Function at 0x416380
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46c638
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x491d88]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
xor ebp, ebp
push ebp
lea eax, [esp + 0x1c]
push eax
push 1
push ebp
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], ebp
call fcn.0042afd2
mov esi, eax
add esp, 0x18
cmp esi, ebp
jne 0x4165e9
mov edx, dword [esp + 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebp
push ebp
push str.PendingFileRenameOperations
push edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x34], ebp
call esi
cmp eax, ebp
jne 0x4165be
mov ecx, dword [esp + 0x14]
cmp ecx, ebp
jbe 0x4165be
push ecx
call fcn.0042f9cf
mov edx, dword [esp + 0x1c]
add esp, 4
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebp
push str.PendingFileRenameOperations
push edx
call esi
cmp eax, ebp
jne 0x416587
mov eax, dword [esp + 0x14]
push eax
push str.Read__d_bytes_of_data_from_PendingFileRenameOperations
push 0x80
push 0x4932a8
call fcn.00401300
mov eax, dword [esp + 0x24]
lea ecx, [ebx + eax - 1]
add esp, 0x10
cmp ebx, ecx
mov esi, ebx
jae 0x41659f
cmp esi, ecx
jae 0x416481
cmp byte [esi], 0
jne 0x416481
push esi
call fcn.004541d2
mov esi, eax
mov eax, dword [esp + 0x18]
lea ecx, [ebx + eax - 1]
add esp, 4
cmp esi, ecx
jb 0x416465
lea edx, [ebx + eax - 1]
cmp esi, edx
jae 0x416534
mov eax, esi
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4164a3
sub eax, edi
push eax
push esi
lea ecx, [esp + 0x28]
call fcn.00403dd0
mov ecx, dword [esp + 0x4c]
mov edi, dword [ecx + 4]
mov edx, dword [edi + 4]
lea eax, [esp + 0x20]
push eax
push edx
push edi
mov dword [esp + 0x50], ebp
call fcn.00407160
mov ecx, dword [esp + 0x4c]
push 1
mov ebp, eax
call fcn.00406810
mov dword [edi + 4], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ebp
cmp dword [esp + 0x38], 0x10
mov dword [esp + 0x44], 0xffffffff
jb 0x416504
mov eax, dword [esp + 0x24]
push eax
call fcn.0042f9ca
add esp, 4
push esi
push str.Adding__s_to_list_of_files_to_be_renamed
push 0x20
push 0x4932a8
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], 0
mov byte [esp + 0x34], 0
call fcn.00401300
mov eax, dword [esp + 0x24]
add esp, 0x10
xor ebp, ebp
lea ecx, [ebx + eax - 1]
cmp esi, ecx
jae 0x41655c
lea esp, [esp]
cmp byte [esi], 0
je 0x41655c
push esi
call fcn.004541d2
mov esi, eax
mov eax, dword [esp + 0x18]
lea edx, [ebx + eax - 1]
add esp, 4
cmp esi, edx
jb 0x416540
lea ecx, [ebx + eax - 1]
cmp esi, ecx
jb 0x416465
push ebx
call fcn.0042f9ca
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push eax
push str.Error_reading_PendingFileRenameOperations_key___d
push 0x400
push 0x4932a8
call fcn.00401300
add esp, 0x10
push ebx
call fcn.0042f9ca
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push eax
push str.We_couldnt_open_the_pending_file_renameoperations_key___error_d
push 0x20
push 0x4932a8
call fcn.00401300
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push esi
push str.We_could_not_open_the_key__SYSTEMCurrentControlSetControlSession_Manager___error_d
push 0x400
push 0x4932a8
call fcn.00401300
add esp, 0x10
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret