Function at 0x415466
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x403c
call fcn.00439e70
mov eax, dword [0x448008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x4034], edx
mov esi, 0x483760
mov dword [ebp - 0x4038], ecx
mov edx, 0x449740
push edi
mov ecx, esi
call fcn.00425154
lea eax, [ebp - 0x4010]
xor ebx, ebx
push eax
push 1
push ebx
push esi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41572f
lea eax, [ebp - 0x4014]
mov dword [ebp - 0x4014], 0x4000
push eax
lea eax, [ebp - 0x4008]
push eax
push ebx
push ebx
push str.NxCoreAccessTape
push dword [ebp - 0x4010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x4010]
mov ebx, eax
neg ebx
sbb bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add bl, 1
je 0x41572f
mov esi, dword [ebp - 0x4014]
test esi, esi
je 0x41572f
push 0xffffffffffffffff
mov edx, esi
lea ecx, [ebp - 0x4008]
call fcn.0040ebe2
test eax, eax
jne 0x41572f
movzx eax, word [ebp - 0x4008]
cmp eax, 0x104
jae 0x41572f
lea ebx, [ebp - 0x4006]
add ebx, eax
cmp byte [ebx - 1], 0
jne 0x41572f
mov edx, 0x481e18
lea ecx, [ebp - 0x4006]
call fcn.00401d91
test al, al
je 0x41572f
movzx edx, word [ebx]
add ebx, 2
mov dword [ebp - 0x401c], edx
cmp edx, 0x58
ja 0x41572f
mov edi, ebx
add ebx, edx
mov dword [ebp - 0x4018], edi
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
add ebx, 8
mov dword [ebp - 0x4020], eax
mov dword [ebp - 0x4024], ecx
mov dword [ebp - 0x4028], ebx
cmp eax, 0x1ff8
ja 0x41572f
lea ecx, [ebp - 0x4008]
sub eax, ecx
add eax, ebx
cmp eax, esi
jg 0x41572f
mov eax, dword [edi + 4]
xor ecx, ecx
shld ecx, eax, 0x10
shl eax, 0x10
mov dword [ebp - 0x402c], ecx
mov dword [ebp - 0x4030], eax
cmp dword [ebp + 0xc], ecx
ja 0x4155e6
jb 0x41572f
cmp dword [ebp + 8], eax
jb 0x41572f
mov ecx, dword [0x449648]
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x4155fc
cmp eax, dword [edi + 0x40]
jne 0x41572f
mov al, byte [ecx + 0x29]
mov bh, byte [ecx + 0x46]
mov bl, byte [ecx + 0x4e]
mov edi, dword [ecx + 0x48]
movzx esi, word [ecx + 0x4c]
push edx
push dword [ebp - 0x4018]
mov byte [ebp - 0x4009], al
push ecx
call fcn.0043a150
mov ecx, dword [0x449648]
add esp, 0xc
mov al, byte [ebp - 0x4009]
push 0x58
mov byte [ecx + 0x29], al
mov eax, dword [ebp - 0x401c]
pop edx
mov byte [ecx + 0x46], bh
mov byte [ecx + 0x4e], bl
mov dword [ecx + 0x48], edi
mov word [ecx + 0x4c], si
cmp eax, edx
jae 0x41565e
sub edx, eax
imul eax, eax, 0x58
push edx
push 0
add eax, ecx
push eax
call fcn.0042c7b0
add esp, 0xc
mov ecx, 0x2000
call fcn.0040fda7
mov ecx, dword [0x449648]
mov edx, dword [ebp - 0x4020]
mov esi, dword [ebp - 0x4024]
push edx
push dword [ebp - 0x4028]
mov dword [ecx], eax
mov dword [eax + 4], edx
mov eax, dword [ecx]
mov dword [eax], esi
mov eax, dword [ecx]
add eax, 8
push eax
call fcn.0043a150
mov esi, dword [ebp - 0x4034]
add esp, 0xc
xor edx, edx
mov ecx, esi
push dword [ebp - 0x402c]
push dword [ebp - 0x4030]
call fcn.0040ee40
mov ebx, dword [ebp - 0x4038]
lea eax, [ebp - 0x403c]
pop ecx
pop ecx
push 0
push eax
mov edi, 0x10000
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x415722
cmp dword [ebp - 0x403c], edi
jne 0x415722
mov esi, dword [0x449648]
mov edx, edi
mov ecx, ebx
mov eax, dword [esi + 4]
not eax
push eax
call fcn.0040ebe2
test eax, eax
jne 0x415728
mov ecx, dword [esi + 8]
lea eax, [edi - 4]
sub eax, ecx
je 0x415716
lea edx, [ecx + ebx]
mov ecx, esi
push eax
call fcn.00414a22
test eax, eax
jne 0x415722
mov esi, dword [0x449648]
inc dword [esi + 4]
xor eax, eax
and dword [esi + 8], 0
inc eax
jmp 0x415731
mov esi, dword [0x449648]
mov ecx, esi
call fcn.00414184
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a623
mov esp, ebp
pop ebp
ret 8