eax
lea ecx, [edi + 0x90]
call fcn.00409b90
mov ebx, dword [ebp - 0x28c]
lea eax, [ebp - 0x290]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x290], 0x104
push eax
inc ebx
push ebx
push dword [ebp - 0x294]
mov dword [ebp - 0x28c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x408ce4
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [edi + 0x94]
mov eax, 0x92492493
sub ecx, dword [edi + 0x90]
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x409202
mov eax, dword [ebp - 0x220]
cmp eax, 0xa
jb 0x409039
cmp eax, 8
mov dword [ebp - 0x224], 0xa
push 0x14
lea esi, [ebp - 0x234]
cmovae esi, dword [ebp - 0x234]
push str.GIX_SYSTEM
push esi
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + 0x14], ax
jmp 0x409058
push str.GIX_SYSTEM
mov byte [ebp - 0x284], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x284]
push 0xa
call fcn.004042b0
mov edx, dword [ebp - 0x220]
mov eax, edx
mov ecx, dword [ebp - 0x224]
sub eax, ecx
cmp eax, 0x23
jb 0x4090a7
cmp edx, 8
lea esi, [ebp - 0x234]
push 0x46
cmovae esi, dword [ebp - 0x234]
lea edi, [ecx + 0x23]
push str.ControlSet001ControlNlsLanguage
mov dword [ebp - 0x224], edi
lea eax, [esi + ecx*2]
push eax
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [ebp - 0x288]
jmp 0x4090c8
push 0x23
push str.ControlSet001ControlNlsLanguage
mov byte [ebp - 0x284], 0
lea ecx, [ebp - 0x234]
push dword [ebp - 0x284]
push 0x23
call fcn.00404100
xor eax, eax
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 7
mov word [ebp - 0x280], ax
push str.InstallLanguage
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 2
call fcn.00403fb0
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x24c]
push eax
lea edx, [ebp - 0x234]
call fcn.00413260
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
call fcn.004019e0
cmp dword [ebp - 0x26c], 8
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x280]
cmovae ecx, dword [ebp - 0x280]
push 0x435710
push ecx
call fcn.00409fe0
mov ecx, dword [edi + 0x94]
mov eax, 0x92492493
mov ebx, dword [edi + 0x90]
add esp, 0xc
sub ecx, ebx
xor esi, esi
imul ecx
add edx, ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
je 0x4091f7
mov ecx, dword [ebp - 0x2ac]
lea eax, [ebx + 0x18]
cmp dword [eax], ecx
je 0x409191
inc esi
add eax, 0x1c
cmp esi, edi
jb 0x409183
jmp 0x4091f7
mov ecx, dword [ebp - 0x288]
lea eax, [esi*8]
sub eax, esi
add ecx, 0x9c
lea eax, [ebx + eax*4]
cmp ecx, eax
je 0x4091f7
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0x4091b7
mov edx, dword [eax]
mov eax, dword [eax + 0x10]
mov esi, dword [ecx + 0x14]
cmp eax, esi
ja 0x4091e3
mov edi, ecx
cmp esi, 8
jb 0x4091ca
mov edi, dword [ecx]
lea esi, [eax + eax]
mov dword [ecx + 0x10], eax
push esi
push edx
push edi
call fcn.00415ee0
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
jmp 0x4091f7
push edx
mov byte [ebp - 0x284], 0
push dword [ebp - 0x284]
push eax
call fcn.004042b0
lea ecx, [ebp - 0x280]
call fcn.004019e0
lea ecx, [ebp - 0x268]
call fcn.004019e0
lea ecx, [ebp - 0x234]
call fcn.004019e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414df1
mov esp, ebp
pop ebp
ret 4