Function at 0x403180
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x20
push ebp
push esi
xor ebp, ebp
push ebp
lea eax, [esp + 0x10]
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SystemCurrentControlSetControlServiceGroupOrder
push 0x80000002
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40341f
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0xc]
push ecx
push ebp
lea edx, [esp + 0x30]
push edx
push ebp
push str.List
push eax
mov dword [esp + 0x24], ebp
call edi
test eax, eax
jne 0x40341e
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.MSVCR90.dll_malloc]
lea edx, [ecx + ecx]
push edx
call esi
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
je 0x40341e
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
push ebp
push str.List
push eax
call edi
test eax, eax
jne 0x40341e
mov eax, dword [esp + 0x30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x403237
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
lea eax, [ecx + eax + 1]
lea edx, [eax + eax]
push ebx
push edx
mov dword [esp + 0x14], eax
call esi
mov ecx, dword [esp + 0x1c]
add esp, 4
xor ebx, ebx
mov dword [esp + 0x24], eax
mov edi, ecx
mov esi, eax
cmp word [ecx], bp
je 0x4032cc
nop
mov eax, dword [esp + 0x34]
push edi
push eax
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x40329a
lea ebx, [eax + 1]
cmp word [edi], bp
je 0x4032bc
jmp 0x403290
add edi, 2
cmp word [edi], bp
jne 0x403290
jmp 0x4032bc
movzx eax, word [edi]
cmp ax, bp
je 0x4032b3
add edi, 2
mov word [esi], ax
movzx eax, word [edi]
add esi, 2
cmp ax, bp
jne 0x4032a2
mov cx, word [edi]
mov word [esi], cx
add esi, 2
add edi, 2
cmp word [edi], bp
jne 0x403270
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov dx, word [edi]
mov word [esi], dx
add esi, 2
cmp dword [esp + 0x3c], ebp
je 0x4032e8
cmp ebx, ebp
jne 0x4033f7
jmp 0x403419
cmp ebx, ebp
jne 0x403419
mov esi, eax
mov edi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], ebp
cmp word [ecx], bp
je 0x4033c0
mov eax, dword [esp + 0x38]
push edi
push eax
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x403383
movzx eax, word [edi]
mov dword [esp + 0x28], 1
cmp ax, bp
je 0x403341
jmp 0x403330
add edi, 2
mov word [esi], ax
movzx eax, word [edi]
add esi, 2
cmp ax, bp
jne 0x403330
mov cx, word [edi]
mov ebx, dword [esp + 0x34]
mov word [esi], cx
lea edx, [esp + 0x20]
push ebx
add esi, 2
push edx
mov dword [esp + 0x28], esi
add edi, 2
call fcn.00401110
mov eax, ebx
add esp, 8
lea edx, [eax + 2]
jmp 0x403370
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x403370
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
movzx eax, word [edi]
cmp ax, bp
je 0x4033a1
jmp 0x403390
add edi, 2
mov word [esi], ax
movzx eax, word [edi]
add esi, 2
cmp ax, bp
jne 0x403390
mov ax, word [edi]
mov word [esi], ax
add esi, 2
add edi, 2
mov dword [esp + 0x20], esi
cmp word [edi], bp
jne 0x403305
cmp dword [esp + 0x28], ebp
jne 0x4033ea
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x20]
push ebx
push ecx
call fcn.00401110
mov eax, ebx
add esp, 8
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4033d7
sub eax, edx
sar eax, 1
lea esi, [esi + eax*2 + 2]
mov dx, word [edi]
mov eax, dword [esp + 0x24]
mov word [esi], dx
add esi, 2
mov ecx, dword [esp + 0x14]
sub esi, eax
sar esi, 1
add esi, esi
push esi
push eax
mov eax, dword [esp + 0x34]
push eax
push ebp
push str.List
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40341d
mov dword [esp + 0x1c], ebp
pop ebx
pop edi
mov eax, dword [esp + 0xc]
cmp eax, ebp
je 0x40342e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.MSVCR90.dll_free]
cmp eax, ebp
je 0x403442
push eax
call esi
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x403450
push eax
call esi
add esp, 4
mov eax, dword [esp + 0x14]
pop esi
pop ebp
add esp, 0x20
ret