Function at 0x417850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x47e0
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x27d4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x418241
dec eax
test eax, eax
jle 0x4178ab
mov ecx, 0x5c
lea ecx, [ecx]
cmp word [ebp + eax*2 - 0x27d4], cx
je 0x4178a1
dec eax
test eax, eax
jg 0x417890
jmp 0x4178ab
xor ecx, ecx
mov word [ebp + eax*2 - 0x27d2], cx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push str.Lost
lea edx, [ebp - 0x27d4]
push edx
lea eax, [ebp - 0x37d4]
push 0x44014c
push eax
call esi
push str.LostP
lea ecx, [ebp - 0x27d4]
push ecx
lea edx, [ebp - 0x2fd4]
push 0x44014c
push edx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x20
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x37d4]
push eax
push 0
push 0
call ebx
mov esi, eax
push esi
call fcn.0041e128
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x37d4]
push ecx
push 0
push 0
call ebx
push 0x43fc28
push edi
call fcn.004216ee
add esp, 8
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x2fd4]
push edx
push 0
push 0
mov dword [ebp - 0x47e0], eax
call ebx
mov esi, eax
push esi
call fcn.0041e128
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x2fd4]
push eax
push 0
push 0
call ebx
push 0x43fc28
push edi
call fcn.004216ee
add esp, 8
mov dword [ebp - 0x47dc], eax
push 0
cmp dword [ebp - 0x47e0], 0
je 0x417ab4
test eax, eax
je 0x417ab4
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x37d4]
push ecx
push 0
push 0
call ebx
mov esi, eax
push esi
call fcn.0041e128
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea edx, [ebp - 0x37d4]
push edx
push 0
push 0
call ebx
push 0x43fc28
push edi
call fcn.004216ee
mov esi, eax
add esp, 8
test esi, esi
jne 0x4179f5
mov dword [ebp - 0x47d8], eax
jmp 0x417a14
push 2
push 0
push esi
call fcn.00421dc1
push esi
call fcn.00421941
push esi
mov dword [ebp - 0x47d8], eax
call fcn.00421eaa
add esp, 0x14
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x2fd4]
push eax
push 0
push 0
call ebx
mov esi, eax
push esi
call fcn.0041e128
add esp, 4
push 0
push 0
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x2fd4]
push ecx
push 0
push 0
call ebx
push 0x43fc28
push edi
call fcn.004216ee
mov esi, eax
add esp, 8
test esi, esi
jne 0x417a65
xor edi, edi
jmp 0x417a80
push 2
push 0
push esi
call fcn.00421dc1
push esi
call fcn.00421941
push esi
mov edi, eax
call fcn.00421eaa
add esp, 0x14
cmp dword [ebp - 0x47d8], 0
jne 0x417aa9
mov edx, dword [ebp - 0x47e0]
push edx
call fcn.00421eaa
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x417acd
mov eax, dword [ebp - 0x47dc]
push eax
call fcn.00421eaa
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x47e0]
push edi
lea ecx, [ebp - 0x17d4]
push 0x3e8
push ecx
call fcn.00421320
add esp, 0xc
test eax, eax
je 0x417b2b
lea esp, [esp]
lea edx, [ebp - 0x17d4]
push 0x440170
push edx
call fcn.00421458
lea eax, [ebp - 0x17d4]
push eax
push 0x43ea00
call fcn.00421575
push edi
lea ecx, [ebp - 0x17d4]
push 0x3e8
push ecx
call fcn.00421320
add esp, 0x1c
test eax, eax
jne 0x417af0
mov esi, dword [ebp - 0x47dc]
push esi
lea edx, [ebp - 0x13ec]
push 0x3e8
push edx
call fcn.00421320
add esp, 0xc
test eax, eax
je 0x417b8b
lea ebx, [ebx]
lea eax, [ebp - 0x13ec]
push 0x440170
push eax
call fcn.00421458
lea ecx, [ebp - 0x13ec]
push ecx
push 0x43ea00
call fcn.00421575
push esi
lea edx, [ebp - 0x13ec]
push 0x3e8
push edx
call fcn.00421320
add esp, 0x1c
test eax, eax
jne 0x417b50
push edi
call fcn.00421eaa
push esi
call fcn.00421eaa
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x47d2]
push ecx
mov word [ebp - 0x47d4], ax
call fcn.00423160
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x3fd2]
push eax
mov word [ebp - 0x3fd4], dx
call fcn.00423160
lea ecx, [ebp - 0x47d4]
push ecx
mov ecx, str.lagsname
call fcn.00410ba0
add esp, 0x24
lea edx, [ebp - 0x47d4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x417d93
push 0x7fe
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.00423160
lea eax, [ebp - 0x17d4]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x417c20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417c20
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x17d4]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x17d4]
mov edi, eax
lea eax, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417c50
push edi
sub ecx, eax
lea eax, [ebp - 0x804]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x17d4]
push ecx
push 0
push 0
call esi
lea edx, [ebp - 0x47d8]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x417cac
push str.lagsname
lea edi, [ebp - 0x47d8]
lea esi, [ebp - 0x804]
call fcn.004174b0
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 4
jmp 0x417cb9
mov eax, dword [ebp - 0x47d8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea ecx, [ebp - 0xc03]
push 0
push ecx
mov byte [ebp - 0xc04], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x804]
push edx
push 0
push 0
call ebx
push 0
push 0
push eax
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0
