Function at 0x40146d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x560
push ebx
push esi
push edi
lea edi, [ebp - 0x560]
mov ecx, 0x158
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x41f01c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x3fff
and dword [ebp - 0x238], 0
mov esi, esp
lea eax, [ebp - 0x250]
push eax
push 0x20019
push 0
push str.Interface
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00413f7e
test eax, eax
je 0x4014da
mov eax, dword [ebp - 0xc]
jmp 0x4016c8
mov esi, esp
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x238]
push eax
push 0
push 0
push 0
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp esi, esp
call fcn.00413f7e
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jne 0x4016b0
cmp dword [ebp - 0x238], 0
jbe 0x4016b0
and dword [ebp - 0x25c], 0
jmp 0x401545
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
cmp eax, dword [ebp - 0x238]
jae 0x4016b0
mov dword [ebp - 0x22c], 0xff
mov esi, esp
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x25c]
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp esi, esp
call fcn.00413f7e
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jne 0x4016ab
mov esi, esp
lea eax, [ebp - 0x274]
push eax
push 1
push 0
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.00413f7e
test eax, eax
jne 0x401696
and dword [ebp - 0x280], 0
xor eax, eax
mov word [ebp - 0x490], ax
push 0x206
push 0
lea eax, [ebp - 0x48e]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x49c], 0x104
mov esi, esp
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x280]
push eax
push 0
push 0
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.00413f7e
test eax, eax
jne 0x401696
mov esi, esp
push str.IApplicationAssociationRegistrationInternal
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.MSVCR120.dll__wcsicmp]
pop ecx
pop ecx
cmp esi, esp
call fcn.00413f7e
test eax, eax
jne 0x401696
mov esi, esp
lea eax, [ebp - 0x220]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
cmp esi, esp
call fcn.00413f7e
mov esi, esp
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00413f7e
mov dword [ebp - 0xc], 1
jmp 0x4016b0
mov esi, esp
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00413f7e
jmp 0x401538
mov esi, esp
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, esp
call fcn.00413f7e
mov eax, dword [ebp - 0xc]
push edx
mov ecx, ebp
push eax
lea edx, [0x4016f9]
call fcn.00413f26
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413fa1
add esp, 0x560
cmp ebp, esp
call fcn.00413f7e
mov esp, ebp
pop ebp
ret