Function at 0x41518c
Capabilities:
Query or enumerate registry value
Set console window title
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
lea edi, [ebp - 0x110]
mov ecx, 0x44
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0x104
mov esi, esp
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push str.LogToFile
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, esp
call fcn.00419202
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x415201
cmp dword [ebp - 8], 1
je 0x415232
mov dword [ebp - 4], 1
mov esi, esp
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x110]
push edx
push 1
push 0
push str.LogToFile
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, esp
call fcn.00419202
mov dword [ebp - 0xc], eax
cmp dword [0x41e7d0], 0xffffffff
je 0x415273
mov esi, esp
mov ecx, dword [0x41e7d0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00419202
test eax, eax
jne 0x415269
push 0x100
push 0x421bbc
push str.CloseHandle__m_hOutput_
call fcn.0041574c
mov dword [0x41e7d0], 0xffffffff
movsx edx, byte [ebp - 0x110]
test edx, edx
je 0x4153c9
mov esi, esp
push str.Console
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.00419202
test eax, eax
jne 0x4152fe
mov esi, esp
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.00419202
mov dword [0x41e7d0], eax
cmp dword [0x41e7d0], 0xffffffff
jne 0x4152e5
mov esi, esp
call dword [sym.imp.KERNEL32.dll_AllocConsole]
cmp esi, esp
call fcn.00419202
mov esi, esp
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp esi, esp
call fcn.00419202
mov dword [0x41e7d0], eax
mov esi, esp
push str.ActiveX_Debug_Output
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp esi, esp
call fcn.00419202
jmp 0x4153c9
movsx ecx, byte [ebp - 0x110]
test ecx, ecx
je 0x4153c9
mov esi, esp
push str.Debug
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.00419202
test eax, eax
je 0x4153c9
mov esi, esp
push str.Debugger
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.00419202
test eax, eax
je 0x4153c9
mov esi, esp
push 0x421c48
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp esi, esp
call fcn.00419202
test eax, eax
je 0x4153c9
mov esi, esp
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.00419202
mov dword [0x41e7d0], eax
cmp dword [0x41e7d0], 0xffffffff
je 0x4153c9
mov esi, esp
push 2
push 0
push 0
mov eax, dword [0x41e7d0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp esi, esp
call fcn.00419202
push str._r_n_r_nDbgInitialize___r_n_r_n
call fcn.0041510e
pop edi
pop esi
add esp, 0x110
cmp ebp, esp
call fcn.00419202
mov esp, ebp
pop ebp
ret 4