Function at 0xc23410
Capabilities:
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc4947d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1bec
call fcn.00c347f0
mov eax, dword [0xc57104]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1bdc], ecx
mov dword [ebp - 0x538], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x1b20], 0
lea eax, [ebp - 0x1b20]
push eax
push 0x2001f
push 0
push str.SoftwareNeoWizPMangInstall
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1b24], eax
cmp dword [ebp - 0x1b24], 0
jne 0xc234d2
mov dword [ebp - 0x1b28], 0
cmp dword [ebp - 0x538], 0
je 0xc234ba
mov ecx, dword [ebp - 0x538]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b28], eax
mov dword [ebp - 0x538], 0
mov edx, dword [ebp - 0x1b28]
mov dword [ebp - 0x1b24], edx
mov eax, dword [ebp - 0x1b20]
mov dword [ebp - 0x538], eax
lea ecx, [ebp - 0x534]
push ecx
push str.root
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x538]
call fcn.00c1ff80
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x53c], 0
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0
mov byte [ebp - 4], 1
mov dword [ebp - 0x120], 0x400
mov dword [ebp - 0x1b34], 0
lea edx, [ebp - 0x1b34]
push edx
push 0xf003f
push 0
push str.SoftwareNeowizPmangInstall
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x1b38], eax
cmp dword [ebp - 0x1b38], 0
jne 0xc23583
lea ecx, [ebp - 0x52c]
call fcn.00c10af0
mov dword [ebp - 0x1b38], eax
mov eax, dword [ebp - 0x1b34]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x1b38], 0
jne 0xc2361f
push 0x400
push 0
lea ecx, [ebp - 0x524]
push ecx
call fcn.00c33270
add esp, 0xc
mov dword [ebp - 0x1b3c], 0
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x1b3c]
push ecx
push 0
push str.INSTALL_STATUS
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1b40], eax
cmp dword [ebp - 0x1b40], 0
jne 0xc2361f
push str.TRUE
lea eax, [ebp - 0x524]
push eax
call fcn.00c33e60
add esp, 8
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
jne 0xc2361f
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x530], 1
mov ecx, dword [ebp - 0x1bdc]
cmp dword [ecx + 0x1094], 1
jne 0xc236a7
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x1b44], 0
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x1b44]
push ecx
push 0
push str.INSTALL_STATUS
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1b48], eax
cmp dword [ebp - 0x1b48], 0
jne 0xc236a7
push str.TRUE
lea eax, [ebp - 0x524]
push eax
call fcn.00c33e60
add esp, 8
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
je 0xc236a7
mov dword [ebp - 0x530], 0
cmp dword [0xc582d0], 0
je 0xc236bf
mov ecx, dword [ebp - 0x1bdc]
cmp dword [ecx + 0x120], 0
jne 0xc236c9
mov dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0
je 0xc23e3b
mov ecx, 0xc581b0
call fcn.00c22700
test eax, eax
jne 0xc23ab1
mov edx, dword [ebp - 0x1bdc]
mov eax, dword [edx + 0x128]
mov dword [ebp - 0x1b4c], eax
cmp dword [ebp - 0x1b4c], 0
jne 0xc23ab1
cmp dword [0xc59240], 0
jne 0xc23ab1
mov ecx, dword [ebp - 0x1bdc]
call fcn.00c22780
test eax, eax
je 0xc23ab1
lea ecx, [ebp - 0x6cc]
call fcn.00c14660
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x1bdc]
add ecx, 0x1fc
mov dword [ebp - 0x1b50], ecx
mov edx, dword [ebp - 0x1b50]
cmp dword [edx + 0x18], 0x10
jb 0xc23765
mov eax, dword [ebp - 0x1b50]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1be0], ecx
jmp 0xc23774
mov edx, dword [ebp - 0x1b50]
add edx, 4
mov dword [ebp - 0x1be0], edx
mov eax, dword [ebp - 0x530]
push eax
mov ecx, dword [ebp - 0x1be0]
push ecx
lea ecx, [ebp - 0x6cc]
call fcn.00c0e280
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x1b58], eax
lea edx, [ebp - 0x6cc]
push edx
lea eax, [ebp - 0x6c4]
push eax
push 0xc58144
call fcn.00c202e0
mov ecx, dword [0xc5b02c]
mov dword [ebp - 0x1b54], ecx
push 0
push 0xc20430
mov edx, dword [ebp - 0x1b58]
push edx
push 0xc1
mov eax, dword [ebp - 0x1b54]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0xc23a22
lea ecx, [ebp - 0xd04]
call fcn.00c180e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1bdc]
cmp dword [ecx + 0xd0], 0
je 0xc2388d
mov edx, dword [ebp - 0x1bdc]
add edx, 0xf18
mov dword [ebp - 0x1b5c], edx
mov eax, dword [ebp - 0x1b5c]
cmp dword [eax + 0x18], 0x10
jb 0xc23837
mov ecx, dword [ebp - 0x1b5c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1be4], edx
jmp 0xc23846
mov eax, dword [ebp - 0x1b5c]
add eax, 4
mov dword [ebp - 0x1be4], eax
push 0
mov ecx, dword [ebp - 0x1bdc]
mov edx, dword [ecx + 0x1094]
push edx
mov eax, dword [ebp - 0x1bdc]
mov ecx, dword [eax + 0xf10]
push ecx
mov edx, dword [ebp - 0x1bdc]
add edx, 0x710
push edx
mov eax, dword [ebp - 0x1bdc]
add eax, 0x1250
push eax
mov ecx, dword [ebp - 0x1be4]
push ecx
lea ecx, [ebp - 0xd04]
call fcn.00c18c10
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x1b64], eax
lea edx, [ebp - 0xd04]
push edx
lea eax, [ebp - 0xcfc]
push eax
push 0xc58144
call fcn.00c202e0
mov ecx, dword [0xc5b02c]
mov dword [ebp - 0x1b60], ecx
push 0
push 0xc20430
mov edx, dword [ebp - 0x1b64]
push edx
push 0x8b
mov eax, dword [ebp - 0x1b60]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0xc23984
mov dword [ebp - 0x1b00], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd04]
call fcn.00c18970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6cc]
call fcn.00c14c70
mov byte [ebp - 4], 0
mov dword [ebp - 0x1b68], 0
cmp dword [ebp - 0x52c], 0
je 0xc23942
mov ecx, dword [ebp - 0x52c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b68], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1b6c], 0
cmp dword [ebp - 0x538], 0
je 0xc23979
mov edx, dword [ebp - 0x538]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b6c], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b00]
jmp 0xc240bf
mov dword [ebp - 0x1b04], 0xfffffffd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd04]
call fcn.00c18970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6cc]
call fcn.00c14c70
mov byte [ebp - 4], 0
mov dword [ebp - 0x1b70], 0
cmp dword [ebp - 0x52c], 0
je 0xc239e0
mov eax, dword [ebp - 0x52c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b70], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1b74], 0
cmp dword [ebp - 0x538], 0
je 0xc23a17
mov ecx, dword [ebp - 0x538]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b74], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b04]
jmp 0xc240bf
mov dword [ebp - 0x1b08], 0xfffffffd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6cc]
call fcn.00c14c70
mov byte [ebp - 4], 0
mov dword [ebp - 0x1b78], 0
cmp dword [ebp - 0x52c], 0
je 0xc23a6f
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b78], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1b7c], 0
cmp dword [ebp - 0x538], 0
je 0xc23aa6
mov eax, dword [ebp - 0x538]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b7c], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b08]
jmp 0xc240bf
lea ecx, [ebp - 0xe8c]
call fcn.00c0db20
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x1bdc]
add ecx, 0x1fc
mov dword [ebp - 0x1b80], ecx
mov edx, dword [ebp - 0x1b80]
cmp dword [edx + 0x18], 0x10
jb 0xc23aef
mov eax, dword [ebp - 0x1b80]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1be8], ecx
jmp 0xc23afe
mov edx, dword [ebp - 0x1b80]
add edx, 4
mov dword [ebp - 0x1be8], edx
mov eax, dword [ebp - 0x530]
push eax
mov ecx, dword [ebp - 0x1be8]
push ecx
lea ecx, [ebp - 0xe8c]
call fcn.00c0e280
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x1b88], eax
lea edx, [ebp - 0xe8c]
push edx
lea eax, [ebp - 0xe84]
push eax
push 0xc58144
call fcn.00c202e0
mov ecx, dword [0xc5b02c]
mov dword [ebp - 0x1b84], ecx
push 0
push 0xc20430
mov edx, dword [ebp - 0x1b88]
push edx
push 0xb0
mov eax, dword [ebp - 0x1b84]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0xc23dac
lea ecx, [ebp - 0x14c4]
call fcn.00c180e0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1bdc]
cmp dword [ecx + 0xd0], 0
je 0xc23c17
mov edx, dword [ebp - 0x1bdc]
add edx, 0xf18
mov dword [ebp - 0x1b8c], edx
mov eax, dword [ebp - 0x1b8c]
cmp dword [eax + 0x18], 0x10
jb 0xc23bc1
mov ecx, dword [ebp - 0x1b8c]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x1bec], edx
jmp 0xc23bd0
mov eax, dword [ebp - 0x1b8c]
add eax, 4
mov dword [ebp - 0x1bec], eax
push 0
mov ecx, dword [ebp - 0x1bdc]
mov edx, dword [ecx + 0x1094]
push edx
mov eax, dword [ebp - 0x1bdc]
mov ecx, dword [eax + 0xf10]
push ecx
mov edx, dword [ebp - 0x1bdc]
add edx, 0x710
push edx
mov eax, dword [ebp - 0x1bdc]
add eax, 0x1250
push eax
mov ecx, dword [ebp - 0x1bec]
push ecx
lea ecx, [ebp - 0x14c4]
call fcn.00c18c10
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x1b94], eax
lea edx, [ebp - 0x14c4]
push edx
lea eax, [ebp - 0x14bc]
push eax
push 0xc58144
call fcn.00c202e0
mov ecx, dword [0xc5b02c]
mov dword [ebp - 0x1b90], ecx
push 0
push 0xc20430
mov edx, dword [ebp - 0x1b94]
push edx
push 0x8b
mov eax, dword [ebp - 0x1b90]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0xc23d0e
mov dword [ebp - 0x1b0c], 0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14c4]
call fcn.00c18970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe8c]
call fcn.00c0e150
mov byte [ebp - 4], 0
mov dword [ebp - 0x1b98], 0
cmp dword [ebp - 0x52c], 0
je 0xc23ccc
mov ecx, dword [ebp - 0x52c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b98], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1b9c], 0
cmp dword [ebp - 0x538], 0
je 0xc23d03
mov edx, dword [ebp - 0x538]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1b9c], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b0c]
jmp 0xc240bf
mov dword [ebp - 0x1b10], 0xfffffffd
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14c4]
call fcn.00c18970
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe8c]
call fcn.00c0e150
mov byte [ebp - 4], 0
mov dword [ebp - 0x1ba0], 0
cmp dword [ebp - 0x52c], 0
je 0xc23d6a
mov eax, dword [ebp - 0x52c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1ba0], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1ba4], 0
cmp dword [ebp - 0x538], 0
je 0xc23da1
mov ecx, dword [ebp - 0x538]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1ba4], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b10]
jmp 0xc240bf
