Function at 0x412156
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x844
mov eax, 0x554927
call fcn.00527be2
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x84c], edx
xor edi, edi
xor edx, edx
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x848], edi
mov dword [ebp - 0x818], 7
mov dword [ebp - 0x81c], edi
mov word [ebp - 0x82c], dx
lea edx, [ebp - 0x834]
push edx
push 0x20019
push edi
mov dword [ebp - 4], edi
push eax
push ecx
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x840], 4
mov dword [ebp - 0x844], 2
mov dword [ebp - 0x830], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412bbd
mov ecx, 0x585d54
lea esi, [ebp - 0x82c]
mov dword [ebp - 0x830], 0x800
call fcn.00409cec
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push edi
push str.DisplayName
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41224a
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x41222a
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x810]
lea esi, [ebp - 0x82c]
call fcn.00409cec
mov edi, dword [ebp - 0x84c]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x84c]
push eax
call fcn.0041a3c6
mov eax, dword [eax]
cmp eax, dword [edi + 4]
je 0x412bb1
call fcn.00411ff4
push dword [ebp - 0x850]
lea eax, [ebx + 0x230]
push eax
call fcn.00409508
push 0xffffffffffffffff
xor esi, esi
push esi
lea ecx, [ebx + 0x70]
lea eax, [ebp - 0x82c]
call fcn.0040946e
mov edi, 0x800
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.AuthorizedCDFPrefix
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412306
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4122e8
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x810]
mov esi, ebx
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push 0x587518
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x412370
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412351
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x1c]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.Contact
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4123da
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4123bb
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x38]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.DisplayIcon
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412444
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412425
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x54]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.DisplayVersion
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4124b1
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41248f
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x8c]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.HelpLink
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41251e
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4124fc
sub eax, edx
sar eax, 1
lea esi, [ebx + 0xac]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.HelpTelephone
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41258b
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412569
sub eax, edx
sar eax, 1
lea esi, [ebx + 0xc8]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.InstallDate
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4125f8
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4125d6
sub eax, edx
sar eax, 1
lea esi, [ebx + 0xe4]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.InstallLocation
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412665
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412643
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x100]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.InstallSource
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4126d2
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4126b0
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x11c]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.LocalPackage
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41273f
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41271d
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x13c]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.Publisher
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4127ac
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41278a
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x178]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.Readme
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412819
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4127f7
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x194]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.Size
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412886
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412864
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x1b0]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.URLInfoAbout
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4128f3
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4128d1
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x1e8]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x838]
push eax
push esi
push str.URLUpdateInfo
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x412960
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41293e
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x204]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x844]
push eax
push esi
push str.ModifyPath
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4129cd
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4129ab
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x158]
lea ecx, [ebp - 0x810]
call fcn.00409cec
xor esi, esi
push edi
lea eax, [ebp - 0x810]
push esi
push eax
mov dword [ebp - 0x830], edi
call fcn.00527ca0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x844]
push eax
push esi
push str.UninstallString
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412a42
lea eax, [ebp - 0x810]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x412a1a
sub eax, edx
sar eax, 1
lea esi, [ebx + 0x1cc]
lea ecx, [ebp - 0x810]
call fcn.00409cec
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.EstimatedSize
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412a75
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0xa8], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.Language
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412aa8
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0x138], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.NoRepair
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412adb
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0x174], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.Version
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412b0e
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0x220], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.VersionMajor
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412b41
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0x224], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.VersionMinor
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412b74
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0x228], eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x840]
push eax
push esi
push str.WindowsInstaller
push dword [ebp - 0x834]
call edi
test eax, eax
jne 0x412ba7
mov eax, dword [ebp - 0x83c]
mov dword [ebx + 0x22c], eax
mov dword [ebp - 0x848], 1
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 1
xor edi, edi
lea esi, [ebp - 0x82c]
call fcn.00409659
mov eax, dword [ebp - 0x848]
call fcn.00527c65
ret 8