Function at 0x411c39
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x4121c8
xor esi, esi
push 8
mov ebx, ecx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], esi
call fcn.004015a0
mov eax, dword [ebx + 0xc4]
pop ecx
pop ecx
cmp eax, esi
je 0x42d5b4
cmp dword [ebx + 0xd4], esi
je 0x42d5cc
cmp dword [ebx + 0xd0], esi
je 0x42d5d3
cmp dword [ebx + 0xc8], esi
je 0x42d5da
cmp dword [ebx + 0xcc], esi
je 0x42d5e1
cmp dword [ebx + 0xdc], esi
je 0x42d5e8
push esi
push esi
call eax
mov dword [ebp - 0xcc], eax
cmp eax, 0xffffffff
je 0x42d5ef
push edi
push 0x1c
pop edi
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, dword [ebp - 0xd4]
push esi
push dword [ecx + 0x54]
mov dword [ebp - 0xc8], edi
push eax
call dword [ebx + 0xd4]
test eax, eax
je 0x42d5f8
lea eax, [ebp - 0xac]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xcc]
mov dword [ebp - 0xac], edi
call dword [ebx + 0xc8]
test eax, eax
jne 0x411d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42d5ff
lea eax, [ebp - 0xdc]
push eax
push esi
push esi
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xcc]
test eax, eax
jne 0x411d5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42d61b
mov edi, dword [ebp - 0xdc]
inc edi
lea eax, [edi + edi]
push eax
mov dword [ebp - 0xd8], eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push dword [ebp - 0xd8]
mov dword [ebp - 0xd0], eax
cmp eax, esi
je 0x42d63f
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xdc]
push eax
push edi
push dword [ebp - 0xd0]
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xcc]
test eax, eax
je 0x42d655
push 0x13
pop ecx
mov esi, 0x410e78
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xdc]
push eax
push 0x4e
lea eax, [ebp - 0x90]
push eax
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push 0x24
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xdc]
test eax, eax
je 0x42d6e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x42d6e8
push 0xe
lea eax, [ebp - 0x90]
push 0x4121a8
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x42d694
push 0x30
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
push 0x20019
mov word [ebp - 0x1e], ax
push esi
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xd8]
mov dword [ebp - 0xe4], eax
cmp eax, 0xffffffff
je 0x42d750
push 4
pop eax
push 8
pop ecx
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x10
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0xe8], esi
push 0
push dword [ebp - 0xe4]
mov esi, 0x412224
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x42d6fb
push dword [ebp - 0xd8]
push dword [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0xd4]
push dword [eax]
push 0x4120c8
push 8
call fcn.004015a0
mov esi, dword [ebp - 0xd4]
add esp, 0x18
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd0]
push dword [esi]
push 0x412030
push 8
call fcn.004015a0
add esp, 0x10
push dword [ebp - 0xd0]
lea ecx, [esi + 0x5c]
call fcn.00411c13
push dword [ebp - 0xd0]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jl 0x42d779
lea eax, [ebp - 0x20]
push eax
push dword [esi]
push 0x411f70
push 8
call fcn.004015a0
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x60]
call fcn.00411c13
push dword [ebp - 0xcc]
mov esi, eax
call dword [ebx + 0xd0]
test esi, esi
jl 0x42d78e
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret 4
push 0x42e310
push 4
call fcn.004015a0
pop ecx
pop ecx
mov eax, 0x80004005
jmp 0x411f5e
push 0x42e260
jmp 0x42d5b9
push 0x42e1b0
jmp 0x42d5b9
push 0x42e0f8
jmp 0x42d5b9
push 0x42e048
jmp 0x42d5b9
push 0x42df90
jmp 0x42d5b9
push 0x42deb8
push 1
jmp 0x42d5bb
push 0x42de00
jmp 0x42d604
push 0x42dd38
push 1
call fcn.004015a0
pop ecx
pop ecx
push dword [ebp - 0xcc]
call dword [ebx + 0xd0]
jmp 0x42d68a
push 0x42dc80
push 1
call fcn.004015a0
pop ecx
pop ecx
mov esi, 0x80004005
push dword [ebp - 0xcc]
call dword [ebx + 0xd0]
jmp 0x42d79c
push 0x42dbe0
push 1
call fcn.004015a0
add esp, 0xc
mov esi, 0x8007000e
jmp 0x42d62e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x411dbb
push 0x42db28
push 1
call fcn.004015a0
pop ecx
pop ecx
push dword [ebp - 0xcc]
call dword [ebx + 0xd0]
push dword [ebp - 0xd0]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 0x80004005
jmp 0x411f5d
mov eax, dword [ebp - 0xd0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x42d69d
sub eax, edx
sar eax, 1
add eax, eax
cmp eax, 0x50
jae 0x42d6cc
push dword [ebp - 0xd0]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x50
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0x90]
push eax
push 0x28
push dword [ebp - 0xd0]
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
jmp 0x411e2b
push 0x42da60
push 1
call fcn.004015a0
pop ecx
pop ecx
jmp 0x411e2b
cmp dword [ebp - 0xd8], 4
jne 0x411eb3
push 0xa
push 0xc
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xe8]
call sub.msvcrt.dll__itow_s
mov esi, dword [ebp - 0xd4]
add esp, 0x10
test eax, eax
je 0x411edd
push eax
push dword [esi]
push 0x42d9d0
push 8
call fcn.004015a0
add esp, 0x10
push 0x30
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x1e], ax
jmp 0x411edd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0xd4]
push dword [eax]
push 0x42d8f8
push 8
call fcn.004015a0
mov esi, dword [ebp - 0xd4]
add esp, 0x10
jmp 0x411ee9
push 0x42d858
push 1
call fcn.004015a0
pop ecx
pop ecx
mov eax, edi
jmp 0x411f5d
push 0x42d7a8
push 1
call fcn.004015a0
pop ecx
pop ecx
mov eax, esi
jmp 0x411f5d