Function at 0x415ec0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x19c
push ebx
push 0x14
mov dword [esp + 0x1c], ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x415ef1
mov ecx, eax
call fcn.004013d0
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x2c], ebx
jne 0x415efb
xor eax, eax
pop ebx
add esp, 0x19c
ret
mov eax, dword [ebx]
push ebp
push esi
push edi
mov ecx, ebx
mov dword [esp + 0x18], 2
call dword [eax]
test eax, eax
je 0x41647d
push 0x1040
xor edi, edi
call fcn.0041a4fe
mov ebp, eax
push 0x280
mov dword [esp + 0x34], ebp
call fcn.0041a4fe
add esp, 8
mov dword [esp + 0x1c], eax
lea esi, [eax + 0x50]
add ebp, 0x208
lea ecx, [esp + 0x10]
mov byte [esi], 0
mov edx, dword [ebx]
push ecx
lea ecx, [esp + 0x24]
push ebp
push ecx
push 0
lea ecx, [esp + 0x24]
push 0
mov eax, edi
push ecx
push esi
push eax
mov ecx, ebx
mov dword [esp + 0x34], 0x28
mov dword [esp + 0x30], 0x104
inc edi
call dword [edx + 4]
test eax, eax
jne 0x415f98
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x415f91
mov edx, dword [esp + 0x18]
add ebp, 0x104
inc edx
add esi, 0x28
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], 0x10
jl 0x415f40
mov eax, 2
lea ecx, [esp + 0x48]
mov dword [ecx], eax
inc eax
add ecx, 4
cmp eax, 0x10
jl 0x415fa1
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x48]
lea ebp, [esp + edx*4 + 0x40]
mov eax, ebp
sub eax, ecx
and al, 0xfc
cmp eax, 0x40
jg 0x41609c
lea edx, [esp + 0x48]
cmp edx, ebp
je 0x41634f
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x4c]
lea ebx, [esp + 0x4c]
lea eax, [esp + edx*4 + 0x40]
cmp ecx, eax
je 0x41634f
mov ecx, dword [esp + 0x48]
mov esi, dword [ebx]
mov ebp, dword [esp + 0x1c]
lea ecx, [ecx + ecx*4]
xor eax, eax
lea edx, [esi + esi*4]
lea edi, [ebp + ecx*8]
lea ebp, [ebp + edx*8]
mov cl, byte [eax + ebp]
mov dl, byte [edi + eax]
cmp cl, dl
jl 0x416063
jg 0x416017
inc eax
cmp eax, 0x28
jl 0x416005
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], esi
lea esi, [ebx - 4]
lea ecx, [esp + 0x10]
push esi
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov edi, ebx
call fcn.00416630
test eax, eax
je 0x416057
mov edx, dword [esi]
lea eax, [esp + 0x10]
mov dword [edi], edx
mov edi, esi
sub esi, 4
lea ecx, [esp + 0x14]
push esi
push eax
call fcn.00416630
test eax, eax
jne 0x41603b
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
mov ecx, dword [esp + 0x48]
jmp 0x416084
lea edx, [esp + 0x48]
mov eax, ebx
cmp edx, ebx
je 0x41607e
mov ecx, dword [eax - 4]
sub eax, 4
lea edx, [esp + 0x48]
cmp eax, edx
mov dword [eax + 4], ecx
jne 0x41606d
mov ecx, esi
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x18]
add ebx, 4
lea eax, [esp + eax*4 + 0x40]
cmp ebx, eax
jne 0x415fef
jmp 0x41634f
cmp eax, 0x40
lea ebx, [esp + 0x48]
jle 0x416214
mov eax, ebp
mov ecx, dword [ebx]
sub eax, ebx
mov dword [esp + 0x34], ecx
sar eax, 2
cdq
sub eax, edx
mov ecx, dword [esp + 0x1c]
sar eax, 1
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x30]
mov edx, dword [ebx + eax*4]
mov eax, dword [ebp - 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], eax
lea edx, [esp + 0x20]
lea eax, [esp + 0x34]
push edx
push eax
call fcn.00416630
test eax, eax
je 0x41611c
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x38]
call fcn.00416630
test eax, eax
jne 0x416154
lea eax, [esp + 0x28]
lea ecx, [esp + 0x34]
push eax
push ecx
lea ecx, [esp + 0x38]
call fcn.00416630
test eax, eax
je 0x416133
mov eax, dword [esp + 0x28]
jmp 0x416158
lea edx, [esp + 0x28]
lea eax, [esp + 0x34]
push edx
push eax
