Function at 0x404d40
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1840
call fcn.0040f280
sub esp, eax
mov eax, dword [esp + eax]
mov dword [ebp - 0x1820], 0
mov ebx, eax
lea eax, [edx + 0x7f18]
cmp ax, 0x63
jbe 0x405260
movzx eax, dx
cmp eax, 0x8013
je 0x405602
ja 0x404e40
cmp eax, 0x800a
je 0x4056f0
ja 0x404f30
cmp eax, 0x8005
je 0x405771
jbe 0x4051c0
cmp eax, 0x8007
je 0x405610
jb 0x405355
cmp eax, 0x8008
jne 0x404e7b
lea eax, [ebp - 0x1820]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov ebx, eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.RefreshTreeView
mov dword [esp + 8], ebx
mov eax, dword [ebp - 0x1820]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.RefreshListView
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
nop
mov ebx, 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x8039
je 0x404e30
ja 0x404e90
cmp eax, 0x8016
je 0x405a40
jbe 0x4050a0
cmp eax, 0x801a
je 0x405a10
cmp eax, 0x801b
je 0x405490
cmp eax, 0x8019
je 0x405400
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x814d
je 0x405a40
jbe 0x405191
cmp eax, 0x8151
je 0x405b20
cmp eax, 0x8156
je 0x405243
cmp eax, 0x814e
jne 0x404e7b
mov esi, 2
lea eax, [ebp - 0x1820]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov dword [esp + 0xc], esi
mov edi, eax
lea eax, [ebp - 0x100c]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1820]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call dbg.CreateValue
test eax, eax
jne 0x405340
mov dword [esp], edi
mov ebx, 1
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x404e35
cmp eax, 0x800f
ja 0x405020
cmp eax, 0x800e
jae 0x405813
cmp eax, 0x800b
je 0x4054a2
cmp eax, 0x800d
jne 0x404e7b
mov eax, dword [0x414e20]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemFullPath
mov esi, eax
test eax, eax
je 0x404e30
mov dword [esp], ebx
call dword [0x4156d0]
sub esp, 4
test eax, eax
je 0x40555c
call dword [0x415634]
test eax, eax
je 0x405015
cmp word [esi], 0
mov eax, esi
je 0x404fb9
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x404fb0
sub eax, esi
mov dword [esp], 0x42
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GlobalAlloc]
sub esp, 8
mov ebx, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GlobalLock]
xor edx, edx
sub esp, 4
movzx ecx, word [esi + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x404fe5
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GlobalUnlock]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], 0xd
call dword [0x415708]
sub esp, 8
call dword [0x415608]
jmp 0x40555c
cmp eax, 0x8011
je 0x405510
mov esi, 1
ja 0x404ec3
mov eax, dword [0x414e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.GetValueName
mov dword [esp + 4], 0
mov esi, eax
lea eax, [ebp - 0x1820]
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov dword [esp], ebx
mov edi, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1820]
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
call dbg.ModifyValue
mov ebx, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], edi
call ebx
mov dword [esp], esi
call ebx
mov ebx, 1
jmp 0x404e7d
cmp eax, 0x8014
je 0x405250
cmp eax, 0x8015
jne 0x404e7b
lea esi, [ebp - 0x180c]
mov eax, ebx
lea edi, [ebp - 0x100c]
mov dword [ebp - 0x1810], 0
mov edx, esi
call dbg.InitOpenFileName
mov eax, dword [0x414e40]
or dword [ebp - 0x17d8], 0x800000
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], edi
mov dword [esp + 4], 0x90
mov dword [esp], eax
call dword [0x4156c0]
mov dword [ebp - 0x17dc], edi
sub esp, 0x10
mov dword [esp], esi
call dword [0x415440]
sub esp, 4
test eax, eax
je 0x4055b1
mov eax, dword [ebp - 0x17f0]
mov dword [esp + 4], 0x41225e
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wfopen]
mov esi, eax
test eax, eax
je 0x405bc0
mov dword [esp], eax
call dbg.import_registry_file
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.ucrtbase.dll_fclose]
test eax, eax
jne 0x405bc0
test edi, edi
je 0x405bc0
mov eax, dword [ebp - 0x17f0]
mov dword [esp + 0xc], 0x7e2
mov dword [esp + 8], 0x67
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call dbg.messagebox
jmp 0x4055b7
cmp eax, 0x8066
je 0x405036
mov esi, 7
cmp eax, 0x814c
je 0x404ec3
xor ebx, ebx
cmp eax, 0x8041
sete bl
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x8002
je 0x4053e1
cmp eax, 0x8004
jne 0x404e7b
mov eax, dword [0x414e20]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemFullPath
mov esi, eax
test eax, eax
je 0x404e30
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], dbg.addtofavorites_dlgproc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x85
mov dword [esp], 0
call dword [0x41562c]
sub esp, 0x14
cmp eax, 1
je 0x405f0e
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x404e30
mov esi, 0xb
jmp 0x404ec3
mov esi, 4
jmp 0x404ec3
lea eax, [ebp - 0x181c]
mov dword [ebp - 0x1824], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x1824]
sub esp, 0x14
test eax, eax
jne 0x404e30
lea eax, [ebp - 0x1814]
movzx edx, dx
lea ebx, [ebp - 0x100c]
mov dword [ebp - 0x1818], 0x400
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x1810]
sub edx, 0x80e8
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1818]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x180c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x181c]
mov dword [ebp - 0x1814], 0x1000
mov dword [ebp - 0x1810], 0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumValueW]
sub esp, 0x20
test eax, eax
je 0x405570
mov eax, dword [ebp - 0x181c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x404e30
mov eax, dword [0x414e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.StartValueRename
jmp 0x404f13
mov esi, dword [0x414e44]
mov dword [esp], esi
call dword [0x4156a8]
mov edi, eax
mov eax, dword [0x414e4c]
sub esp, 4
mov dword [esp + 4], 2
mov dword [esp], eax
call dword [0x41567c]
sub esp, 8
test edi, edi
je 0x405b80
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8006
mov dword [esp], eax
call dword [0x4155fc]
xor eax, eax
sub esp, 0xc
mov dword [esp], esi
lea esi, [ebp - 0x100c]
mov dword [esp + 4], eax
call dword [0x415730]
sub esp, 8
mov dword [esp], ebx
mov dword [esp + 4], esi
call dword [0x415650]
mov eax, ebx
mov edx, esi
mov ebx, 1
sub esp, 8
call dbg.resize_frame_rect
jmp 0x404e7d
mov dword [esp], ebx
mov ebx, 1
call dword [0x415628]
sub esp, 4
jmp 0x404e7d
lea edx, [ebp - 0x1004]
xor eax, eax
mov ecx, 0xe
mov edi, edx
lea esi, [ebp - 0x100c]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [edi], cx
mov dword [ebp - 0x1008], ebx
mov ebx, 1
mov dword [ebp - 0x100c], 0x42
mov dword [ebp - 0xff8], 0x40100
mov dword [ebp - 0xff4], 0xffffffff
mov dword [ebp - 0xff0], 0xffff0001
mov word [ebp - 0xfec], bx
mov dword [esp], esi
call dword [0x415448]
sub esp, 4
test eax, eax
je 0x404e30
test byte [0x410014], 1
jne 0x405ee5
mov eax, dword [ebp - 0xffc]
mov dword [esp], eax
call dword [0x415454]
sub esp, 4
jmp 0x404e30
mov dword [esp], ebx
mov ebx, 1
call dbg.ShowAboutBox
jmp 0x404e7d
lea eax, [ebp - 0x1820]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov ebx, eax
test eax, eax
je 0x405e8c
cmp word [eax], 0
mov esi, dword [0x415664]
je 0x4054eb
call esi
mov edx, dword [0x414e20]
cmp eax, dword [edx + 4]
je 0x405fca
call esi
mov edx, dword [0x414e20]
cmp eax, dword [edx + 8]
jne 0x404e1e
mov dword [esp], eax
call dbg.StartValueRename
jmp 0x404e1e
lea eax, [ebp - 0x1820]
mov dword [esp + 4], 0
lea edi, [ebp - 0x100c]
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov dword [esp + 0xc], edi
