Function at 0x4415c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 8], eax
call fcn.00440d10
call fcn.00437b70
call fcn.00437b30
call fcn.00437a80
call fcn.00437a60
call fcn.00437a70
call fcn.00439d00
call fcn.004379d0
call fcn.00437660
mov dword [0x48a850], eax
mov dword [0x48a7e0], 0
mov dword [0x48a7e4], 0
mov dword [0x48a7e8], 1
mov dword [0x48a7ec], 1
mov dword [0x48a7f0], 1
mov dword [0x48a7f4], 1
mov dword [0x48a7f8], 1
mov dword [0x48a7fc], 1
mov dword [0x48a800], 1
mov dword [0x48a808], 0
lea eax, [ebp - 0x220]
push eax
push 0x20019
push 0
push str.SoftwareTencentQQ
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x44171e
mov dword [ebp - 0x224], 4
mov dword [ebp - 0x434], 0x104
lea ecx, [ebp - 0x434]
push ecx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
push 0
push 0x472100
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0
jne 0x44171e
lea edx, [ebp - 0x43c]
push edx
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x430]
push ecx
call fcn.00434080
add esp, 0xc
test eax, eax
je 0x44171e
mov edx, dword [ebp - 0x438]
mov dword [0x48a7e0], edx
mov eax, dword [ebp - 0x43c]
mov dword [0x48a7e4], eax
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x210]
push edx
push 0x472110
call fcn.00438b10
add esp, 8
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x210]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
push 0x48a7e4
push 0x48a7e0
call fcn.004429d0
add esp, 8
lea edx, [ebp - 4]
push edx
push 0x20006
push 0
lea eax, [ebp - 0x210]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x218], eax
cmp dword [ebp + 8], 0
je 0x441a87
mov dword [ebp - 0x440], 4
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x64c], 0x208
lea ecx, [ebp - 0x64c]
push ecx
lea edx, [ebp - 0x648]
push edx
lea eax, [ebp - 0x440]
push eax
push 0
push str.QuickLaunch
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
push 0x472150
lea edx, [ebp - 0x648]
push edx
call fcn.004160f0
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov dword [0x48a7f4], eax
mov dword [ebp - 0x64c], 0x208
lea eax, [ebp - 0x64c]
push eax
lea ecx, [ebp - 0x648]
push ecx
lea edx, [ebp - 0x440]
push edx
push 0
push 0x472154
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
push 0x47216c
lea ecx, [ebp - 0x648]
push ecx
call fcn.004160f0
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov dword [0x48a7fc], eax
mov dword [ebp - 0x64c], 0x208
lea edx, [ebp - 0x64c]
push edx
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0x472170
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
push 0x472184
lea eax, [ebp - 0x648]
push eax
call fcn.004160f0
add esp, 8
neg eax
sbb eax, eax
add eax, 1
mov dword [0x48a7f8], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a7e8
lea edx, [ebp - 0x440]
push edx
push 0
push 0x472188
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a7ec
lea edx, [ebp - 0x440]
push edx
push 0
push 0x472198
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a7f0
lea edx, [ebp - 0x440]
push edx
push 0
push 0x4721a8
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a7f4
lea edx, [ebp - 0x440]
push edx
push 0
push 0x4721cc
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a7f8
lea edx, [ebp - 0x440]
push edx
push 0
push 0x4721f8
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a7fc
lea edx, [ebp - 0x440]
push edx
push 0
push 0x472208
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a800
lea edx, [ebp - 0x440]
push edx
push 0
push 0x472228
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x64c], 4
lea ecx, [ebp - 0x64c]
push ecx
push 0x48a850
lea edx, [ebp - 0x440]
push edx
push 0
push 0x472244
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
jmp 0x441b3d
mov dword [ebp - 0x650], 4
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x654], 4
lea ecx, [ebp - 0x654]
push ecx
push 0x48a7f0
lea edx, [ebp - 0x650]
push edx
push 0
push 0x47225c
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x654], 4
lea ecx, [ebp - 0x654]
push ecx
push 0x48a7f4
lea edx, [ebp - 0x650]
push edx
push 0
push 0x472280
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x654], 4
lea ecx, [ebp - 0x654]
push ecx
push 0x48a850
lea edx, [ebp - 0x650]
push edx
push 0
push 0x4722ac
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x218], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret