Function at 0x4118e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6ac
mov eax, dword [0x4ea080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0xa
mov esi, str.SoftwareShouyoudao
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call fcn.00411760
lea eax, [ebp - 0x670]
push eax
push 0xf003f
xor edi, edi
push edi
lea ecx, [ebp - 0x2c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x670], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411ccb
push 0x1fc
lea eax, [ebp - 0x632]
xor edx, edx
push edi
push eax
mov word [ebp - 0x634], dx
call fcn.0048f070
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x698]
push ecx
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], eax
lea edx, [ebp - 0x684]
push edx
lea eax, [ebp - 0x680]
push eax
lea ecx, [ebp - 0x688]
push ecx
lea edx, [ebp - 0x690]
push edx
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x6a8]
push ecx
lea edx, [ebp - 0x674]
push edx
mov edx, dword [ebp - 0x670]
push edi
lea eax, [ebp - 0x6a4]
push eax
lea ecx, [ebp - 0x634]
push ecx
push edx
mov dword [ebp - 0x6a4], edi
mov dword [ebp - 0x674], edi
mov dword [ebp - 0x6a8], edi
mov dword [ebp - 0x69c], edi
mov dword [ebp - 0x690], edi
mov dword [ebp - 0x688], edi
mov dword [ebp - 0x680], edi
mov dword [ebp - 0x684], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0x1fc
lea ecx, [ebp - 0x22a]
xor eax, eax
push edi
push ecx
mov word [ebp - 0x22c], ax
call fcn.0048f070
push 0x206
lea eax, [ebp - 0x432]
xor edx, edx
push edi
push eax
mov word [ebp - 0x434], dx
call fcn.0048f070
mov eax, dword [ebp - 0x674]
add esp, 0x18
cmp eax, edi
je 0x411cbe
mov dword [ebp - 0x678], edi
jle 0x411c8b
mov edi, edi
push 0x1fe
lea ecx, [ebp - 0x22c]
push edi
push ecx
call fcn.0048f070
add esp, 0xc
lea edx, [ebp - 0x698]
push edx
mov edx, dword [ebp - 0x678]
push edi
push edi
push edi
lea eax, [ebp - 0x67c]
push eax
mov eax, dword [ebp - 0x670]
lea ecx, [ebp - 0x22c]
push ecx
push edx
push eax
mov dword [ebp - 0x67c], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x411cb5
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411aa0
sub eax, edx
sar eax, 1
je 0x411ac5
lea ecx, [ebp - 0x22c]
push 0xff
push ecx
call fcn.0048f3f4
add esp, 8
push 0x208
lea edx, [ebp - 0x434]
push edi
push edx
call fcn.0048f070
add esp, 0xc
xor eax, eax
mov word [ebp - 0x650], ax
mov esi, 7
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x6a0], 0x104
mov dword [ebp - 0x68c], 1
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x640], edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411b10
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x650]
call fcn.004110e0
push 1
push 0x4b1930
lea ecx, [ebp - 0x650]
call fcn.004111d0
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411b50
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0x650]
call fcn.004111d0
cmp dword [ebp - 0x63c], 8
mov eax, dword [ebp - 0x650]
jae 0x411b87
lea eax, [ebp - 0x650]
lea ecx, [ebp - 0x6a0]
push ecx
lea edx, [ebp - 0x434]
push edx
push str.Installation
lea ecx, [ebp - 0x68c]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00419e80
add esp, 0x18
xor edx, edx
lea eax, [ebp - 0x434]
mov word [ebp - 0x66c], dx
mov dword [ebp - 0x658], esi
mov dword [ebp - 0x65c], edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x411bd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x66c]
call fcn.004110e0
mov esi, dword [ebx]
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x66c]
push ecx
push edx
push esi
mov ecx, ebx
call fcn.004117c0
mov ecx, dword [ebx + 4]
mov edx, 0x9249248
sub edx, ecx
cmp edx, 1
jb 0x411cab
inc ecx
mov dword [ebx + 4], ecx
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov esi, 8
mov dword [ecx], eax
cmp dword [ebp - 0x658], esi
jb 0x411c42
mov edx, dword [ebp - 0x66c]
push edx
call fcn.0048e224
add esp, 4
xor eax, eax
mov dword [ebp - 0x658], 7
mov dword [ebp - 0x65c], edi
mov word [ebp - 0x66c], ax
cmp dword [ebp - 0x63c], esi
jb 0x411c72
mov ecx, dword [ebp - 0x650]
push ecx
call fcn.0048e224
add esp, 4
mov eax, dword [ebp - 0x678]
inc eax
mov dword [ebp - 0x678], eax
cmp eax, dword [ebp - 0x674]
jl 0x411a40
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048ef91
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
call fcn.00425a9a
mov edx, dword [ebp - 0x670]
push edx
jmp 0x411cc5
mov ecx, dword [ebp - 0x670]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0048ef91
mov esp, ebp
pop ebp
ret