mov esi, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1820]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dbg.CreateKey
test eax, eax
jne 0x405bf0
mov dword [esp], esi
mov ebx, 1
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x404e7d
mov eax, dword [0x414e20]
mov dword [esp + 4], ebx
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.FindPathInTree
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov eax, dword [0x414e20]
mov dword [esp + 4], 0x110b
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [0x4156fc]
sub esp, 0x10
jmp 0x405325
call dword [0x41543c]
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.RefreshTreeView
lea eax, [ebp - 0x1810]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov dword [esp + 0xc], 0
mov ebx, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1810]
jmp 0x404e0a
mov esi, 3
jmp 0x404ec3
lea eax, [ebp - 0x100c]
mov dword [esp + 4], eax
mov eax, dword [0x414e20]
mov eax, dword [eax]
mov dword [esp], eax
call dword [0x415650]
mov edx, dword [ebp - 0x1000]
mov eax, dword [0x414e20]
sub esp, 8
mov ebx, edx
mov esi, dword [eax + 0x10]
add esi, dword [ebp - 0x100c]
shr ebx, 0x1f
mov dword [ebp - 0x180c], esi
add ebx, edx
lea edx, [ebp - 0x180c]
sar ebx, 1
mov dword [esp + 4], edx
mov dword [ebp - 0x1808], ebx
mov eax, dword [eax]
mov dword [esp], eax
call dword [0x415604]
sub esp, 8
test eax, eax
je 0x404e30
mov eax, dword [ebp - 0x1808]
movzx esi, si
shl ebx, 0x10
or ebx, esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x180c]
mov dword [esp], eax
call dword [0x415710]
sub esp, 8
mov dword [esp + 4], 0x7f84
mov dword [esp], 0
call dword [0x4156b0]
sub esp, 8
mov dword [esp], eax
call dword [0x41570c]
mov eax, dword [0x414e20]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x201
mov eax, dword [eax]
mov dword [esp], eax
call dword [0x4156fc]
sub esp, 0x10
jmp 0x404e30
call dword [0x415664]
mov esi, eax
mov eax, dword [0x414e20]
mov edx, dword [eax + 4]
cmp esi, edx
je 0x405ea6
cmp esi, dword [eax + 8]
je 0x405c29
mov dword [esp + 4], esi
mov ebx, dword [0x4156a0]
mov dword [esp], edx
call ebx
sub esp, 8
test eax, eax
jne 0x405743
mov eax, dword [0x414e20]
mov dword [esp + 4], esi
mov eax, dword [eax + 8]
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x404e30
mov dword [esp + 0xc], 0
mov ebx, 1
mov dword [esp + 8], 0x2e
mov dword [esp + 4], 0x100
mov dword [esp], esi
call dword [0x4156fc]
sub esp, 0x10
jmp 0x404e7d
mov dword [esp + 8], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], dbg.removefavorite_dlgproc
mov dword [esp + 4], 0x86
mov dword [esp], 0
call dword [0x41562c]
sub esp, 0x14
mov ebx, eax
cmp eax, 1
jne 0x404e30
lea eax, [ebp - 0x100c]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x404e7d
mov eax, dword [ebp - 0x100c]
mov dword [esp + 4], 0x4148e0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x100c]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x404e7d
cmp dx, 0x800e
je 0x405e52
cmp word [0x4147e0], 0
je 0x404e30
mov eax, dword [0x414e20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 9
mov esi, dword [0x4156fc]
mov dword [esp + 4], 0x110a
mov eax, dword [eax + 4]
mov dword [esp], eax
call esi
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x404e30
mov eax, dword [0x414e20]
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x100c
mov eax, dword [eax + 8]
mov dword [esp], eax
call esi
sub esp, 0x10
mov dword [ebp - 0x180c], eax
mov dword [esp + 4], 0x7f02
mov dword [esp], 0
call dword [0x4156b0]
mov edx, dword [0x41570c]
sub esp, 8
mov dword [ebp - 0x1828], edx
mov dword [esp], eax
call edx
sub esp, 4
mov dword [ebp - 0x1824], eax
lea eax, [ebp - 0x180c]
mov dword [esp + 0x10], eax
mov eax, dword [0x410010]
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov eax, dword [0x414e20]
mov dword [esp + 8], 0x4147e0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.FindNext
mov ecx, dword [ebp - 0x1824]
mov edx, dword [ebp - 0x1828]
mov edi, eax
mov dword [esp], ecx
call edx
sub esp, 4
test edi, edi
je 0x406012
mov eax, dword [0x414e20]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 9
mov dword [esp + 4], 0x110b
mov eax, dword [eax + 4]
mov dword [esp], eax
call esi
mov eax, dword [0x414e20]
sub esp, 0x10
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [0x415698]
mov eax, dword [0x414e20]
sub esp, 0xc
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [0x415740]
sub esp, 4
cmp dword [ebp - 0x180c], 0xffffffff
je 0x406061
mov eax, dword [0x414e20]
lea ebx, [ebp - 0x100c]
mov dword [ebp - 0x1000], 0
mov dword [ebp - 0xffc], 3
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x102b
mov eax, dword [eax + 8]
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x180c]
mov dword [ebp - 0x1000], 3
mov dword [ebp - 0xffc], 3
sub esp, 0x10
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x102b
mov eax, dword [eax + 8]
mov dword [esp], eax
call esi
mov eax, dword [0x414e20]
sub esp, 0x10
mov eax, dword [eax + 8]
mov dword [esp], eax
call dword [0x415718]
sub esp, 4
jmp 0x404e30
mov dword [esp], ebx
mov ebx, 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xb
mov dword [esp + 4], 0x4122aa
call dword [0x415744]
sub esp, 0x10
jmp 0x404e7d
lea esi, [ebp - 0x180c]
mov eax, ebx
lea ebx, [ebp - 0x100c]
mov edx, esi
call dbg.InitOpenFileName
mov eax, dword [0x414e40]
mov dword [esp + 0xc], pe_nt_image_headers32
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x91
mov dword [esp], eax
call dword [0x4156c0]
mov dword [ebp - 0x17dc], ebx
mov dword [ebp - 0x17d0], 0x412264
sub esp, 0x10
mov dword [ebp - 0x17d8], 0x80066
mov dword [ebp - 0x17c8], sym._ExportRegistryFile_OFNHookProc_16
mov dword [ebp - 0x17c4], 0x83
mov dword [esp], esi
call dword [0x415444]
sub esp, 4
test eax, eax
je 0x405bb0
mov eax, dword [ebp - 0x17f4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x17cc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x17f0]
mov dword [esp], eax
call dbg.export_registry_key
test eax, eax
jne 0x404e30
test byte [0x410014], 1
je 0x404e30
mov dword [esp + 0xc], str.Registry_export_failed._n
mov dword [esp + 8], str.ExportRegistryFile
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.7
jmp 0x404e30
mov eax, dword [0x414e20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 9
mov ebx, dword [0x4156fc]
mov dword [esp + 4], 0x110a
mov eax, dword [eax + 4]
mov dword [esp], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [0x414e20]
mov dword [esp + 8], 3
mov dword [esp + 4], 0x1102
mov eax, dword [eax + 4]
mov dword [esp], eax
call ebx
mov ebx, 1
sub esp, 0x10
jmp 0x404e7d
mov dword [esp + 8], 8
mov dword [esp + 4], 0x8006
mov dword [esp], eax
call dword [0x4155fc]
mov eax, 5
sub esp, 0xc
jmp 0x4053a8
call dword [0x41543c]
jmp 0x404e30
mov eax, dword [ebp - 0x17f0]
mov dword [esp + 0xc], 0x7e3
mov dword [esp + 8], 0x67
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x10
mov dword [esp], ebx
call dbg.messagebox
jmp 0x404e30
mov eax, dword [0x414e20]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.InsertNode
test eax, eax
je 0x40555c
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.StartKeyRename
jmp 0x40555c
mov dword [esp + 0xc], 0
mov edi, dword [0x4156fc]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1032
mov dword [esp], esi
call edi
sub esp, 0x10
test eax, eax
je 0x404e30
cmp eax, 1
mov dword [esp + 8], 0x8048
setne al
mov dword [esp + 4], 0x34
movzx eax, al
mov dword [esp], ebx
lea eax, [eax + eax + 0x8049]
mov dword [esp + 0xc], eax
call dbg.messagebox
cmp eax, 6
jne 0x404e30
lea eax, [ebp - 0x1820]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.GetItemPath
mov dword [esp + 0xc], 1
mov dword [ebp - 0x1824], eax
mov eax, dword [0x414e20]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x100c
mov eax, dword [eax + 8]
mov dword [esp], eax
call edi
mov dword [ebp - 0x182c], eax
mov eax, dword [0x414e20]
sub esp, 0x10
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x100c
mov eax, dword [eax + 8]
mov dword [esp], eax
call edi
sub esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
je 0x406048
mov dword [ebp - 0x1828], ebx
jmp 0x405d50
mov eax, dword [0x414e20]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x100c
mov eax, dword [eax + 8]
mov dword [esp], eax
call edi
sub esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
je 0x406048
mov eax, dword [0x414e20]
mov dword [esp + 4], esi
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._GetItemText
mov ebx, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1824]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1820]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1828]
mov dword [esp], eax
call dbg.DeleteValue
test eax, eax
je 0x40603f
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [0x414e20]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x1008
mov eax, dword [eax + 8]
mov dword [esp], eax
call edi
sub esp, 0x10
test esi, esi
jne 0x405d1d
mov eax, dword [0x414e20]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov eax, dword [eax + 8]
mov dword [esp], eax
call dbg.AddEntryToList
mov edx, dword [ebp - 0x182c]
test edx, edx
jne 0x405d1d
lea eax, [ebp - 0x100c]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov eax, dword [0x414e20]
mov dword [ebp - 0xffc], 1
mov dword [ebp - 0x1000], 1
mov dword [esp + 4], 0x102b
mov eax, dword [eax + 8]
mov dword [esp], eax
call edi
sub esp, 0x10
jmp 0x405d1d
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], dbg.find_dlgproc
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x87
mov dword [esp], 0
call dword [0x41562c]
sub esp, 0x14
cmp eax, 1
jne 0x404e30
jmp 0x40581e
mov dword [esp], 0x10
mov ebx, 1
call dword [0x4156c4]
sub esp, 4
jmp 0x404e7d
lea eax, [ebp - 0x1820]
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
call dbg.GetItemPath
mov esi, eax
test eax, eax
je 0x405ed0
cmp word [eax], 0
jne 0x405fd7
mov dword [esp], 0x10
call dword [0x4156c4]
sub esp, 4
jmp 0x40555c
mov dword [esp + 0xc], str.printing_is_not_yet_implemented._n
mov dword [esp + 8], str.PrintRegistryHive
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.7
jmp 0x405477
lea eax, [ebp - 0x100c]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
jne 0x405235
cmp word [esi], 0
mov eax, esi
je 0x405f79
add eax, 2
cmp word [eax], 0
jne 0x405f70
sub eax, esi
mov dword [esp + 0x10], esi
sar eax, 1
mov dword [esp + 0xc], 1
lea eax, [eax + eax + 2]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x100c]
mov dword [esp + 4], 0x4148e0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x100c]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x405235
mov dword [esp], eax
call dbg.StartKeyRename
jmp 0x404e1e
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1820]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dbg.DeleteKey
test eax, eax
je 0x40555c
mov eax, dword [0x414e20]
mov dword [esp + 4], 0
mov eax, dword [eax + 4]
mov dword [esp], eax
call dbg.DeleteNode
jmp 0x40555c
mov dword [esp + 0x10], 0x4147e0
mov dword [esp + 0xc], 0x804a
mov dword [esp + 8], 0x67
mov dword [esp + 4], 0x40
mov dword [esp], ebx
call dbg.messagebox
jmp 0x404e30
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [ebp - 0x1824]
mov ebx, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x404e7d
mov eax, dword [0x414e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [0x415718]
push eax
jmp 0x404e30