Function at 0x41062e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0x451220]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xe0], ebx
call fcn.00410988
test al, al
je 0x410968
push ecx
mov esi, esp
push 0x447820
call fcn.00406e38
push ebx
push 1
call fcn.004101bc
mov eax, dword [0x453c6c]
add esp, 0xc
mov ecx, 0x453c6c
call dword [eax + 0xc]
push 9
add eax, 0x10
mov esi, 0x448ba8
push esi
mov dword [ebp - 0xec], eax
lea eax, [ebp - 0xe0]
push str.Igrjkshj_CaohckeklEqjkghp2
push eax
mov dword [ebp - 0xdc], ebx
call fcn.00407d40
mov eax, dword [eax]
add esp, 0x10
lea ecx, [ebp - 0xdc]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4106dd
mov byte [ebp - 0xd5], 1
cmp dword [ebp - 0xdc], ebx
jne 0x4106e3
mov byte [ebp - 0xd5], bl
mov eax, dword [ebp - 0xe0]
add eax, 0xfffffff0
mov dword [ebp - 0xf0], ebx
call fcn.00406e8b
cmp byte [ebp - 0xd5], bl
je 0x4107b9
push 0xc8
lea eax, [ebp - 0xd4]
push ebx
push eax
mov dword [ebp - 0xe0], ebx
call fcn.00429ac0
add esp, 0xc
push 9
push esi
lea eax, [ebp - 0xe4]
push str.tnza
push eax
mov dword [ebp - 0xf4], 0xc4
call fcn.00407d40
mov eax, dword [eax]
add esp, 0x10
lea ecx, [ebp - 0xf4]
push ecx
lea ecx, [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0xe0]
push ecx
push ebx
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410778
cmp dword [ebp - 0xe0], 1
mov byte [ebp - 0xd5], 1
je 0x41077e
mov byte [ebp - 0xd5], bl
mov eax, dword [ebp - 0xe4]
add eax, 0xfffffff0
mov dword [ebp - 0xf0], ebx
call fcn.00406e8b
cmp byte [ebp - 0xd5], bl
je 0x4107ad
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.00406e04
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
push ecx
mov dword [ebp - 0xdc], ebx
add eax, 0xfffffff0
lea ebx, [ebp - 0xdc]
mov edi, esp
call fcn.0040698f
add eax, 0x10
mov dword [edi], eax
call fcn.00411331
pop ecx
mov dword [ebp - 0xe0], eax
test eax, eax
jne 0x41095a
cmp dword [ebp - 0xdc], eax
je 0x41095a
mov eax, dword [0x453c6c]
mov ecx, 0x453c6c
call dword [eax + 0xc]
mov edi, dword [ebp - 0xec]
add eax, 0x10
cmp dword [edi - 0xc], 0
mov dword [ebp - 0xdc], eax
je 0x4108d5
cmp dword [edi - 0xc], 4
jle 0x410867
push 0xc
pop ebx
push 9
push esi
lea eax, [ebp - 0xf4]
push str.jvw_
push eax
call fcn.00407d40
add esp, 0x10
push dword [eax]
lea edx, [ebp - 0xe4]
push 4
pop ecx
lea eax, [ebp - 0xec]
call fcn.00408b53
push eax
call fcn.00404b9e
test eax, eax
jne 0x41086d
mov byte [ebp - 0xd5], 1
jmp 0x410874
mov ebx, dword [ebp - 0xf0]
mov byte [ebp - 0xd5], 0
test bl, 8
je 0x41088a
mov eax, dword [ebp - 0xe4]
add eax, 0xfffffff0
and ebx, 0xfffffff7
call fcn.00406e8b
test bl, 4
je 0x41089d
mov eax, dword [ebp - 0xf4]
add eax, 0xfffffff0
call fcn.00406e8b
cmp byte [ebp - 0xd5], 0
push 9
lea eax, [ebp - 0xe4]
push esi
je 0x4108ce
push str._uyt_1__kxsykasqwc_1__rvlsJVW__k
push eax
call fcn.00407d40
push edi
push dword [eax]
lea eax, [ebp - 0xdc]
push eax
call fcn.0040678c
add esp, 0x1c
jmp 0x4108f7
push str._uyt_1__kxsykasqwc_1__rvlsAEE4017_i
jmp 0x4108b4
push 9
push esi
lea eax, [ebp - 0xe4]
push str._uyt_1__kxsykasqwc_1__rvlsAEE4017
push eax
call fcn.00407d40
add esp, 0x10
lea edi, [ebp - 0xdc]
call int.004069e7
mov eax, dword [ebp - 0xe4]
add eax, 0xfffffff0
call fcn.00406e8b
lea esi, [ebp - 0xe8]
call fcn.00412547
push str.SaveCommandLine
mov eax, esi
call fcn.0041261b
mov esi, dword [ebp - 0xdc]
test eax, eax
je 0x410947
mov ecx, dword [esi - 0xc]
lea ecx, [ecx + ecx + 2]
push ecx
push esi
call eax
pop ecx
pop ecx
test eax, eax
je 0x410947
push str._funnameshamuma_new
call fcn.004036df
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xe8]
call fcn.0041255c
lea eax, [esi - 0x10]
call fcn.00406e8b
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
call fcn.00406e8b
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00406e8b
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xe0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00427527
leave
ret