Function at 0x418fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4c6d06
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x270], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x29c]
xor eax, eax
xor ebx, ebx
cmp byte [esp + 0x298], bl
mov dl, 0xc3
setne al
xor ecx, ecx
mov word [esp + 0x7c], cx
mov cl, 0x92
mov byte [esp + 0x64], dl
mov byte [esp + 0x68], dl
mov byte [esp + 0x74], dl
add eax, reloc.WS2_32.dll_accept
mov edi, eax
mov al, 0xa1
mov dl, 0xfc
push 0x2c
mov dword [esp + 0x24], 0x104
mov byte [esp + 0x54], 0xff
mov byte [esp + 0x55], cl
mov byte [esp + 0x56], 0xe1
mov byte [esp + 0x57], al
mov byte [esp + 0x58], 0xca
mov byte [esp + 0x59], cl
mov byte [esp + 0x5a], 0xfa
mov byte [esp + 0x5b], al
mov byte [esp + 0x5c], 0xdb
mov byte [esp + 0x5d], cl
mov byte [esp + 0x5e], 0xef
mov byte [esp + 0x5f], al
mov byte [esp + 0x60], 0xde
mov byte [esp + 0x61], cl
mov byte [esp + 0x62], 0xeb
mov byte [esp + 0x63], al
mov byte [esp + 0x64], 0xf0
mov byte [esp + 0x65], cl
mov byte [esp + 0x66], 0xdd
mov byte [esp + 0x67], al
mov byte [esp + 0x69], cl
mov byte [esp + 0x6a], 0xe9
mov byte [esp + 0x6b], al
mov byte [esp + 0x6d], cl
mov byte [esp + 0x6e], 0xfb
mov byte [esp + 0x6f], al
mov byte [esp + 0x70], 0xe9
mov byte [esp + 0x71], cl
mov byte [esp + 0x72], 0xf6
mov byte [esp + 0x73], al
mov byte [esp + 0x74], 0xdc
mov byte [esp + 0x75], cl
mov byte [esp + 0x76], 0xe2
mov byte [esp + 0x77], al
mov byte [esp + 0x79], cl
mov byte [esp + 0x7a], dl
mov byte [esp + 0x7b], al
mov byte [esp + 0x7c], 0xc9
mov byte [esp + 0x7d], cl
mov byte [esp + 0x7e], dl
mov byte [esp + 0x7f], al
mov byte [esp + 0x3c], 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], 0x2c
call fcn.004a41a8
add esp, 4
mov dword [esp + 0x30], eax
cmp eax, ebx
je 0x419116
push 0x2c
lea edx, [esp + 0x54]
push edx
push eax
call fcn.004a7010
add esp, 0xc
lea esi, [esp + 0x28]
mov dword [esp + 0x290], ebx
call fcn.004215e0
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebx
push eax
push edi
mov byte [esp + 0x2f], bl
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4192e2
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4192e2
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebx
push ebx
push eax
mov dword [esp + 0x3c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41917e
mov byte [esp + 0x1b], 1
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x1b], bl
je 0x4192e2
cmp word [esp + 0x7c], bx
je 0x4192e2
cmp dword [esp + 0x20], ebx
je 0x4192e2
mov cl, 0xa7
mov al, 0xb6
mov dl, 0xae
mov byte [esp + 0x58], dl
mov byte [esp + 0x5c], dl
mov byte [esp + 0x68], dl
mov dl, 0xd1
mov byte [esp + 0x6a], dl
mov byte [esp + 0x6e], dl
mov dl, 0xc6
push 0x28
mov byte [esp + 0x54], 0xe4
mov byte [esp + 0x55], cl
mov byte [esp + 0x56], 0xd0
mov byte [esp + 0x57], al
mov byte [esp + 0x58], 0x9d
mov byte [esp + 0x59], cl
mov byte [esp + 0x5a], 0xf0
mov byte [esp + 0x5b], al
mov byte [esp + 0x5d], cl
mov byte [esp + 0x5e], 0xc4
mov byte [esp + 0x5f], al
mov byte [esp + 0x61], cl
mov byte [esp + 0x62], 0xd6
mov byte [esp + 0x63], al
mov byte [esp + 0x64], 0x84
mov byte [esp + 0x65], cl
mov byte [esp + 0x66], 0xdb
mov byte [esp + 0x67], al
mov byte [esp + 0x68], 0xb1
mov byte [esp + 0x69], cl
mov byte [esp + 0x6a], 0xcf
mov byte [esp + 0x6b], al
mov byte [esp + 0x6d], cl
mov byte [esp + 0x6f], al
mov byte [esp + 0x70], 0xa4
mov byte [esp + 0x71], cl
mov byte [esp + 0x73], al
mov byte [esp + 0x74], 0xef
mov byte [esp + 0x75], cl
mov byte [esp + 0x76], dl
mov byte [esp + 0x77], al
mov byte [esp + 0x78], 0xb9
mov byte [esp + 0x79], cl
mov byte [esp + 0x7a], dl
mov byte [esp + 0x7b], al
mov byte [esp + 0x50], 0x21
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0x28
call fcn.004a41a8
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, ebx
je 0x419296
push 0x28
lea ecx, [esp + 0x54]
push ecx
push eax
call fcn.004a7010
add esp, 0xc
lea edx, [esp + 0x7c]
push edx
lea esi, [esp + 0x40]
mov byte [esp + 0x294], 1
call fcn.004215e0
push eax
mov ecx, 0x103
mov ebx, ebp
call fcn.00417580
push ebp
call fcn.00418af0
xor ecx, ecx
add esp, 0xc
test al, al
setne cl
inc ecx
mov esi, ecx
lea ecx, [esp + 0x3c]
call fcn.00421580
lea ecx, [esp + 0x28]
call fcn.00421580
mov eax, esi
jmp 0x4192ed
lea ecx, [esp + 0x28]
call fcn.00421580
xor eax, eax
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x270]
xor ecx, esp
call fcn.004a4a25
add esp, 0x280
ret