Function at 0x415827
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x2064
call fcn.00424e30
sub esp, eax
mov dword [esp], 0x2001f
call fcn.00411dce
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x102c], 0xc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1028], eax
mov dword [ebp - 0x1024], 0
mov dword [esp], 1
mov eax, dword [fcn.004311f0]
call eax
mov dword [esp], eax
call sub.msvcrt.dll_fflush
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x415893
mov dword [esp], str.Configuring...
call fcn.0041b00c
mov dword [esp], 0xf003f
call fcn.00411563
mov ebx, eax
mov ecx, 0x467064
call fcn.004350a0
lea edx, [ebp - 0x1020]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x14]
mov dword [esp + 0x1c], edx
lea edx, [ebp - 0x102c]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
test eax, eax
sete al
test al, al
je 0x416556
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], 4
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
call eax
sub esp, 0xc
mov dword [ebp - 0x1018], eax
mov eax, dword [ebp - 0x1018]
test eax, eax
je 0x415946
mov byte [0x46703c], 1
mov dword [esp], str.Error_setting_registry_permissions_n
call fcn.00411655
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4491b0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x4159eb
call fcn.00411583
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_root.cer
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x4491b0
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LogonDrive
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415a87
mov dword [esp + 4], 0x4491d7
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.LogonDrive
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LogonPath
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415b23
mov dword [esp + 4], str.lofiapp1pcapp__sprewts1pcapp
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.LogonPath
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreferedServers
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415bbf
mov dword [esp + 4], str.lofiapp1
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreferedServers
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.QueryServer
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415c5c
mov eax, dword [0x445ca0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.QueryServer
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44922b
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415cf9
mov eax, dword [0x445ca0]
mov dword [esp + 4], eax
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44922b
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnablePB
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415d7f
mov dword [ebp - 0x1018], 1
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1018]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnablePB
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.LocalCardSupport
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415e0b
mov dword [ebp - 0x1018], 3
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1018]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.LocalCardSupport
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LocalOfflineAllowed
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415e91
mov dword [ebp - 0x1018], 1
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1018]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.LocalOfflineAllowed
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.RemoteCardSupport
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415f1d
mov dword [ebp - 0x1018], 3
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1018]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.RemoteCardSupport
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.RemoteOfflineAllowed
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x415fa3
mov dword [ebp - 0x1018], 1
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1018]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.RemoteOfflineAllowed
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44928a
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x41603f
mov dword [esp + 4], 0x44929c
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44928a
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.enableCloseSession
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x4160c4
mov eax, dword [0x445ca8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, dword [0x445ca8]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.enableCloseSession
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ForceStartupLogin
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x416149
mov eax, dword [0x445cac]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, dword [0x445cac]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ForceStartupLogin
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LoginType
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x4161ce
mov eax, dword [str.both]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, dword [str.both]
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.LoginType
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1018], 0x1000
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.MazingerVersion
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
test al, al
je 0x416226
mov byte [0x467040], 1
lea eax, [ebp - 0x1014]
mov dword [eax], 0x2e342e33
mov dword [eax + 4], 0x6e652d32
mov dword [eax + 8], 0x70726574
mov dword [eax + 0xc], 0x65736972
mov byte [eax + 0x10], 0
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.MazingerVersion
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1018], 0x1000
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviousGinaDll
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0x1020]
cmp eax, 2
je 0x4162f2
mov eax, dword [ebp - 0x1020]
test eax, eax
jne 0x416352
mov ecx, 0x4670c4
call fcn.004350a0
mov dword [esp + 4], eax
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.PreviousGinaDll
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.ForceStartupLogin
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x4163f4
mov dword [esp + 4], 0x447a88
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ForceStartupLogin
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableCloseSession
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x416496
mov dword [esp + 4], 0x447a82
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.EnableCloseSession
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x1018]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1014]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x101c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.LoginType
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
sete al
test al, al
je 0x416538
mov dword [esp + 4], str.kerberos
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x1014]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1014]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.LoginType
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.REGISTRY_HKLMSoftwareSoffidesso_configured
call fcn.00411655
jmp 0x41656e
mov byte [0x46703c], 1
call fcn.00411b5a
mov dword [esp], str.Cannot_configure_registry_HKLMSoftwareSoffidesso
call fcn.00411655
movzx eax, byte [0x467042]
xor eax, 1
test al, al
je 0x41696a
mov dword [esp], 0xf003f
call fcn.00411563
lea edx, [ebp - 0x1020]
mov dword [esp + 0x20], edx
lea edx, [ebp - 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSoffidESSO
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
test eax, eax
sete al
test al, al
je 0x416957
mov dword [esp], 1
mov eax, dword [fcn.004311f0]
call eax
mov dword [esp], eax
call sub.msvcrt.dll_fflush
movzx eax, byte [0x46703d]
xor eax, 1
test al, al
je 0x416617
mov dword [esp], str.Registering_uninstalller...
call fcn.0041b00c
lea eax, [ebp - 0x2034]
mov dword [eax], 0x66666f53
mov dword [eax + 4], 0x45206469
mov dword [eax + 8], 0x7265746e
mov dword [eax + 0xc], 0x73697270
mov dword [eax + 0x10], 0x69532065
mov dword [eax + 0x14], 0x656c676e
mov dword [eax + 0x18], 0x67695320
mov dword [eax + 0x1c], 0x6e4f2d6e
mov byte [eax + 0x20], 0
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2034]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisplayName
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x2034]
mov dword [eax], 0x2e342e33
mov dword [eax + 4], 0x6e652d32
mov dword [eax + 8], 0x70726574
mov dword [eax + 0xc], 0x65736972
mov byte [eax + 0x10], 0
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2034]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisplayVersion
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x2034]
mov dword [eax], 0x66666f53
mov word [eax + 4], 0x6469
mov byte [eax + 6], 0
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2034]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Publisher
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
call fcn.00411583
mov dword [esp + 8], eax
mov dword [esp + 4], str.__suninstall.exe_
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2034]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.UninstallString
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
call fcn.00411583
mov dword [esp + 8], eax
mov dword [esp + 4], str.__smazinger.exe_
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call fcn.00431940
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2034]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisplayIcon
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [esp], 0
call fcn.00411480
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1034]
mov dword [esp], eax
call fcn.00411495
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._Y_m_d
mov dword [esp + 4], 0x1000
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strftime
lea eax, [ebp - 0x2034]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x2034]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.InstallDate
mov dword [esp], edx
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1030], 1
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1030]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.NoModify
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1030], 1
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 4
lea edx, [ebp - 0x1030]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.NoRepair
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp], str.Registered_uninstall
call fcn.00411655
jmp 0x41696a
mov dword [esp], str.__Cannot_register_uninstall
call fcn.00411655
mov byte [0x46703c], 1
call fcn.0041252a
call fcn.00412629
call fcn.00412c39
call fcn.00413058
call fcn.0041333e
call fcn.0041151b
test eax, eax
setne al
test al, al
je 0x416998
call fcn.0041441c
jmp 0x41699d
call fcn.0041489e
call fcn.0041151b
test eax, eax
setne al
test al, al
je 0x4169b0
call fcn.0041354a
nop
mov ebx, dword [ebp - 4]
leave
ret