mov dword [ebp - 0x1b14], 0xfffffffd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe8c]
call fcn.00c0e150
mov byte [ebp - 4], 0
mov dword [ebp - 0x1ba8], 0
cmp dword [ebp - 0x52c], 0
je 0xc23df9
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1ba8], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1bac], 0
cmp dword [ebp - 0x538], 0
je 0xc23e30
mov eax, dword [ebp - 0x538]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1bac], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b14]
jmp 0xc240bf
lea ecx, [ebp - 0x1afc]
call fcn.00c180e0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x1bdc]
cmp dword [ecx + 0xd0], 0
je 0xc23f4e
mov edx, dword [ebp - 0x1bdc]
mov eax, dword [edx + 0x210]
mov dword [ebp - 0x1bb0], eax
cmp dword [ebp - 0x1bb0], 0
jbe 0xc23ec4
mov ecx, dword [ebp - 0x1bdc]
add ecx, 0x1fc
mov dword [ebp - 0x1bb4], ecx
mov edx, dword [ebp - 0x1bb4]
cmp dword [edx + 0x18], 0x10
jb 0xc23ea7
mov eax, dword [ebp - 0x1bb4]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1bf0], ecx
jmp 0xc23eb6
mov edx, dword [ebp - 0x1bb4]
add edx, 4
mov dword [ebp - 0x1bf0], edx
mov eax, dword [ebp - 0x1bf0]
mov dword [ebp - 0x1bf4], eax
jmp 0xc23ece
mov dword [ebp - 0x1bf4], 0
mov ecx, dword [ebp - 0x1bdc]
add ecx, 0xf18
mov dword [ebp - 0x1bb8], ecx
mov edx, dword [ebp - 0x1bb8]
cmp dword [edx + 0x18], 0x10
jb 0xc23efd
mov eax, dword [ebp - 0x1bb8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1bf8], ecx
jmp 0xc23f0c
mov edx, dword [ebp - 0x1bb8]
add edx, 4
mov dword [ebp - 0x1bf8], edx
push 1
mov eax, dword [ebp - 0x1bdc]
mov ecx, dword [eax + 0x1094]
push ecx
mov edx, dword [ebp - 0x1bdc]
mov eax, dword [edx + 0xf10]
push eax
mov ecx, dword [ebp - 0x1bf4]
push ecx
mov edx, dword [ebp - 0x1bdc]
add edx, 0x1250
push edx
mov eax, dword [ebp - 0x1bf8]
push eax
lea ecx, [ebp - 0x1afc]
call fcn.00c18c10
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x1bc0], eax
lea ecx, [ebp - 0x1afc]
push ecx
lea edx, [ebp - 0x1af4]
push edx
push 0xc58144
call fcn.00c202e0
mov eax, dword [0xc5b02c]
mov dword [ebp - 0x1bbc], eax
push 0
push 0xc20430
mov ecx, dword [ebp - 0x1bc0]
push ecx
push 0x8b
mov edx, dword [ebp - 0x1bbc]
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne 0xc24035
mov dword [ebp - 0x1b18], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1afc]
call fcn.00c18970
mov byte [ebp - 4], 0
mov dword [ebp - 0x1bc4], 0
cmp dword [ebp - 0x52c], 0
je 0xc23ff3
mov eax, dword [ebp - 0x52c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1bc4], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1bc8], 0
cmp dword [ebp - 0x538], 0
je 0xc2402a
mov ecx, dword [ebp - 0x538]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1bc8], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b18]
jmp 0xc240bf
mov dword [ebp - 0x1b1c], 0xfffffffd
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1afc]
call fcn.00c18970
mov byte [ebp - 4], 0
mov dword [ebp - 0x1bcc], 0
cmp dword [ebp - 0x52c], 0
je 0xc24082
mov edx, dword [ebp - 0x52c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1bcc], eax
mov dword [ebp - 0x52c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1bd0], 0
cmp dword [ebp - 0x538], 0
je 0xc240b9
mov eax, dword [ebp - 0x538]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1bd0], eax
mov dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x1b1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00c32666
mov esp, ebp
pop ebp
ret