Function at 0x417880
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x40c
or ecx, 0xffffffff
push ebx
push ebp
push esi
push edi
mov byte [eax], 0
mov edi, str.HKEY_LOCAL_MACHINE
xor eax, eax
mov esi, dword [esp + 0x420]
repne scasb al, byte es:[edi]
mov ebp, dword [sym.imp.MSVCRT.dll_strncmp]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINE
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x4178c7
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x417961
mov edi, str.HKEY_CLASSES_ROOT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_CLASSES_ROOT
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x4178ed
mov ebx, closesocket
jmp 0x417961
mov edi, str.HKEY_CURRENT_USER
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_CURRENT_USER
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x417913
mov ebx, reloc.WSOCK32.dll_accept
jmp 0x417961
mov edi, str.HKEY_USERS
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_USERS
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x417939
mov ebx, reloc.WSOCK32.dll_closesocket
jmp 0x417961
mov edi, str.HKEY_CURRENT_CONFIG
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_CURRENT_CONFIG
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x417ac4
mov ebx, SysStringLen
push 0x400
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.00411fe0
mov ebp, dword [sym.imp.MSVCRT.dll_strchr]
lea edx, [esp + 0x28]
push 0x5c
push edx
call ebp
mov edi, eax
lea eax, [esp + 0x30]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x1c
mov esi, eax
test edi, edi
jne 0x4179a6
lea ecx, [esp + 0x1c]
push 0x2f
push ecx
call ebp
add esp, 8
mov edi, eax
test esi, esi
jne 0x4179b4
push 0x2f
push esi
call ebp
add esp, 8
mov esi, eax
test edi, edi
je 0x417ac4
test esi, esi
je 0x417ac4
test ebx, ebx
je 0x417ac4
lea edx, [esp + 0x14]
mov byte [esi], 0
inc esi
push edx
push 0x20019
inc edi
push 0
push edi
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x417ac4
mov ebx, dword [esp + 0x428]
mov dword [esp + 0x10], 0x400
cmp ebx, 0xffffffff
je 0x417a0d
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x424]
mov edi, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push esi
push edi
mov dword [esp + 0x30], 0
call ebp
test eax, eax
jne 0x417a63
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x424]
test edi, edi
mov byte [eax + esi - 1], 0
je 0x417a56
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret
cmp ebx, 0xffffffff
mov dword [esp + 0x10], 0x400
je 0x417a74
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x424]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push esi
push edi
mov dword [esp + 0x2c], 0
call ebp
test eax, eax
jne 0x417ab9
mov eax, dword [esp + 0x10]
test edi, edi
mov byte [eax + ebx - 1], 0
je 0x417aac
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x40c
ret
test edi, edi
je 0x417ac4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret