Function at 0x4171b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
mov eax, dword [0x5bd254]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x334], 0
lea eax, [ebp - 0x548]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 8]
push ecx
push reloc.JFTIFF32.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x417214
xor eax, eax
jmp 0x4174f0
push 0
push 0
lea edx, [ebp - 0x330]
push edx
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x340]
push edx
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0
lea edx, [ebp - 0x338]
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x548]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x54c], 0
jmp 0x41727a
mov edx, dword [ebp - 0x54c]
add edx, 1
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp - 0x54c]
cmp eax, dword [ebp - 0x110]
jae 0x4173bd
mov dword [ebp - 0x120], pe_nt_image_headers32
mov dword [ebp - 0x338], pe_nt_image_headers32
push 0
lea ecx, [ebp - 0x338]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x540]
push ecx
mov edx, dword [ebp - 0x54c]
push edx
mov eax, dword [ebp - 0x548]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x33c], eax
lea ecx, [ebp - 0x540]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x5a7a78
lea eax, [ebp - 0x328]
push eax
call fcn.005135ca
add esp, 0x10
lea ecx, [ebp - 0x540]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s_s
lea eax, [ebp - 0x440]
push eax
call fcn.005135ca
add esp, 0x10
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x224]
push edx
push 0
push 0xf003f
push 0
push str.JfdClass
push 0
lea eax, [ebp - 0x440]
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x417381
cmp dword [ebp - 0x224], 0
je 0x41736d
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x548]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4174f0
cmp dword [ebp - 0x224], 0
je 0x417397
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x328]
push edx
call fcn.004171b0
add esp, 8
test eax, eax
jne 0x4173b8
xor eax, eax
jmp 0x4174f0
jmp 0x41726b
lea eax, [ebp - 0x224]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x4173f0
xor eax, eax
jmp 0x4174f0
mov dword [ebp - 0x54c], 0
mov dword [ebp - 0x550], 0
jmp 0x417415
mov edx, dword [ebp - 0x54c]
add edx, 1
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp - 0x54c]
cmp eax, dword [ebp - 0x118]
jae 0x4174de
mov dword [ebp - 0x32c], pe_nt_image_headers32
mov dword [ebp - 0x114], pe_nt_image_headers32
mov byte [ebp - 0x540], 0
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x540]
push edx
mov eax, dword [ebp - 0x54c]
push eax
mov ecx, dword [ebp - 0x548]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x550], eax
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
push 0
lea edx, [ebp - 0x540]
push edx
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x4174d9
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x548]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4174f0
jmp 0x417406
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00511a80
mov esp, ebp
pop ebp
ret