Function at 0x415db0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x15c
mov eax, dword [0x4bfbe4]
mov dword [esp + 0x158], eax
push ebx
push ebp
push esi
push edi
mov dx, word [0x45ea54]
mov ecx, dword [0x45ea50]
mov eax, dword [str.00Userauto]
mov dword [esp + 0x40], eax
mov al, byte [0x45ea56]
mov dword [esp + 0x44], ecx
mov byte [esp + 0x4a], al
mov eax, dword [0x45ea44]
xor ecx, ecx
mov dword [esp + 0x4b], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x4f], ecx
xor eax, eax
mov byte [esp + 0x53], cl
mov cx, word [0x45ea48]
mov dword [esp + 0x23], eax
mov word [esp + 0x48], dx
mov edx, dword [str.00Username]
mov dword [esp + 0x18], edx
mov dl, byte [0x45ea4a]
mov dword [esp + 0x27], eax
mov word [esp + 0x20], cx
mov ecx, dword [str.00Usercode]
mov byte [esp + 0x2b], al
mov ax, word [0x45ea3c]
mov dword [esp + 0x2c], ecx
mov cl, byte [0x45ea3e]
mov word [esp + 0x34], ax
mov eax, dword [str.00Userdir]
mov byte [esp + 0x22], dl
mov edx, dword [0x45ea38]
mov dword [esp + 0x54], eax
mov byte [esp + 0x36], cl
mov ecx, dword [0x45ea2c]
mov dword [esp + 0x30], edx
xor edx, edx
xor eax, eax
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5e], eax
mov dword [esp + 0x37], edx
mov dword [esp + 0x62], eax
mov dword [esp + 0x3b], edx
mov word [esp + 0x66], ax
mov eax, dword [esp + 0x174]
mov byte [esp + 0x3f], dl
mov dx, word [0x45ea30]
mov word [esp + 0x5c], dx
cdq
mov ecx, 0xa
idiv ecx
mov cl, byte [esp + 0x40]
xor bl, bl
add cl, al
mov byte [esp + 0x40], cl
add byte [esp + 0x41], dl
add byte [esp + 0x18], al
add byte [esp + 0x19], dl
add byte [esp + 0x2c], al
add byte [esp + 0x2d], dl
mov cl, byte [esp + 0x54]
add cl, al
mov al, byte [esp + 0x55]
add al, dl
mov byte [esp + 0x54], cl
mov byte [esp + 0x55], al
mov esi, dword [esp + 0x170]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x50]
push edx
mov ebp, pe_nt_image_headers32
push esi
mov dword [esp + 0x2c], 3
mov dword [esp + 0x28], ebp
call edi
test eax, eax
jne 0x415fa7
cmp dword [esp + 0x10], 2
ja 0x415f2b
mov al, 0x7f
mov byte [esp + 0x6a], al
mov byte [esp + 0x6b], al
mov ecx, dword [esp + 0x178]
lea eax, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], ebp
call edi
test eax, eax
jne 0x415fa7
mov edx, dword [esp + 0x17c]
lea ecx, [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x3c]
push ecx
push esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], ebp
call edi
test eax, eax
jne 0x415fa7
mov eax, dword [esp + 0x184]
mov dl, byte [esp + 0x68]
mov cl, byte [esp + 0x69]
mov byte [eax], dl
mov dl, byte [esp + 0x6a]
mov byte [eax + 1], cl
mov cl, byte [esp + 0x6b]
mov byte [eax + 2], dl
mov byte [eax + 3], cl
mov bl, 1
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x184]
push ebp
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x64]
push ecx
push esi
mov dword [esp + 0x2c], 1
call edi
test eax, eax
mov al, bl
je 0x415fd9
mov byte [ebp], 0
mov ecx, dword [esp + 0x168]
pop edi
pop esi
pop ebp
pop ebx
call fcn.0042825d
add esp, 0x15c
ret 0x18