Function at 0x415f30
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8f
push 0
push 0
dec ecx
jne 0x415f38
push ebx
push esi
push edi
mov ebx, eax
lea edi, [ebp - 0x3ed]
xor eax, eax
push ebp
push 0x416452
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004034e4
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x3f4]
mov eax, 0x41646c
call fcn.00406984
mov eax, dword [ebp - 0x3f4]
call fcn.00403990
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp 0x41610a
lea eax, [ebp - 0x3fc]
mov edx, dword [ebx]
call fcn.00403d2c
push dword [ebp - 0x3fc]
push 0
lea eax, [ebp - 0x400]
push eax
lea edx, [ebp - 0x408]
mov eax, 0x4164bc
call fcn.00406984
mov eax, dword [ebp - 0x408]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x404]
call fcn.00403c98
mov eax, dword [ebp - 0x404]
push eax
lea edx, [ebp - 0x410]
mov eax, 0x4164d8
call fcn.00406984
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x414]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x414]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x410]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x40c]
call fcn.00403c98
mov edx, dword [ebp - 0x40c]
mov eax, 0x80000002
pop ecx
call fcn.00407500
push dword [ebp - 0x400]
push 0x416528
push 0
lea eax, [ebp - 0x418]
push eax
lea edx, [ebp - 0x420]
mov eax, 0x416534
call fcn.00406984
mov eax, dword [ebp - 0x420]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x41c]
call fcn.00403c98
mov eax, dword [ebp - 0x41c]
push eax
lea edx, [ebp - 0x428]
mov eax, 0x4164d8
call fcn.00406984
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x42c]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x428]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x424]
call fcn.00403c98
mov edx, dword [ebp - 0x424]
mov eax, 0x80000002
pop ecx
call fcn.00407500
push dword [ebp - 0x418]
push 0x416550
lea eax, [ebp - 0x3f8]
mov edx, 5
call fcn.00403e1c
mov edx, dword [ebp - 0x3f8]
mov eax, ebx
call fcn.0040377c
inc esi
push 0x3e9
push edi
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x415f97
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x430]
mov eax, 0x41646c
call fcn.00406984
mov eax, dword [ebp - 0x430]
call fcn.00403990
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp 0x4162cd
lea eax, [ebp - 0x438]
mov edx, dword [ebx]
call fcn.00403d2c
push dword [ebp - 0x438]
push 0
lea eax, [ebp - 0x43c]
push eax
lea edx, [ebp - 0x444]
mov eax, 0x4164bc
call fcn.00406984
mov eax, dword [ebp - 0x444]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x440]
call fcn.00403c98
mov eax, dword [ebp - 0x440]
push eax
lea edx, [ebp - 0x44c]
mov eax, 0x4164d8
call fcn.00406984
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x450]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x450]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x44c]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x448]
call fcn.00403c98
mov edx, dword [ebp - 0x448]
mov eax, 0x80000001
pop ecx
call fcn.00407500
push dword [ebp - 0x43c]
push 0x416528
push 0
lea eax, [ebp - 0x454]
push eax
lea edx, [ebp - 0x45c]
mov eax, 0x416534
call fcn.00406984
mov eax, dword [ebp - 0x45c]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x458]
call fcn.00403c98
mov eax, dword [ebp - 0x458]
push eax
lea edx, [ebp - 0x464]
mov eax, 0x4164d8
call fcn.00406984
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x468]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x468]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x464]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x460]
call fcn.00403c98
mov edx, dword [ebp - 0x460]
mov eax, 0x80000001
pop ecx
call fcn.00407500
push dword [ebp - 0x454]
push 0x416550
lea eax, [ebp - 0x434]
mov edx, 5
call fcn.00403e1c
mov edx, dword [ebp - 0x434]
mov eax, ebx
call fcn.0040377c
inc esi
push 0x3e9
push edi
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x41615a
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x470]
mov edx, dword [ebx]
call fcn.00403d2c
mov eax, dword [ebp - 0x470]
mov ecx, 0x41655c
mov edx, 0x416568
call fcn.004070bc
mov edx, dword [ebp - 0x46c]
mov eax, ebx
call fcn.0040377c
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x478]
mov edx, dword [ebx]
call fcn.00403d2c
mov eax, dword [ebp - 0x478]
mov ecx, 0x41655c
mov edx, 0x416578
call fcn.004070bc
mov edx, dword [ebp - 0x474]
mov eax, ebx
call fcn.0040377c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41645c
lea eax, [ebp - 0x478]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0x468]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x460]
call fcn.00403b80
lea eax, [ebp - 0x45c]
call fcn.004034e4
lea eax, [ebp - 0x458]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x450]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x448]
call fcn.00403b80
lea eax, [ebp - 0x444]
call fcn.004034e4
lea eax, [ebp - 0x440]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.00403508
lea eax, [ebp - 0x424]
call fcn.00403b80
lea eax, [ebp - 0x420]
call fcn.004034e4
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x414]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x40c]
call fcn.00403b80
lea eax, [ebp - 0x408]
call fcn.004034e4
lea eax, [ebp - 0x404]
mov edx, 4
call fcn.00403b98
lea eax, [ebp - 0x3f4]
call fcn.004034e4
ret