call ebx
lea eax, [ebp - 0xc04]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417d11
sub eax, edx
lea edx, [ebp - 0xc04]
push edx
mov edx, eax
call fcn.00416f30
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1fd2]
push ecx
mov word [ebp - 0x1fd4], ax
call fcn.00423160
lea eax, [ebp - 0xc04]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417d50
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0xc04]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0xc04]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417d75
push eax
sub ecx, edi
lea eax, [ebp - 0x1fd4]
inc ecx
push eax
push ecx
lea ecx, [ebp - 0xc04]
jmp 0x417ef9
push 0x208
lea eax, [ebp - 0xa0c]
push 0
push eax
mov dword [ebp - 0x47dc], 0
call fcn.00423160
add esp, 0xc
lea ecx, [ebp - 0x47dc]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x47d8], 0x104
mov dword [ebp - 0x47e0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x47d8]
push edx
mov edx, dword [ebp - 0x47dc]
lea eax, [ebp - 0xa0c]
push eax
lea ecx, [ebp - 0x47e0]
push ecx
push 0
push str.lagsname
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x47dc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0xa0c]
push edx
push 0
push 0
call ebx
push 0
push 0
push eax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xa0c]
push ecx
push 0
push 0
call ebx
lea eax, [ebp - 0x404]
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417e70
lea edx, [ebp - 0x404]
sub eax, esi
push edx
mov edx, eax
call fcn.00416f30
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1fd2]
push ecx
mov word [ebp - 0x1fd4], ax
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417eb0
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x417ee0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417ee0
push eax
sub ecx, edi
lea eax, [ebp - 0x1fd4]
inc ecx
push eax
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea edx, [ebp - 0x1fd4]
push edx
push 0xff
push 0x44bae6
call fcn.004205b2
lea eax, [ebp - 0x3fd4]
add esp, 0xc
push eax
mov ecx, str.lagsnameTow
call fcn.00410ba0
add esp, 4
lea ecx, [ebp - 0x3fd4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4180cc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1002]
push eax
mov word [ebp - 0x1004], dx
call fcn.00423160
lea eax, [ebp - 0x13ec]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417f70
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x13ec]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x13ec]
mov edi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x417f97
push edi
sub ecx, eax
lea edx, [ebp - 0x1004]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x13ec]
push eax
push 0
push 0
call esi
lea ecx, [ebp - 0x47d8]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x417ff3
push str.lagsnameTow
lea edi, [ebp - 0x47d8]
lea esi, [ebp - 0x1004]
call fcn.004174b0
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esp, 4
jmp 0x418000
mov edx, dword [ebp - 0x47d8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x1004]
push ecx
push 0
push 0
call ebx
push 0
push 0
push eax
lea edx, [ebp - 0x404]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x1004]
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418058
sub eax, edx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00416f30
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1fd2]
push eax
mov word [ebp - 0x1fd4], dx
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x418096
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
jmp 0x4180c0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4180c0
jmp 0x41820f
push 0x208
lea edx, [ebp - 0xa0c]
push 0
push edx
mov dword [ebp - 0x47dc], 0
call fcn.00423160
add esp, 0xc
lea eax, [ebp - 0x47dc]
push eax
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x47d8], 0x104
mov dword [ebp - 0x47e0], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x47d8]
push ecx
mov ecx, dword [ebp - 0x47dc]
lea edx, [ebp - 0xa0c]
push edx
lea eax, [ebp - 0x47e0]
push eax
push 0
push str.lagsnameTow
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x47dc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0xa0c]
push ecx
push 0
push 0
call ebx
push 0
push 0
push eax
lea edx, [ebp - 0x404]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0xa0c]
push eax
push 0
push 0
call ebx
lea eax, [ebp - 0x404]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4181a5
sub eax, ecx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00416f30
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1fd2]
push eax
mov word [ebp - 0x1fd4], dx
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4181e3
push 0
push 0
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0
call esi
lea ecx, [ebp - 0x404]
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x418208
push eax
lea edx, [ebp - 0x1fd4]
push edx
sub ecx, edi
inc ecx
push ecx
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call esi
lea ecx, [ebp - 0x1fd4]
push ecx
push 0x1e
push 0x44bce4
call fcn.004205b2
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret