Function at 0x418960
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4620c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x46b13a], 0
push ebx
push esi
je 0x418bf4
push str.VMware__Inc.
push str.SOFTWARE_s
lea eax, [ebp - 0x104]
push 0x100
push eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x224], 0x30
xor bl, bl
call fcn.0040fad0
push str.volatile
lea ecx, [ebp - 0x104]
push ecx
push str._s_s
lea edx, [ebp - 0x204]
push 0x100
push edx
call fcn.0040fad0
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00421970
add esp, 0x38
test eax, eax
jne 0x418a4e
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x224]
push edx
push 0x46c6b8
lea eax, [ebp - 0x228]
push eax
push 0
push str.UUIDHost
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x21c]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x418a4e
mov eax, dword [ebp - 0x224]
mov byte [0x46b13a], 0
mov byte [eax + 0x46c6b7], 0
jmp 0x418bf4
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x418a81
push str.GetSystemFirmwareTable
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418a7a
call fcn.004188d0
mov dword [ebp - 0x218], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x218]
test eax, eax
jne 0x418ae2
push eax
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
lea ecx, [ebp - 0x218]
push ecx
test eax, eax
push 0
setge bl
call fcn.00427c20
add esp, 0xc
test bl, bl
je 0x418ab4
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x218]
mov bl, 1
test eax, eax
jne 0x418ae2
push str.UUID:_Failed_to_obtain_host_UUID_n
call fcn.00412850
add esp, 4
call fcn.00418760
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405fa8
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebp - 0x214]
call fcn.00418640
mov edi, dword [sym.imp.MSVCR90.dll_free]
test al, al
je 0x418b22
lea edx, [ebp - 0x214]
push edx
call fcn.004186f0
mov esi, eax
add esp, 4
test esi, esi
je 0x418b22
push 0x30
push esi
push 0x46c6b8
call fcn.0040fb30
push esi
call edi
add esp, 0x10
jmp 0x418b38
mov eax, dword [ebp - 0x218]
push 0x30
push eax
push 0x46c6b8
call fcn.0040fb30
add esp, 0xc
mov ecx, dword [ebp - 0x218]
push ecx
call edi
add esp, 4
mov byte [0x46b13a], 0
pop edi
test bl, bl
je 0x418bf4
push 0
lea edx, [ebp - 0x220]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004219b0
add esp, 0x24
test eax, eax
jne 0x418bf4
mov edx, dword [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
push ecx
push eax
push 0x20006
push 1
push eax
push eax
push str.volatile
push edx
call fcn.004219b0
add esp, 0x24
test eax, eax
jne 0x418be7
mov eax, 0x46c6b8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418bb4
sub eax, edx
inc eax
push eax
mov eax, dword [ebp - 0x21c]
push 0x46c6b8
push 1
push 0
push str.UUIDHost
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x21c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x46c6b8
pop ebx
call fcn.00405fa8
mov esp, ebp
pop ebp
ret