Function at 0x415e54
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x46ec87
call fcn.00453e8c
sub esp, 0x524
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0x475628
mov esi, 0x475620
cmp eax, edi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], esi
jne 0x415e85
mov eax, 0x493568
lea ecx, [ebp - 0x1d]
push edi
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00403cfd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x415ea8.71
jmp dword [eax*4 + 0x416cf9]
push 0x489764
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x415eeb
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x48a324
mov eax, dword [ecx + 0x268]
lea esi, [ecx + 0x268]
mov byte [eax + 2], 1
call fcn.0042d267
mov eax, dword [esi]
mov byte [eax + 2], 1
jmp 0x416cc2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
je 0x415eff
push eax
call fcn.00415169
pop ecx
jmp 0x416032
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x48a31c
mov dword [ecx + 0x14], 1
call fcn.0042d267
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1c8], esi
jne 0x415f33
mov eax, 0x493568
lea ecx, [ebp - 0x22]
push edi
push ecx
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1e8]
push edi
push eax
push 0xe
mov byte [ebp - 4], 1
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1e8]
jmp 0x41697a
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xd8], esi
jne 0x415f87
mov eax, 0x493568
lea ecx, [ebp - 0x24]
push edi
push ecx
push eax
lea ecx, [ebp - 0xf8]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push edi
push eax
push 0xc
mov byte [ebp - 4], 2
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0xf8]
jmp 0x41697a
mov esi, dword [ebp + 8]
push 1
pop edi
mov ecx, esi
push edi
call fcn.0042a9f1
mov dword [esi + 0x44], edi
jmp 0x416cc2
mov eax, 0x48a308
mov dword [ebp - 0x238], ebx
mov ecx, eax
mov dword [ebp - 0x218], esi
test ecx, ecx
jne 0x415fef
mov eax, 0x493568
lea ecx, [ebp - 0x17]
push edi
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00403cfd
lea eax, [ebp - 0x238]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00405831
mov ebx, eax
lea ecx, [ebp - 0x238]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00402424
test bl, bl
push 1
je 0x416045
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402424
mov eax, edi
jmp 0x416cea
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x48a300
jmp 0x416cba
mov eax, 0x48a2f0
mov dword [ebp - 0x2d8], ebx
mov ecx, eax
mov dword [ebp - 0x2b8], esi
test ecx, ecx
jne 0x416075
mov eax, 0x493568
lea ecx, [ebp - 0x1f]
push edi
push ecx
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00403cfd
lea eax, [ebp - 0x2d8]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00405831
test eax, eax
jne 0x4160f7
mov eax, 0x48a2ec
mov dword [ebp - 0x148], ebx
mov ecx, eax
mov dword [ebp - 0x128], esi
test ecx, ecx
jne 0x4160ba
mov eax, 0x493568
lea ecx, [ebp - 0x19]
push edi
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.00403cfd
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 5
call fcn.00417009
lea ecx, [ebp - 0x148]
mov bl, al
mov byte [ebp - 4], 4
call fcn.00402424
test bl, bl
je 0x4160f7
mov bl, 1
jmp 0x4160f9
xor bl, bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x2d8]
call fcn.00402424
test bl, bl
je 0x41613e
push 0xffffffffffffffff
lea eax, [ebp - 0x328]
push 5
push eax
lea ecx, [ebp - 0x58]
call fcn.00403f9d
mov ecx, dword [ebp + 8]
push edi
push eax
push 0x10
mov byte [ebp - 4], 6
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x328]
jmp 0x41697a
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov ebx, eax
push 0x48a2dc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41616b
mov esi, 0x496a00
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41620d
mov dword [ebp + 0xc], edi
push 0xf003f
push 0x48a288
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
call fcn.00416df6
test eax, eax
jne 0x41631d
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x52e]
mov word [ebp - 0x530], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push ebx
mov dword [ebp - 0x10], edx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x530]
mov esi, 0x496a00
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4161ff
push dword [ebp + 0xc]
call edi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x41620d
push dword [ebp + 0xc]
call edi
push esi
call fcn.00435112
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 1
mov eax, dword [0x4959b0]
test eax, eax
jne 0x41622b
mov eax, 0x4755fc
push eax
push esi
push 0x4959d0
call fcn.00435235
lea eax, [ebp - 0x23]
push 0
mov ebx, 0x493568
mov edi, 0x4755e0
mov esi, 0x4755d8
push eax
push ebx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x88], esi
call fcn.004011a9
mov eax, dword [0x47565c]
mov byte [ebp - 4], 8
test eax, eax
mov dword [ebp - 0x288], edi
mov dword [ebp - 0x268], esi
jne 0x41627f
mov eax, ebx
lea ecx, [ebp - 0x1b]
push 0
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 9
test eax, eax
mov dword [ebp - 0x198], edi
mov dword [ebp - 0x178], esi
jne 0x4162ac
mov eax, ebx
lea ecx, [ebp - 0x21]
push 0
push ecx
push eax
lea ecx, [ebp - 0x198]
call fcn.004011a9
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x198]
push eax
push 5
mov byte [ebp - 4], 0xa
call fcn.0040a51e
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 9
call fcn.00401093
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 8
call fcn.00401093
and byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00401093
mov ecx, dword [ebp + 8]
push 2
call fcn.0042aa13
jmp 0x416cc2
push dword [ebp + 8]
call fcn.00415169
cmp dword [ebp + 0xc], edi
pop ecx
je 0x416cdc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x416cdc
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push ebx
call esi
movzx eax, word [eax]
sub eax, 0x31
je 0x416398
dec eax
je 0x416386
dec eax
je 0x416369
push edi
push ebx
call esi
push eax
push 0x48a280
jmp 0x416cba
mov edi, dword [ebp + 8]
push ebx
mov byte [edi + 0x264], 1
call esi
push eax
call esi
push eax
mov ecx, edi
call fcn.0042a8dd
jmp 0x416cc2
push edi
push ebx
call esi
push eax
call esi
push eax
push 0x48a278
jmp 0x416cba
push edi
push ebx
call esi
push eax
call esi
mov esi, dword [ebp + 8]
push eax
push 0x489f7c
mov ecx, esi
call fcn.0042d267
mov dword [esi + 0x48], 1
jmp 0x416cc2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x489748
push dword [ebp + 0xc]
call esi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x4163d9
mov byte [edi + 0x25e], 1
push 0x489730
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x416cc2
mov byte [edi + 0x25f], 1
jmp 0x416cc2
mov eax, 0x48a264
mov dword [ebp - 0x300], ebx
mov ecx, eax
mov dword [ebp - 0x2e0], esi
test ecx, ecx
jne 0x416413
mov eax, 0x493568
lea ecx, [ebp - 0x15]
push edi
push ecx
push eax
lea ecx, [ebp - 0x300]
call fcn.00403cfd
lea eax, [ebp - 0x300]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.00405831
mov ebx, eax
lea ecx, [ebp - 0x300]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00402424
test bl, bl
je 0x416cc2
mov eax, dword [ebp + 8]
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x58]
lea esi, [eax + 0x260]
push 0xffffffffffffffff
lea eax, [ebp - 0xd0]
push 9
push eax
mov dword [esi], edi
call fcn.00403f9d
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
neg eax
sbb eax, eax
push 0x48a254
and eax, ecx
mov byte [ebp - 4], 0xc
push eax
call fcn.0040c615
pop ecx
test al, al
pop ecx
je 0x4164a4
or dword [esi], 0xffffffff
jmp 0x4164b8
push 0xa
push esi
lea ecx, [ebp - 0xd0]
call fcn.00416fa4
test al, al
jne 0x4164b8
mov dword [esi], edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0xd0]
jmp 0x41697a
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
jne case.0x415ea8.71
push dword [ebp + 0xc]
mov dword [eax + 0x14], 3
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x100], esi
jne 0x4164fb
mov eax, 0x493568
lea ecx, [ebp - 0x25]
push edi
push ecx
push eax
lea ecx, [ebp - 0x120]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x120]
push edi
push eax
push 8
mov byte [ebp - 4], 0xd
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402424
push edi
push dword [ebp + 0xc]
push 0x48a24c
jmp 0x416cba
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.00417061
add esp, 0xc
test eax, eax
je 0x416573
mov eax, dword [esi + 0x268]
mov cx, word [ebp - 0x14]
mov word [eax + 0x4a], cx
jmp 0x416cc2
push esi
jmp 0x416cd6
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
