Function at 0x41591d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420bcd
mov eax, dword fs:[0]
push eax
sub esp, 0x860
mov eax, dword [0x4231e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x758], ecx
and dword [ebp - 0x760], 0
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x86c], eax
and dword [ebp - 0x780], 0
mov dword [ebp - 0x85c], 0xffff0003
and dword [ebp - 0x84c], 0
mov dword [ebp - 0x858], 0x67
mov dword [ebp - 0x838], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x5c], 0
je 0x415f52
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
cmp dword [eax + 4], 7
jne 0x415f52
push 0x28
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x754]
add eax, 8
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x60]
push eax
call fcn.0040b696
push eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [ebp - 0x76c], 0
lea eax, [ebp - 0x76c]
push eax
push 0x4036f4
push 1
push 0
push 0x4036e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0
jl 0x415f10
and dword [ebp - 0x778], 0
mov esi, dword [ebp - 0x754]
add esi, 8
push 0x10
pop eax
imul eax, eax, 0
lea edi, [ebp + eax - 0x740]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x778]
push eax
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x740]
push eax
push 1
mov eax, dword [ebp - 0x76c]
mov eax, dword [eax]
push dword [ebp - 0x76c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x788], eax
mov ecx, dword [ebp - 0x788]
call dword [0x42486c]
call dword [ebp - 0x788]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0
jge 0x415ad6
lea eax, [ebp - 0x778]
push eax
push 0
push 0
lea eax, [ebp - 0x740]
push eax
push 1
mov eax, dword [ebp - 0x76c]
mov eax, dword [eax]
push dword [ebp - 0x76c]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x78c], eax
mov ecx, dword [ebp - 0x78c]
call dword [0x42486c]
call dword [ebp - 0x78c]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0
jl 0x415e13
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x860], eax
push 0
lea eax, [ebp - 0x750]
push eax
push 1
mov eax, dword [ebp - 0x778]
mov eax, dword [eax]
push dword [ebp - 0x778]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x790], eax
mov ecx, dword [ebp - 0x790]
call dword [0x42486c]
call dword [ebp - 0x790]
test eax, eax
jne 0x415e11
and dword [ebp - 0x868], 0
push 0x484
call fcn.0040b3d0
mov dword [ebp - 0x794], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x794], 0
je 0x415b62
mov ecx, dword [ebp - 0x794]
call fcn.00413e89
mov dword [ebp - 0x798], eax
jmp 0x415b69
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x7f0], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x754], eax
push 0x28
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x750]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x60]
push eax
call fcn.0040b696
push eax
mov ecx, dword [ebp - 0x754]
call fcn.00417a11
test eax, eax
jne 0x415bbe
mov eax, dword [ebp - 0x754]
mov dword [eax + 0x6c], 1
mov eax, dword [ebp - 0x754]
mov dword [eax + 4], 1
mov dword [ebp - 0x814], 0x100
push 2
pop eax
imul eax, eax, 0
mov dword [ebp - 0x79c], eax
cmp dword [ebp - 0x79c], 0x200
jae 0x415bef
jmp 0x415bf4
call fcn.0041f604
xor eax, eax
mov ecx, dword [ebp - 0x79c]
mov word [ebp + ecx - 0x530], ax
push 0x4053a8
lea ecx, [ebp - 0x820]
call sub.MFC42u.dll_CString::CString_2
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x808], eax
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x760]
or eax, 1
mov dword [ebp - 0x760], eax
lea eax, [ebp - 0x60]
push eax
call fcn.0040b696
push eax
push dword [ebp - 0x808]
lea eax, [ebp - 0x81c]
push eax
call sub.MFC42u.dll_operator_1
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x818], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x760]
or eax, 2
mov dword [ebp - 0x760], eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x530]
push eax
mov ecx, dword [ebp - 0x818]
call fcn.0040b3f4
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x415cc7
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x530]
test eax, eax
jne 0x415cc7
mov dword [ebp - 0x7a0], 1
jmp 0x415cce
and dword [ebp - 0x7a0], 0
mov al, byte [ebp - 0x7a0]
mov byte [ebp - 0x765], al
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x760]
and eax, 2
je 0x415cfe
and dword [ebp - 0x760], 0xfffffffd
lea ecx, [ebp - 0x81c]
call sub.MFC42u.dll_CString::CString
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x760]
and eax, 1
je 0x415d1f
and dword [ebp - 0x760], 0xfffffffe
lea ecx, [ebp - 0x820]
call sub.MFC42u.dll_CString::CString
movzx eax, byte [ebp - 0x765]
test eax, eax
je 0x415d43
lea eax, [ebp - 0x60]
push eax
push 0x4053b0
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x834], eax
lea eax, [ebp - 0x530]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x754]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x758]
call fcn.004179ae
mov ecx, eax
call fcn.00417f0b
mov dword [ebp - 0x7e8], eax
mov ecx, dword [ebp - 0x754]
add ecx, 0x80
call fcn.00411686
test eax, eax
jne 0x415e0c
push 0
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x7a4], eax
mov ecx, dword [ebp - 0x7a4]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7a4]
push dword [ebp - 0x7e8]
mov ecx, 0x4239b0
call sub.MFC42u.dll_CPtrList::AddTail
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7a8], eax
mov ecx, dword [ebp - 0x7a8]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7a8]
jmp 0x415aef
jmp 0x415e4b
push 0x4053d0
lea ecx, [ebp - 0x7ac]
call sub.MFC42u.dll_CString::CString_1
mov dword [ebp - 4], 3
push dword [ebp - 0x770]
lea eax, [ebp - 0x7ac]
push eax
call fcn.0041d91d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7ac]
call sub.MFC42u.dll_CString::CString
mov eax, dword [ebp - 0x76c]
mov eax, dword [eax]
push dword [ebp - 0x76c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x7b0], eax
mov ecx, dword [ebp - 0x7b0]
call dword [0x42486c]
call dword [ebp - 0x7b0]
push 0
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x7b4], eax
mov ecx, dword [ebp - 0x7b4]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7b4]
mov ecx, 0x4239b0
call fcn.00417f27
test eax, eax
jne 0x415ee1
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7e4], eax
mov ecx, dword [ebp - 0x7e4]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7e4]
mov ecx, dword [0x4239ac]
call fcn.004191ad
jmp 0x415f09
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7e0], eax
mov ecx, dword [ebp - 0x7e0]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7e0]
jmp 0x416412
push 0x405420
lea ecx, [ebp - 0x7dc]
call sub.MFC42u.dll_CString::CString_1
mov dword [ebp - 4], 4
push dword [ebp - 0x770]
lea eax, [ebp - 0x7dc]
push eax
call fcn.0041d91d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call sub.MFC42u.dll_CString::CString
mov dword [ebp - 0x780], 1
lea eax, [ebp - 0x774]
push eax
push 0x40293c
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41637d
and dword [ebp - 0x77c], 0
jmp 0x415f87
mov eax, dword [ebp - 0x77c]
inc eax
mov dword [ebp - 0x77c], eax
push 0x40
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0x77c]
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x416371
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x780], 1
jne 0x41600c
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xe0]
push eax
push 0x40545c
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
lea eax, [ebp - 0x730]
push eax
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x416000
jmp 0x415f7a
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x484
call fcn.0040b3d0
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 4], 5
cmp dword [ebp - 0x7d8], 0
je 0x41603f
mov ecx, dword [ebp - 0x7d8]
call fcn.00413e89
mov dword [ebp - 0x7cc], eax
jmp 0x416046
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x810], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x754], eax
lea eax, [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0x754]
call fcn.00417a11
mov eax, dword [ebp - 0x754]
mov dword [eax + 4], 1
cmp dword [ebp - 0x780], 1
jne 0x41609b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x75c], eax
jmp 0x41618f
mov eax, dword [ebp - 0x754]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x764], eax
cmp dword [ebp - 0x764], 7
ja 0x4160e5
cmp dword [ebp - 0x764], 7
je 0x416102
cmp dword [ebp - 0x764], 0
je 0x416102
cmp dword [ebp - 0x764], 2
je 0x416124
cmp dword [ebp - 0x764], 3
je 0x416152
cmp dword [ebp - 0x764], 6
je 0x416113
jmp 0x416180
cmp dword [ebp - 0x764], 9
je 0x416124
cmp dword [ebp - 0x764], 0xa
je 0x416152
cmp dword [ebp - 0x764], 0xc
je 0x416113
jmp 0x416180
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x75c], eax
jmp 0x41618f
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x75c], eax
jmp 0x41618f
mov eax, dword [ebp - 0x758]
cmp dword [eax + 0x78], 0
je 0x416141
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x75c], eax
jmp 0x416150
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x60]
mov dword [ebp - 0x75c], eax
jmp 0x41618f
mov eax, dword [ebp - 0x758]
cmp dword [eax + 0x78], 0
je 0x41616f
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x75c], eax
jmp 0x41617e
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x75c], eax
jmp 0x41618f
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x75c], eax
cmp dword [ebp - 0x75c], 0
je 0x416311
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x75c]
cmp ecx, dword [eax + 0x3c]
jne 0x416311
mov dword [ebp - 0x7f4], 0x100
push 2
pop eax
imul eax, eax, 0
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 0x200
jae 0x4161d2
jmp 0x4161d7
call fcn.0041f604
xor eax, eax
mov ecx, dword [ebp - 0x7d4]
mov word [ebp + ecx - 0x330], ax
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0xe0]
push eax
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x41623a
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x330]
test eax, eax
jne 0x41623a
lea eax, [ebp - 0xe0]
push eax
push 0x405498
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x834], eax
lea eax, [ebp - 0x330]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x754]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x758]
call fcn.004179ae
mov ecx, eax
call fcn.00417f0b
mov dword [ebp - 0x7f8], eax
mov ecx, dword [ebp - 0x754]
add ecx, 0x80
call fcn.00411686
test eax, eax
jne 0x41630f
push 0
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x7c8], eax
mov ecx, dword [ebp - 0x7c8]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7c8]
push dword [ebp - 0x7f8]
mov ecx, 0x4239b0
call sub.MFC42u.dll_CPtrList::AddTail
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7d0], eax
mov ecx, dword [ebp - 0x7d0]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7d0]
jmp 0x41636c
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x784], eax
cmp dword [ebp - 0x784], 0
je 0x416365
push 1
mov eax, dword [ebp - 0x784]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x7b8], eax
mov ecx, dword [ebp - 0x7b8]
call dword [0x42486c]
mov ecx, dword [ebp - 0x784]
call dword [ebp - 0x7b8]
mov dword [ebp - 0x800], eax
jmp 0x41636c
and dword [ebp - 0x800], 0
jmp 0x415f7a
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x7bc], eax
mov ecx, dword [ebp - 0x7bc]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7bc]
mov ecx, 0x4239b0
call fcn.00417f27
test eax, eax
jne 0x4163ea
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7c0], eax
mov ecx, dword [ebp - 0x7c0]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7c0]
mov ecx, dword [0x4239ac]
call fcn.004191ad
jmp 0x416412
mov eax, dword [0x4239a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x7c4], eax
mov ecx, dword [ebp - 0x7c4]
call dword [0x42486c]
mov ecx, dword [0x4239a4]
call dword [ebp - 0x7c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f3a0
leave
ret 4