lea ecx, [esp + 0x38]
call fcn.00416630
test eax, eax
je 0x416139
mov eax, dword [esp + 0x34]
jmp 0x416158
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
push edx
lea ecx, [esp + 0x38]
call fcn.00416630
test eax, eax
mov eax, dword [esp + 0x28]
jne 0x416158
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov edi, ebp
mov esi, ebx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
push esi
call fcn.00416630
test eax, eax
je 0x416191
lea eax, [esp + 0x14]
add esi, 4
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.00416630
test eax, eax
jne 0x41617b
sub edi, 4
lea ecx, [esp + 0x14]
push edi
push ecx
lea ecx, [esp + 0x18]
call fcn.00416630
test eax, eax
je 0x4161bd
sub edi, 4
lea edx, [esp + 0x14]
push edi
push edx
lea ecx, [esp + 0x18]
call fcn.00416630
test eax, eax
jne 0x4161a7
cmp edi, esi
jbe 0x4161ce
mov ecx, dword [edi]
mov eax, dword [esi]
mov dword [esi], ecx
mov dword [edi], eax
add esi, 4
jmp 0x416168
mov edx, ebp
mov eax, esi
sub edx, esi
sub eax, ebx
and edx, 0xfffffffc
and al, 0xfc
cmp edx, eax
push 0
jg 0x4161f4
mov ecx, dword [esp + 0x20]
push ecx
push ebp
push esi
call fcn.00416760
add esp, 0x10
mov ebp, esi
jmp 0x416205
mov edx, dword [esp + 0x20]
push edx
push esi
push ebx
call fcn.00416760
add esp, 0x10
mov ebx, esi
mov eax, ebp
sub eax, ebx
and al, 0xfc
cmp eax, 0x40
jg 0x4160a9
mov ecx, dword [esp + 0x48]
lea ebx, [esp + 0x4c]
mov esi, dword [ebx]
mov ebp, dword [esp + 0x1c]
lea ecx, [ecx + ecx*4]
xor eax, eax
lea edx, [esi + esi*4]
lea edi, [ebp + ecx*8]
lea ebp, [ebp + edx*8]
mov cl, byte [eax + ebp]
mov dl, byte [edi + eax]
cmp cl, dl
jl 0x416290
jg 0x416244
inc eax
cmp eax, 0x28
jl 0x416232
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], esi
lea esi, [ebx - 4]
lea ecx, [esp + 0x10]
push esi
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov edi, ebx
call fcn.00416630
test eax, eax
je 0x416284
mov edx, dword [esi]
lea eax, [esp + 0x10]
mov dword [edi], edx
mov edi, esi
sub esi, 4
lea ecx, [esp + 0x14]
push esi
push eax
call fcn.00416630
test eax, eax
jne 0x416268
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
mov ecx, dword [esp + 0x48]
jmp 0x4162b1
lea edx, [esp + 0x48]
mov eax, ebx
cmp edx, ebx
je 0x4162ab
mov ecx, dword [eax - 4]
sub eax, 4
lea edx, [esp + 0x48]
cmp eax, edx
mov dword [eax + 4], ecx
jne 0x41629a
mov ecx, esi
mov dword [esp + 0x48], ecx
add ebx, 4
lea eax, [esp + 0x88]
cmp ebx, eax
jne 0x41621c
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x88]
lea ebp, [esp + 0x88]
lea eax, [esp + edx*4 + 0x40]
mov dword [esp + 0x14], ebp
cmp ecx, eax
je 0x41634f
jmp 0x4162e7
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebp
lea eax, [eax + eax*4]
lea ebx, [ecx + eax*8]
mov esi, dword [ebp - 4]
mov ecx, dword [esp + 0x1c]
sub ebp, 4
xor eax, eax
lea edx, [esi + esi*4]
lea edi, [ecx + edx*8]
mov cl, byte [eax + ebx]
mov dl, byte [eax + edi]
cmp cl, dl
jl 0x416322
jg 0x41632e
inc eax
cmp eax, 0x28
jge 0x41632e
jmp 0x41630e
mov edx, dword [esp + 0x10]
mov dword [esp + 0x10], ebp
mov dword [edx], esi
jmp 0x4162fc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [ecx], eax
mov ecx, dword [esp + 0x14]
add ecx, 4
lea eax, [esp + edx*4 + 0x40]
cmp ecx, eax
mov dword [esp + 0x14], ecx
jne 0x4162e3
cmp dword [esp + 0x18], 2
jle 0x4163c7
mov ecx, dword [esp + 0x18]
mov ebp, 0x208
mov edx, 0x50
lea eax, [esp + 0x48]
lea ebx, [ecx - 2]
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
add eax, 4
lea ecx, [ecx + ecx*4]
lea esi, [esi + ecx*8]
