Function at 0x411b72
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov dword [ebp - 0x14], str.SayakaPendingFileRenameOperations
mov dword [esp], 0xf003f
call fcn.00411563
lea edx, [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlSession_Manager
mov dword [esp], 0x80000002
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x411db8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0x4670e0
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
cmp eax, 2
setne al
test al, al
je 0x411cb2
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x20]
lea ebx, [eax + edx]
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, ebx
add eax, 2
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
setne al
test al, al
je 0x411ce7
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.Error_accessing_to__s
call fcn.00411655
call fcn.00411b5a
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x411dc9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, ebx
add eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
lea edx, [eax - 1]
mov eax, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov edx, dword [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 0xc]
add edx, eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_strcpy
mov eax, dword [ebp - 0x10]
lea edx, [eax - 1]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
mov dword [ebp - 0x1c], 3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
setne al
test al, al
je 0x411d96
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str.__ERROR_Cannot_set_value__s
call fcn.00411655
call fcn.00411b5a
mov eax, 0
jmp 0x411dc9
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 1
jmp 0x411dc9
mov dword [esp], str.__ERROR_Cannot_open_key_HKLMSYSTEMCurrentControlSetControlSession_Manager
call fcn.00411655
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret