Function at 0x4037e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fe52
mov eax, dword fs:[0]
push eax
sub esp, 0xa78
mov eax, dword [0x42807c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov edi, ecx
mov dword [ebp - 0xa7c], esi
test byte [0x42ac50], 1
mov dword [ebp - 0xa80], edi
jne 0x403853
or dword [0x42ac50], 1
xor eax, eax
push 0x4207a0
mov dword [0x42ac48], 7
mov dword [0x42ac44], esi
mov word [0x42ac34], ax
call fcn.0040f8fd
add esp, 4
cmp dword [0x42ac44], esi
jne 0x403d44
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0xa70]
push ecx
push 0x20019
push esi
push str.SoftwarekingsoftTypeEasyTypeEasyEx
push 0x80000001
mov dword [ebp - 0xa70], esi
call edi
test eax, eax
jne 0x403940
mov ebx, dword [ebp - 0xa70]
cmp ebx, esi
je 0x403940
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push esi
push eax
mov dword [ebp - 0xa78], esi
mov word [ebp - 0x218], dx
call fcn.00412f10
add esp, 0xc
lea ecx, [ebp - 0xa74]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0xa78]
push eax
push esi
push str.DistSrc
push ebx
mov dword [ebp - 0xa74], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x40390b
push 1
mov eax, str.0_
mov ecx, 0x42ac34
call fcn.00401540
mov ecx, dword [ebp - 0xa70]
push ecx
jmp 0x4039db
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x403914
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
mov ecx, 0x42ac34
call fcn.00401540
mov ecx, dword [ebp - 0xa70]
push ecx
jmp 0x4039db
lea edx, [ebp - 0xa70]
push edx
push 0x20019
push esi
push str.SoftwarekingsoftTypeEasyTypeEasy2011
push 0x80000001
call edi
cmp eax, esi
jne 0x4039e1
mov edi, dword [ebp - 0xa70]
cmp edi, esi
je 0x4039e1
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0xa78], esi
mov word [ebp - 0x218], ax
call fcn.00412f10
add esp, 0xc
lea edx, [ebp - 0xa74]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xa78]
push ecx
push esi
push str.DistSrc
push edi
mov dword [ebp - 0xa74], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
push 0x42ac34
mov eax, str.0_
jne 0x4039cf
lea eax, [ebp - 0x218]
call fcn.00401440
mov edx, dword [ebp - 0xa70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0xa3c], eax
mov dword [ebp - 0xa40], esi
mov word [ebp - 0xa50], cx
mov dword [ebp - 4], esi
xor edx, edx
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa24], esi
mov word [ebp - 0xa34], dx
mov byte [ebp - 4], 1
mov ecx, dword [0x42ac44]
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa7c], 0x2e
cmp ecx, esi
jbe 0x403b6e
mov dword [ebp - 0xa78], ecx
cmp ecx, 1
jb 0x403b6e
cmp dword [0x42ac48], 8
mov ebx, dword [0x42ac34]
jae 0x403a60
mov ebx, 0x42ac34
jmp 0x403a60
mov eax, ebx
cmp ecx, esi
jbe 0x403b6e
lea ebx, [ebx]
cmp word [eax], 0x2e
je 0x403a81
add eax, 2
dec ecx
jne 0x403a70
jmp 0x403b6e
cmp eax, esi
je 0x403b6e
mov edi, 1
lea edx, [ebp - 0xa7c]
mov ecx, eax
jmp 0x403aa0
mov si, word [ecx]
cmp si, word [edx]
jne 0x403b3a
add ecx, 2
add edx, 2
dec edi
jne 0x403aa0
cmp dword [0x42ac48], 8
mov ecx, dword [0x42ac34]
jae 0x403ac9
mov ecx, 0x42ac34
