Function at 0x4173ff
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x498e21
call fcn.00497330
sub esp, 0x108
cmp dword [edx + 0x14], 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 8], 4
jb 0x417423
mov edx, dword [edx]
lea eax, [ebp + 8]
xor ebx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41760d
cmp dword [ebp + 8], 4
jne 0x417456
cmp dword [ebp - 0x10], 4
jne 0x417456
mov esi, dword [ebp - 0x14]
jmp 0x417677
xor edx, edx
xor ecx, ecx
call fcn.0040c8b0
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0x57]
mov dword [ebp - 0x54], 0x2cc
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], str.C:BooCodeOffergateMultiSetup_ObfuscatedoglibOGLiboglibutils_system_utils.cpp
mov dword [ebp - 0x48], str.ReplacementFor_GetDwordFromRegistry
call fcn.00410470
push ecx
lea ecx, [ebp - 0x57]
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.00410488
push 4
pop edx
lea ecx, [ebp - 0x2f]
mov dword [ebp - 4], ebx
call fcn.00410470
push ecx
lea ecx, [ebp - 0x2f]
push ecx
push eax
lea ecx, [ebp - 0xfc]
call fcn.00410488
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x57]
mov edx, dword [ebp + 8]
call fcn.00410470
push ecx
lea ecx, [ebp - 0x57]
push ecx
push eax
lea ecx, [ebp - 0xe4]
call fcn.00410488
push 9
push str.dataSize
push ecx
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 2
call fcn.0040f4d8
push eax
lea ecx, [ebp - 0xcc]
call fcn.00403b39
push str.__result
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 3
call fcn.004101d3
push eax
lea ecx, [ebp - 0x6c]
call fcn.00403b39
lea eax, [ebp - 0xfc]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0xb4]
call fcn.0040f103
push str.__dataType
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.004101d3
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403b39
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x9c]
call fcn.0040f103
mov dword [ebp - 0x84], ebx
push str.Read_registry_DWORD_error
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], 0xf
mov byte [ebp - 0x84], bl
mov byte [ebp - 4], 7
call fcn.00405c0c
push ecx
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0040c966
lea ecx, [ebp - 0x84]
call fcn.00403b90
lea ecx, [ebp - 0x9c]
call fcn.00403b90
lea ecx, [ebp - 0x2c]
call fcn.00403b90
lea ecx, [ebp - 0xb4]
call fcn.00403b90
lea ecx, [ebp - 0x6c]
call fcn.00403b90
lea ecx, [ebp - 0xcc]
call fcn.00403b90
lea ecx, [ebp - 0xe4]
call fcn.00403b90
lea ecx, [ebp - 0xfc]
call fcn.00403b90
lea ecx, [ebp - 0x114]
jmp 0x417672
xor edx, edx
xor ecx, ecx
call fcn.0040c8b0
mov dword [ebp - 0x40], 0x2d3
mov dword [ebp - 0x3c], 0xd
mov dword [ebp - 0x38], str.C:BooCodeOffergateMultiSetup_ObfuscatedoglibOGLiboglibutils_system_utils.cpp
mov dword [ebp - 0x34], str.ReplacementFor_GetDwordFromRegistry
mov dword [ebp - 0x2c], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
push 0x4b411d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], bl
call fcn.00405c0c
mov dword [ebp - 4], 0xb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.0040c937
lea ecx, [ebp - 0x2c]
call fcn.00403b90
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret