Function at 0x409550
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
push 0xffffffffffffffff
push 0
push 0
push 0
push 1
push 1
push 0x7d0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x74], 0
call fcn.0042fc31
lea eax, [esp + 0x1c]
push eax
call fcn.0042fd15
mov esi, dword [ebp + 0x14]
mov eax, dword [eax]
mov ebx, dword [ebp + 8]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0xf003f
mov dword [esp + 0x34], eax
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebx], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4098ad
push ecx
mov ecx, dword [esp + 0x24]
mov eax, esp
mov dword [esp + 0x20], esp
lea edx, [esp + 0x20]
mov dword [eax], ecx
push edx
lea ecx, [esp + 0x2c]
call fcn.00409c10
mov edi, dword [eax]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
cmp eax, 1
fild dword [esp + 0x1c]
fmul qword [0x441cf8]
fstp qword [esp + 0x34]
jne 0x4096e9
fld qword [esp + 0x34]
fsub qword [0x441cf0]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x44]
push 8
push eax
push 3
fstp qword [esp + 0x50]
push 0
push str.R6PQ_G2L7
push ecx
call esi
fld qword [esp + 0x34]
fsub qword [0x441ce8]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x44]
push 8
push edx
push 3
push 0
fstp qword [esp + 0x54]
push str.FD8G_Q4T5
push eax
call esi
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x44]
push 8
push eax
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x18]
push 3
push 0
push str.LUD7_KPRG
push ecx
mov dword [esp + 0x60], edx
call esi
mov eax, dword [ebp + 0x10]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], esp
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*8]
mov eax, esp
shl edx, 7
mov dword [esp + 0x20], edx
mov dword [eax], edi
call fcn.004106d0
fild dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x44]
push 8
push eax
fmul qword [0x441cf8]
push 3
push 0
push str.EU9J_TL3B
push ecx
fstp qword [esp + 0x5c]
call esi
mov edx, dword [esp + 0x10]
push edx
jmp 0x409875
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.FD8G_Q4T5
push eax
mov dword [esp + 0x2c], 8
call edi
test eax, eax
jne 0x409748
fld qword [esp + 0x3c]
fadd qword [0x441ce8]
fmul qword [0x441ce0]
call fcn.00422888
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
mov dword [ecx], eax
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x28]
call fcn.00409c30
mov edx, dword [eax]
mov dword [esi], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.LUD7_KPRG
push eax
call edi
test eax, eax
jne 0x409779
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.R6PQ_G2L7
push eax
call edi
test eax, eax
jne 0x4097a0
fld qword [esp + 0x3c]
jmp 0x4097a4
fld qword [esp + 0x44]
fsub qword [esp + 0x44]
fcom qword [0x441cd8]
fnstsw ax
test ah, 0x41
jne 0x4097c9
fcomp qword [0x441cd0]
fnstsw ax
test ah, 1
je 0x4097cb
mov eax, 1
jmp 0x4097cd
fstp st(0)
xor eax, eax
test eax, eax
mov dword [ebx], eax
jne 0x409870
fld qword [esp + 0x34]
fcomp qword [esp + 0x44]
fnstsw ax
test ah, 1
je 0x4097f4
fld qword [esp + 0x44]
fadd qword [0x441cc8]
fstp qword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esp + 0x34]
push 8
push edx
push 3
push 0
push str.LUD7_KPRG
push eax
call esi
fld qword [esp + 0x34]
fsub qword [0x441cf0]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x34]
push 8
push ecx
push 3
push 0
fstp qword [esp + 0x4c]
push str.R6PQ_G2L7
push edx
call esi
lea eax, [esp + 0x14]
lea ecx, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.EU9J_TL3B
push eax
call edi
test eax, eax
jne 0x40985d
fld qword [esp + 0x3c]
jmp 0x409861
fld qword [esp + 0x44]
fld qword [esp + 0x34]
fcomp st(1)
fnstsw ax
test ah, 1
fstp st(0)
je 0x4098a2
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [esp + 0x58], 0xffffffff
call fcn.004349c2
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [esp + 0x58], 0xffffffff
call fcn.004349c2
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret