Function at 0x404f0b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x47519c
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404fb2
cmp dword [ebp - 8], 2
jne 0x404f9b
push 2
push 0x4751a8
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404f96
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x404fb2
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751ac
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405048
cmp dword [ebp - 8], 2
jne 0x405031
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40502c
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x405048
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751b4
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4050de
cmp dword [ebp - 8], 2
jne 0x4050c7
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4050c2
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x4050de
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751bc
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405174
cmp dword [ebp - 8], 2
jne 0x40515d
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405158
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x405174
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751c4
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40520a
cmp dword [ebp - 8], 2
jne 0x4051f3
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4051ee
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x40520a
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751cc
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4052a0
cmp dword [ebp - 8], 2
jne 0x405289
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405284
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x4052a0
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751d4
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405336
cmp dword [ebp - 8], 2
jne 0x40531f
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40531a
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x405336
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751dc
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4053cc
cmp dword [ebp - 8], 2
jne 0x4053b5
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4053b0
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x4053cc
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
push 0x4751e4
lea eax, [ebp - 0x48]
push eax
call fcn.0041bfa0
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405463
cmp dword [ebp - 8], 2
jne 0x40544c
push 5
push 0x4751f0
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x405447
push 0x10003
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
jmp 0x405463
push 0x10006
call fcn.0040435c
add esp, 4
mov eax, 0xffffffff
jmp 0x40546a
xor eax, eax
jmp 0x40546a
pop edi
pop esi
pop ebx
leave
ret