sub eax, ecx
sar eax, 1
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x403b69
push 1
mov eax, str.0_
lea ecx, [ebp - 0xa50]
call fcn.00401540
mov eax, dword [ebp - 0xa74]
push eax
xor ecx, ecx
lea eax, [ebp - 0xa6c]
mov edx, 0x42ac34
call fcn.00405010
mov edi, eax
lea esi, [ebp - 0xa34]
mov byte [ebp - 4], 2
call fcn.00401320
mov byte [ebp - 4], 1
cmp dword [ebp - 0xa58], 8
jb 0x403c52
mov ecx, dword [ebp - 0xa6c]
push ecx
call fcn.0040ed52
add esp, 4
jmp 0x403c52
sbb edx, edx
and edx, 0xfffffffe
inc edx
je 0x403ab5
mov ecx, eax
sub ecx, ebx
sar ecx, 1
or edx, 0xffffffff
sub edx, ecx
mov ecx, dword [ebp - 0xa78]
add ecx, edx
mov dword [ebp - 0xa78], ecx
lea ebx, [eax + 2]
xor esi, esi
jmp 0x403a60
cmp ebx, 0xffffffff
jne 0x403b99
push esi
push 0x42ac34
or eax, 0xffffffff
lea edi, [ebp - 0xa50]
call fcn.00401390
push 1
mov eax, str.0_
lea ecx, [ebp - 0xa34]
call fcn.00401540
jmp 0x403c54
mov eax, dword [0x42ac44]
xor ecx, ecx
mov edx, 0x42ac34
cmp ebx, eax
jne 0x403bea
dec eax
push eax
lea eax, [ebp - 0xa6c]
call fcn.00405010
mov edi, eax
lea esi, [ebp - 0xa50]
mov byte [ebp - 4], 3
call fcn.00401320
lea esi, [ebp - 0xa6c]
mov byte [ebp - 4], 1
call fcn.00401270
push 1
mov eax, str.0_
lea ecx, [ebp - 0xa34]
call fcn.00401540
jmp 0x403c52
push ebx
lea eax, [ebp - 0xa6c]
call fcn.00405010
mov edi, eax
lea esi, [ebp - 0xa50]
mov byte [ebp - 4], 4
call fcn.00401320
lea esi, [ebp - 0xa6c]
mov byte [ebp - 4], 1
call fcn.00401270
mov eax, dword [ebp - 0xa74]
sub eax, ebx
push eax
lea ecx, [ebx + 1]
lea eax, [ebp - 0xa6c]
mov edx, 0x42ac34
call fcn.00405010
mov edi, eax
lea esi, [ebp - 0xa34]
mov byte [ebp - 4], 5
call fcn.00401320
lea esi, [ebp - 0xa6c]
mov byte [ebp - 4], 1
call fcn.00401270
xor esi, esi
mov eax, dword [ebp - 0xa50]
mov ebx, 8
cmp dword [ebp - 0xa3c], ebx
jae 0x403c6d
lea eax, [ebp - 0xa50]
push eax
call fcn.0040fd46
add esp, 4
mov edi, eax
mov eax, dword [ebp - 0xa34]
cmp dword [ebp - 0xa20], ebx
jae 0x403c8c
lea eax, [ebp - 0xa34]
push eax
call fcn.0040fd46
push eax
push edi
lea edx, [ebp - 0xa18]
push str._d._d
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [0x42ac34]
add esp, 0x14
mov dword [0x42ac44], esi
cmp dword [0x42ac48], ebx
jae 0x403cc1
mov eax, 0x42ac34
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xa18]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x403cd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0xa18]
mov ecx, 0x42ac34
call fcn.00402bd0
cmp dword [ebp - 0xa20], ebx
jb 0x403d07
mov edx, dword [ebp - 0xa34]
push edx
call fcn.0040ed52
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0xa24], esi
mov word [ebp - 0xa34], ax
cmp dword [ebp - 0xa3c], ebx
jb 0x403d3e
mov ecx, dword [ebp - 0xa50]
push ecx
call fcn.0040ed52
add esp, 4
mov edi, dword [ebp - 0xa80]
push esi
xor edx, edx
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], esi
push 0x42ac34
or eax, 0xffffffff
mov word [edi], dx
call fcn.00401390
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ed5d
mov esp, ebp
pop ebp
ret