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 0x148]
lea edi, [edx + ecx + 0x129c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax - 4]
add edx, 0x28
mov esi, ecx
shl esi, 6
add esi, ecx
mov ecx, dword [esp + 0x2c]
lea esi, [ecx + esi*4]
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 0x148]
lea edi, [ecx + ebp + 0x25c]
mov ecx, 0x41
add ebp, 0x104
dec ebx
rep movsd dword es:[edi], dword [esi]
jne 0x41636b
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
cmp ebp, 2
jle 0x416462
mov ebx, 0x50
mov edi, 0x1c
add ebp, 0xfffffffe
mov eax, dword [esi + 0x148]
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 2
lea ecx, [ebx + eax + 0x129c]
push ecx
push str.Manage
mov ecx, esi
call fcn.00413630
test eax, eax
jne 0x41641f
mov edx, dword [esi + 0x148]
mov eax, dword [esp + 0x10]
mov dword [edi + edx], eax
jmp 0x416459
mov edx, dword [esi + 0x148]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
lea eax, [ebx + edx + 0x129c]
push eax
call fcn.00416920
test eax, eax
je 0x41644c
mov ecx, dword [esi + 0x148]
mov edx, dword [esp + 0x10]
mov dword [edi + ecx], edx
jmp 0x416459
mov eax, dword [esi + 0x148]
mov dword [edi + eax], 2
add edi, 4
add ebx, 0x28
dec ebp
jne 0x4163e5
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0041a61a
mov edx, dword [esp + 0x20]
push edx
call fcn.0041a61a
mov ebx, dword [esp + 0x40]
add esp, 8
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 0xc]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x28]
push str.NonManage
call fcn.00413240
test eax, eax
je 0x416618
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 0
cmp eax, 0x10
jge 0x41660d
mov ecx, eax
shl eax, 6
add eax, ecx
lea ebx, [ecx*4 + 0x14]
shl eax, 2
mov dword [esp + 0x14], eax
lea eax, [ecx + ecx*4]
shl eax, 3
mov dword [esp + 0x10], eax
jmp 0x4164db
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
lea edi, [esp + 0x45]
mov edx, dword [esi + 0x148]
mov byte [eax + edx + 0x129c], 0
mov eax, dword [str.DIC_]
mov cl, byte [0x42e9e0]
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], cl
mov ecx, 0x17
xor eax, eax
lea edx, [esp + 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x2c]
push edx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ecx
inc ecx
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0xa8]
push ecx
push 0
lea edx, [esp + 0x2c]
push 0
lea ecx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x50]
push ecx
push eax
push edx
mov dword [esp + 0x40], 0x64
mov dword [esp + 0x58], 0x106
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x41660d
lea eax, [esp + 0xa4]
push 0x2c
push eax
mov ecx, esi
call fcn.00415e90
mov ebp, eax
test ebp, ebp
je 0x416578
mov byte [ebp], 0
lea ecx, [esp + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x24]
lea ecx, [eax + 1]
lea esi, [esp + 0xa4]
mov eax, dword [edx + 0x148]
mov edx, dword [esp + 0x14]
lea edi, [edx + eax + 0x25c]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
test ebp, ebp
rep movsb byte es:[edi], byte [esi]
je 0x4165d1
movsx ecx, byte [ebp + 1]
sub ecx, 0x31
je 0x4165cc
dec ecx
jne 0x4165d1
mov eax, 2
jmp 0x4165d1
mov eax, 1
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
add ebx, 4
inc edi
mov edx, dword [ecx + 0x148]
mov ecx, dword [esp + 0x14]
add ecx, 0x104
mov dword [esp + 0x18], edi
mov dword [ebx + edx - 4], eax
mov edx, dword [esp + 0x10]
add edx, 0x28
cmp ebx, 0x54
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
jl 0x4164d7
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
lea eax, [ecx - 2]
pop ebx
add esp, 0x19c
ret