Function at 0x4017e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Write file on windows

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [esp + 0x8c]
mov esi, edx
mov dword [esp + 0x70], ecx
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x401b83
push 2
push 0x400
mov dword [esp + 0x2c], 0
call fcn.0048f633
mov ebp, eax
add esp, 8
mov dword [esp + 0x30], ebp
test ebp, ebp
je 0x401b83
push 0
push 0
push 0
mov dword [esp + 0x40], 0x1312d00
call dword [sym.imp.kernel32.dll_HeapCreate]
push 0x1312d00
push 8
push eax
mov dword [esp + 0x54], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x401b83
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
xorps xmm0, xmm0
push esi
mov esi, dword [sym.imp.kernel32.dll_lstrlenW]
movlpd qword [esp + 0x6c], xmm0
call esi
inc eax
mov dword [esp + 0x40], 0
cdq
xorps xmm0, xmm0
mov dword [esp + 0x28], eax
mov edi, 1
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x38], edx
mov edx, dword [esp + 0x68]
movlpd qword [esp + 0x60], xmm0
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x44], edx
nop dword [eax + eax]
add ecx, 1
mov dword [esp + 0x68], ecx
adc eax, 0
mov dword [esp + 0x50], eax
lea eax, [ebx + edx*2]
push eax
push ebp
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push ebp
call esi
cdq
add eax, 1
adc edx, 0
add dword [esp + 0x44], eax
lea eax, [esp + 0x2c]
adc dword [esp + 0x4c], edx
push eax
push 0x20019
push 0
push ebp
push dword [esp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401c10
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x401c06
mov eax, dword [esp + 0x20]
inc dword [esp + 0x10]
inc eax
push 2
push eax
mov dword [esp + 0x28], eax
call fcn.0048f633
push 2
push dword [esp + 0x1c]
mov edi, eax
mov dword [esp + 0x28], edi
call fcn.0048f633
add esp, 0x10
mov ebp, eax
test edi, edi
je 0x401d21
test ebp, ebp
je 0x401d21
mov eax, dword [esp + 0x10]
add eax, 0x4010
push 2
push eax
mov dword [esp + 0x60], eax
call fcn.0048f633
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x401d15
mov edi, dword [esp + 0x1c]
xor esi, esi
nop dword [eax + eax]
cmp dword [0x4c5184], 0
je 0x401c3b
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
push 0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
push eax
push ebp
push esi
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x401a3d
cmp word [ebp], ax
je 0x401a3d
push ebp
push dword [esp + 0x34]
push 0x4ad240
push dword [esp + 0x64]
push ebx
call fcn.0040a370
add esp, 0x14
cmp eax, 0xffffffff
je 0x401a3d
push edi
lea eax, [esp + 0x60]
push eax
push ebx
call dword [sym.imp.kernel32.dll_lstrlenW]
mov edi, dword [esp + 0x24]
add eax, eax
push eax
push ebx
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
push 0
lea eax, [esp + 0x60]
push eax
push 4
push 0x4ad24c
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
inc esi
jmp 0x4019b0
inc esi
cmp edi, 0x103
je 0x401a52
test edi, edi
mov edi, dword [esp + 0x1c]
je 0x4019b0
push ebx
call fcn.0048f63e
mov eax, dword [esp + 0x24]
add esp, 4
add eax, 0x4010
mov dword [esp + 0x58], eax
push 2
push eax
call fcn.0048f633
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x401c2f
xor edi, edi
nop
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x3c], ecx
push edi
push dword [esp + 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x401bc5
push 0x4ad268
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x401bc5
push dword [esp + 0x18]
push dword [esp + 0x34]
push 0x4ad280
push dword [esp + 0x64]
push ebx
call fcn.0040a370
add esp, 0x14
cmp eax, 0xffffffff
je 0x401bc5
push esi
lea eax, [esp + 0x64]
push eax
push ebx
call dword [sym.imp.kernel32.dll_lstrlenW]
mov esi, dword [esp + 0x24]
add eax, eax
push eax
push ebx
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push 0
lea eax, [esp + 0x64]
push eax
push 4
push 0x4ad24c
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
mov esi, dword [sym.imp.kernel32.dll_lstrlenW]
push ebx
call esi
mov ecx, dword [esp + 0x28]
cdq
add eax, ecx
adc edx, dword [esp + 0x38]
add eax, 1
adc edx, 0
shld edx, eax, 1
add eax, eax
test edx, edx
jb 0x401b8e
ja 0x401b45
cmp eax, dword [esp + 0x34]
jb 0x401b8e
mov eax, dword [esp + 0x34]
add eax, 0x1312d00
push eax
push dword [esp + 0x18]
mov dword [esp + 0x3c], eax
push 8
push dword [esp + 0x54]
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x401b94
push 0x10
push 0x4ad28c
push 0x4ad20c
push dword [0x4def88]
call dword [sym.imp.user32.dll_MessageBoxW]
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
mov eax, dword [esp + 0x14]
jmp 0x401b98
mov ecx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
lea eax, [eax + ecx*2]
push ebx
adc dword [esp + 0x44], 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push ebx
call esi
cdq
add eax, 1
adc edx, 0
add dword [esp + 0x28], eax
adc dword [esp + 0x38], edx
inc edi
jmp 0x401a80
inc edi
cmp esi, 0x103
je 0x401bd6
test esi, esi
je 0x401a80
push ebx
call fcn.0048f63e
add esp, 4
push dword [esp + 0x18]
call fcn.0048f63e
add esp, 4
push ebp
call fcn.0048f63e
mov ebx, dword [esp + 0x18]
add esp, 4
mov ebp, dword [esp + 0x30]
mov esi, dword [sym.imp.kernel32.dll_lstrlenW]
mov edi, dword [esp + 0x3c]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x50]
cmp ecx, edi
jne 0x401c26
cmp eax, dword [esp + 0x40]
je 0x401d2d
mov edx, dword [esp + 0x44]
jmp 0x4018d0
push 0x10
push 0x4ad254
jmp 0x401b72
push dword [esp + 0x30]
call fcn.0048f63e
add esp, 4
push dword [esp + 0x18]
call fcn.0048f63e
add esp, 4
push ebp
call fcn.0048f63e
add esp, 4
push ebx
call fcn.0048f63e
add esp, 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_HeapDestroy]
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x271c
push dword [0x4def88]
call edi
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
push eax
call ebx
test eax, eax
jne 0x401cdb
cmp dword [0x4deb74], 1
jne 0x401cdb
push eax
push 0x297f
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
mov ecx, 1
call fcn.00402c50
push 5
push 0x272c
push dword [0x4def88]
call edi
push eax
call esi
push 0
push 0
push 0x402
push 0x272a
push dword [0x4def88]
call edi
push eax
call ebx
mov ecx, 0x4deb78
call fcn.004028a0
call fcn.004034b0
push 1
mov dword [0x4c5184], 2
call dword [sym.imp.kernel32.dll_ExitThread]
push 0x10
push 0x4ad22c
jmp 0x401b72
push 0x10
push 0x4ad1fc
jmp 0x401b72
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push dword [esp + 0x48]
call dword [sym.imp.kernel32.dll_HeapDestroy]
push ebp
call fcn.0048f63e
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret