Function at 0x417a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x47e0
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x27d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4183f1
dec eax
test eax, eax
jle 0x417a5b
mov ecx, 0x5c
lea ecx, [ecx]
cmp word [ebp + eax*2 - 0x27d4], cx
je 0x417a51
dec eax
test eax, eax
jg 0x417a40
jmp 0x417a5b
xor ecx, ecx
mov word [ebp + eax*2 - 0x27d2], cx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push str.Lost
lea edx, [ebp - 0x27d4]
push edx
lea eax, [ebp - 0x37d4]
push 0x43f14c
push eax
call esi
push str.LostP
lea ecx, [ebp - 0x27d4]
push ecx
lea edx, [ebp - 0x2fd4]
push 0x43f14c
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x20
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x37d4]
push eax
push 0
push 0
call ebx
mov esi, eax
push esi
call fcn.0041de98
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x37d4]
push ecx
push 0
push 0
call ebx
push 0x43ec28
push edi
call fcn.0042145e
add esp, 8
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x2fd4]
push edx
push 0
push 0
mov dword [ebp - 0x47e0], eax
call ebx
mov esi, eax
push esi
call fcn.0041de98
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x2fd4]
push eax
push 0
push 0
call ebx
push 0x43ec28
push edi
call fcn.0042145e
add esp, 8
mov dword [ebp - 0x47dc], eax
push 0
cmp dword [ebp - 0x47e0], 0
je 0x417c64
test eax, eax
je 0x417c64
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x37d4]
push ecx
push 0
push 0
call ebx
mov esi, eax
push esi
call fcn.0041de98
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x37d4]
push edx
push 0
push 0
call ebx
push 0x43ec28
push edi
call fcn.0042145e
mov esi, eax
add esp, 8
test esi, esi
jne 0x417ba5
mov dword [ebp - 0x47d8], eax
jmp 0x417bc4
push 2
push 0
push esi
call fcn.00421b31
push esi
call fcn.004216b1
push esi
mov dword [ebp - 0x47d8], eax
call fcn.00421c1a
add esp, 0x14
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2fd4]
push eax
push 0
push 0
call ebx
mov esi, eax
push esi
call fcn.0041de98
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x2fd4]
push ecx
push 0
push 0
call ebx
push 0x43ec28
push edi
call fcn.0042145e
mov esi, eax
add esp, 8
test esi, esi
jne 0x417c15
xor edi, edi
jmp 0x417c30
push 2
push 0
push esi
call fcn.00421b31
push esi
call fcn.004216b1
push esi
mov edi, eax
call fcn.00421c1a
add esp, 0x14
cmp dword [ebp - 0x47d8], 0
jne 0x417c59
mov edx, dword [ebp - 0x47e0]
push edx
call fcn.00421c1a
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x417c7d
mov eax, dword [ebp - 0x47dc]
push eax
call fcn.00421c1a
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x47e0]
push edi
lea ecx, [ebp - 0x17d4]
push 0x3e8
push ecx
call fcn.00421090
add esp, 0xc
test eax, eax
je 0x417cdb
lea esp, [esp]
lea edx, [ebp - 0x17d4]
push 0x43f170
push edx
call fcn.004211c8
lea eax, [ebp - 0x17d4]
push eax
push 0x43da00
call fcn.004212e5
push edi
lea ecx, [ebp - 0x17d4]
push 0x3e8
push ecx
call fcn.00421090
add esp, 0x1c
test eax, eax
jne 0x417ca0
mov esi, dword [ebp - 0x47dc]
push esi
lea edx, [ebp - 0x13ec]
push 0x3e8
push edx
call fcn.00421090
add esp, 0xc
test eax, eax
je 0x417d3b
lea ebx, [ebx]
lea eax, [ebp - 0x13ec]
push 0x43f170
push eax
call fcn.004211c8
lea ecx, [ebp - 0x13ec]
push ecx
push 0x43da00
call fcn.004212e5
push esi
lea edx, [ebp - 0x13ec]
push 0x3e8
push edx
call fcn.00421090
add esp, 0x1c
test eax, eax
jne 0x417d00
push edi
call fcn.00421c1a
push esi
call fcn.00421c1a
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x47d2]
push ecx
mov word [ebp - 0x47d4], ax
call fcn.00422ed0
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x3fd2]
push eax
mov word [ebp - 0x3fd4], dx
call fcn.00422ed0
lea ecx, [ebp - 0x47d4]
push ecx
mov ecx, str.lagsname
call fcn.004065e0
add esp, 0x24
lea edx, [ebp - 0x47d4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x417f43
push 0x7fe
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.00422ed0
lea eax, [ebp - 0x17d4]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x417dd0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417dd0
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x17d4]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x17d4]
mov edi, eax
lea eax, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417e00
push edi
sub ecx, eax
lea eax, [ebp - 0x804]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x17d4]
push ecx
push 0
push 0
call esi
lea edx, [ebp - 0x47d8]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x417e5c
push str.lagsname
lea edi, [ebp - 0x47d8]
lea esi, [ebp - 0x804]
call fcn.00417660
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 4
jmp 0x417e69
mov eax, dword [ebp - 0x47d8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea ecx, [ebp - 0xc03]
push 0
push ecx
mov byte [ebp - 0xc04], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x804]
push edx
push 0
push 0
call ebx
push 0
push 0
push eax
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0
call ebx
lea eax, [ebp - 0xc04]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417ec1
sub eax, edx
lea edx, [ebp - 0xc04]
push edx
mov edx, eax
call fcn.00406990
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1fd2]
push ecx
mov word [ebp - 0x1fd4], ax
call fcn.00422ed0
lea eax, [ebp - 0xc04]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417f00
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0xc04]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0xc04]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417f25
push eax
sub ecx, edi
lea eax, [ebp - 0x1fd4]
inc ecx
push eax
push ecx
lea ecx, [ebp - 0xc04]
jmp 0x4180a9
push 0x208
lea eax, [ebp - 0xa0c]
push 0
push eax
mov dword [ebp - 0x47dc], 0
call fcn.00422ed0
add esp, 0xc
lea ecx, [ebp - 0x47dc]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x47d8], 0x104
mov dword [ebp - 0x47e0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x47d8]
push edx
mov edx, dword [ebp - 0x47dc]
lea eax, [ebp - 0xa0c]
push eax
lea ecx, [ebp - 0x47e0]
push ecx
push 0
push str.lagsname
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x47dc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0xa0c]
push edx
push 0
push 0
call ebx
push 0
push 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xa0c]
push ecx
push 0
push 0
call ebx
lea eax, [ebp - 0x404]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418020
lea edx, [ebp - 0x404]
sub eax, esi
push edx
mov edx, eax
call fcn.00406990
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1fd2]
push ecx
mov word [ebp - 0x1fd4], ax
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418060
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x418090
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x418090
push eax
sub ecx, edi
lea eax, [ebp - 0x1fd4]
inc ecx
push eax
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea edx, [ebp - 0x1fd4]
push edx
push 0xff
push 0x44aae6
call fcn.00420322
lea eax, [ebp - 0x3fd4]
add esp, 0xc
push eax
mov ecx, str.lagsnameTow
call fcn.004065e0
add esp, 4
lea ecx, [ebp - 0x3fd4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x41827c
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1002]
push eax
mov word [ebp - 0x1004], dx
call fcn.00422ed0
lea eax, [ebp - 0x13ec]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418120
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x13ec]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x13ec]
mov edi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x418147
push edi
sub ecx, eax
lea edx, [ebp - 0x1004]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x13ec]
push eax
push 0
push 0
call esi
lea ecx, [ebp - 0x47d8]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4181a3
push str.lagsnameTow
lea edi, [ebp - 0x47d8]
lea esi, [ebp - 0x1004]
call fcn.00417660
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 4
jmp 0x4181b0
mov edx, dword [ebp - 0x47d8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x1004]
push ecx
push 0
push 0
call ebx
push 0
push 0
push eax
lea edx, [ebp - 0x404]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x1004]
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418208
sub eax, edx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00406990
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1fd2]
push eax
mov word [ebp - 0x1fd4], dx
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418246
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x418270
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x418270
jmp 0x4183bf
push 0x208
lea edx, [ebp - 0xa0c]
push 0
push edx
mov dword [ebp - 0x47dc], 0
call fcn.00422ed0
add esp, 0xc
lea eax, [ebp - 0x47dc]
push eax
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x47d8], 0x104
mov dword [ebp - 0x47e0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x47d8]
push ecx
mov ecx, dword [ebp - 0x47dc]
lea edx, [ebp - 0xa0c]
push edx
lea eax, [ebp - 0x47e0]
push eax
push 0
push str.lagsnameTow
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x47dc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0xa0c]
push ecx
push 0
push 0
call ebx
push 0
push 0
push eax
lea edx, [ebp - 0x404]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x418355
sub eax, ecx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00406990
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1fd2]
push eax
mov word [ebp - 0x1fd4], dx
call fcn.00422ed0
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418393
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4183b8
push eax
lea edx, [ebp - 0x1fd4]
push edx
sub ecx, edi
inc ecx
push ecx
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call esi
lea ecx, [ebp - 0x1fd4]
push ecx
push 0x1e
push 0x44ace4
call fcn.00420322
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret