Function at 0x413830
Capabilities:
Acquire debug privileges
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43698b
mov eax, dword fs:[0]
push eax
sub esp, 0x2a0
mov eax, dword [0x401800]
xor eax, esp
mov dword [esp + 0x298], eax
push ebx
push esi
push edi
mov eax, dword [0x401800]
xor eax, esp
push eax
lea eax, [esp + 0x2b0]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ecx, 0x409dbc
mov dword [esp + 0x20], eax
call fcn.0040c0f0
xor ecx, ecx
call fcn.0040c0f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
test esi, esi
je 0x4138fa
cmp dword [esi], 1
ja 0x4138fa
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0041c41d
lea eax, [esp + 0x64]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push 0x409dc8
push eax
lea eax, [esp + 0x88]
push eax
push 0x40953c
call ebx
push eax
push 0x409dd0
push esi
call fcn.0040c200
add esp, 0x1c
push 0x409df8
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x413d4c
cmp eax, 0xb7
jne 0x41399d
xor ecx, ecx
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413997
cmp dword [esi], 1
ja 0x413997
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0041c41d
lea eax, [esp + 0x64]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push 0x409dc8
push eax
lea eax, [esp + 0x88]
push eax
push 0x40953c
call ebx
push eax
push 0x409e0c
push esi
call fcn.0040c200
add esp, 0x1c
push edi
jmp 0x413dc1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], 0x409e70
call fcn.00413630
push 0x103
lea eax, [esp + 0x99]
mov dword [esp + 0x18], 0
push 0
push eax
mov dword [esp + 0x28], 0
mov byte [esp + 0xa0], 0
call fcn.0041e790
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0xf013f
push 0
push 0x409d34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x413cc8
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
push 0x409e84
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
mov dword [esp + 0x10], eax
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413a9a
cmp dword [esi], 1
ja 0x413a9a
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0041c41d
lea eax, [esp + 0x64]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push dword [esp + 0x10]
push 0x409dc8
push eax
lea eax, [esp + 0x8c]
push eax
push 0x40953c
call ebx
push eax
push 0x409e90
push esi
call fcn.0040c200
add esp, 0x20
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x98]
push eax
push 0
push 0
push 0x409e84
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x413c44
mov ecx, 0x41
lea esi, [esp + 0x94]
lea edi, [esp + 0x19c]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x19c]
push eax
lea ecx, [esp + 0x60]
call fcn.0040b820
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x2bc], 0
call fcn.00413df0
test eax, eax
jne 0x413b82
xor ecx, ecx
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413b78
cmp dword [esi], 1
ja 0x413b78
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041c41d
lea eax, [esp + 0x40]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push 0x409dc8
push eax
lea eax, [esp + 0x88]
push eax
push 0x40953c
call ebx
push eax
push 0x409ec8
push esi
call fcn.0040c200
add esp, 0x1c
mov dword [0x43a144], 1
mov dword [esp + 0x2b8], 0xffffffff
cmp dword [esp + 0x70], 0x10
jb 0x413ba0
push dword [esp + 0x5c]
call fcn.0041ba66
add esp, 4
mov edi, dword [esp + 0x18]
cmp dword [ebp + 8], 2
jl 0x413bb3
mov ecx, dword [esp + 0x20]
call fcn.004136d0
call fcn.00411860
call fcn.004131b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413dc7
cmp dword [esi], 1
ja 0x413dc7
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041c41d
lea eax, [esp + 0x40]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push 0x409dc8
push eax
lea eax, [esp + 0x88]
push eax
push 0x40953c
call ebx
push eax
push 0x409f64
push esi
call fcn.0040c200
add esp, 0x1c
jmp 0x413dc7
xor ecx, ecx
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413ba4
cmp dword [esi], 1
ja 0x413ba4
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041c41d
lea eax, [esp + 0x40]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push dword [esp + 0x10]
push 0x409dc8
push eax
lea eax, [esp + 0x8c]
push eax
push 0x40953c
call ebx
push eax
push 0x409f04
push esi
call fcn.0040c200
add esp, 0x20
jmp 0x413ba4
xor ecx, ecx
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413ba4
cmp dword [esi], 1
ja 0x413ba4
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041c41d
lea eax, [esp + 0x40]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push dword [esp + 0x10]
push 0x409dc8
push eax
lea eax, [esp + 0x8c]
push eax
push 0x40953c
call ebx
push eax
push 0x409f34
push esi
call fcn.0040c200
add esp, 0x20
jmp 0x413ba4
xor ecx, ecx
call fcn.0040c0f0
mov esi, eax
test esi, esi
je 0x413dbf
cmp dword [esi], 3
ja 0x413dbf
lea eax, [esp + 0x24]
push eax
call fcn.0041c85f
add esp, 4
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0041c41d
lea eax, [esp + 0x40]
push eax
push 0x40954c
lea eax, [esp + 0x90]
push 0x14
push eax
call fcn.0041c842
movzx eax, word [esp + 0x44]
add esp, 0x18
push 0x409dc8
push eax
lea eax, [esp + 0x88]
push eax
push 0x409544
call ebx
push eax
push 0x409e40
push esi
call fcn.0040c200
add esp, 0x1c
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x2b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x298]
xor ecx, esp
call fcn.0041b2ad
mov esp, ebp
pop ebp
ret