movzx ecx, word [eax]
sub ecx, 0x31
je 0x4165a8
dec ecx
push edi
push eax
je 0x41659b
push 0x48a244
jmp 0x416cba
call esi
push eax
push 0x48a23c
jmp 0x416cba
push edi
push eax
call esi
push eax
push 0x48a234
jmp 0x416cba
push 0x48a214
push dword [ebp + 0xc]
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
jne 0x4165d6
push edi
push edi
push 0x48a1f0
jmp 0x416cba
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x150], esi
jne 0x4165f4
mov eax, 0x493568
lea ecx, [ebp - 0x16]
push edi
push ecx
push eax
lea ecx, [ebp - 0x170]
call fcn.00403cfd
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x170]
push edi
push eax
push 5
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.00402424
push 2
mov ecx, esi
call fcn.0042aa13
mov dword [esi + 0x44], 1
jmp 0x416cc2
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x493608
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x416cc2
mov eax, dword [ebp + 8]
mov byte [eax + 0x265], 1
jmp 0x416cc2
mov esi, dword [ebp + 0xc]
push 0x48a1d8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416689
push edi
push edi
push 0x48a1c0
jmp 0x416cba
push 0x48a1b4
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
je 0x416cc2
push 0x48956c
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
je 0x416cc2
push 6
push 0x48970c
push esi
call fcn.00454739
add esp, 0xc
test eax, eax
je 0x416cc2
push 0x48a188
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
je 0x416cc2
push edi
push edi
push 0x48a180
jmp 0x416cba
mov esi, dword [ebp + 0xc]
push 0x48a178
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
jne 0x41670c
push edi
push edi
push 0x48a16c
jmp 0x416cba
push 0x4896a8
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
jne 0x41672f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x268]
mov byte [eax + 0x17], 1
jmp 0x416cc2
push 0x48968c
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
jne 0x416752
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x268]
mov byte [eax + 0x18], 1
jmp 0x416cc2
push 0x48a14c
push esi
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
jne 0x416775
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x268]
mov byte [eax + 0x1c], 1
jmp 0x416cc2
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x48a144
mov eax, dword [ecx + 0x268]
lea esi, [ecx + 0x268]
mov byte [eax + 1], 1
call fcn.0042d267
mov eax, dword [esi]
mov byte [eax + 1], 1
jmp 0x416cc2
mov esi, 0x48a124
push esi
call fcn.00453eb4
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x54]
call fcn.00403e17
cmp eax, edi
je 0x416cc2
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push 0x48a114
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4167e7
mov ecx, dword [ebp + 8]
push esi
call fcn.0042a88f
jmp 0x41688f
mov dword [ebp + 0xc], edi
push 0xf003f
push 0x48a288
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xf
call fcn.00416df6
test eax, eax
jne 0x4168a8
xor ebx, ebx
mov ecx, 0x81
lea edi, [ebp - 0x52e]
mov word [ebp - 0x530], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x530]
push eax
call fcn.00435112
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x530]
push eax
call fcn.0042a88f
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x416881
push dword [ebp + 0xc]
call esi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x41688f
push dword [ebp + 0xc]
call esi
mov ecx, dword [ebp + 8]
push 3
call fcn.0042aa13
mov eax, dword [ebp + 8]
mov dword [eax + 0x44], 1
jmp 0x416cc2
push dword [ebp + 8]
call fcn.00415169
cmp dword [ebp + 0xc], edi
pop ecx
je 0x416cdc
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x416cdc
push dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
cmp eax, 0x41
je 0x4169d6
cmp eax, 0x4d
je 0x416984
cmp eax, 0x57
je 0x41692a
cmp eax, 0x61
je 0x4169d6
cmp eax, 0x6d
je 0x416984
cmp eax, 0x77
je 0x41692a
push 0x48a104
push dword [ebp + 0xc]
call fcn.004553f5
pop ecx
test eax, eax
pop ecx
jne 0x416cc2
push eax
push eax
push 0x48a0f4
jmp 0x416cba
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0x1a0], esi
jne 0x416947
mov eax, 0x493568
lea ecx, [ebp - 0x18]
push 0
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c0]
push 0
push eax
push 0xa
mov byte [ebp - 4], 0x11
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c0]
call fcn.00402424
jmp 0x416cc2
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x1f0], esi
jne 0x4169a1
mov eax, 0x493568
lea ecx, [ebp - 0x1a]
push 0
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0
push eax
push 0xb
mov byte [ebp - 4], 0x12
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x210]
jmp 0x41697a
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x240], esi
jne 0x4169f3
mov eax, 0x493568
lea ecx, [ebp - 0x1c]
push 0
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0
push eax
push 9
mov byte [ebp - 4], 0x10
call fcn.0040a3fe
and byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
jmp 0x41697a
mov dword [ebp - 0x10], edi
push 0xf003f
push 0x48a098
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x13
call fcn.00416df6
test eax, eax
jne 0x416a6c
push 0x48a088
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], edi
je 0x416a6c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
push 7
push 0x48a078
push dword [ebp + 0xc]
call fcn.00454739
add esp, 0xc
test eax, eax
je 0x416c48
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push 0x48a068
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x416b3a
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 7
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 4]
call fcn.0040aeaf
cmp dword [eax + 0xc], edi
mov dword [ebp - 0x14], eax
je 0x416ae0
push 0x489370
call fcn.00453eb4
pop ecx
push eax
mov eax, dword [ebp - 0x14]
push 0x489370
lea ecx, [eax + 4]
call fcn.004100c5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], ebx
cmp eax, edi
mov dword [ebp - 0x60], esi
jne 0x416af2
mov eax, 0x493568
lea ecx, [ebp - 0x1e]
push edi
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00403cfd
push dword [0x475630]
lea eax, [ebp - 0x80]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x7c]
and eax, ecx
push edi
push eax
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x14
lea ecx, [eax + 4]
call fcn.0040b095
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x13
call fcn.00402424
mov esi, dword [ebp + 0xc]
push 1
push esi
jmp 0x416c1e
push 0xf003f
push 0x48a288
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00416df6
test eax, eax
jne 0x416c25
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x52e]
mov word [ebp - 0x530], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x104
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x30]
push eax
push edx
push dword [ebp + 0xc]
mov dword [ebp - 0x30], edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], 0
je 0x416bb6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x530]
mov dword [ebp - 0x2b0], ebx
test eax, eax
mov dword [ebp - 0x290], esi
lea eax, [ebp - 0x530]
jne 0x416bd7
mov eax, 0x493568
lea ecx, [ebp - 0x20]
push 0
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00403cfd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2b0]
push 0
push eax
push 7
mov byte [ebp - 4], 0x15
call fcn.0040a3fe
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x13
call fcn.00402424
lea eax, [ebp - 0x530]
push 1
lea esi, [ebp - 0x530]
push eax
push 0x4898ac
jmp 0x416c56
push dword [ebp + 8]
call fcn.00415169
cmp dword [ebp - 0x10], edi
pop ecx
je 0x416cdc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
jmp 0x416cdc
mov eax, dword [ebp + 0xc]
push 1
lea esi, [eax + 0xe]
push esi
push 0x48a054
mov ecx, dword [ebp + 8]
call fcn.0042d267
test esi, esi
je 0x416c75
push esi
push 0x4936d0
mov byte [0x4956fc], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0x10], 0
je 0x416cc2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
jmp 0x416cc2
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 1
jmp 0x416cc2
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
je 0x416ca1
push eax
jmp 0x416cd6
mov dword [eax + 0x14], 4
jmp 0x416cc2
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x48a04c
mov ecx, dword [ebp + 8]
call fcn.0042d267
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402424
push 1
pop eax
jmp 0x416cea
push dword [ebp + 8]
call fcn.00415169
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00402424
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret