Function at 0x411beb
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x4c143c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x412010
mov eax, dword [edi + 0xc]
test eax, eax
je 0x412010
cmp byte [ecx], 0
je 0x412010
cmp byte [eax], 0
je 0x412010
mov esi, dword [edi + 0x10]
test esi, esi
je 0x411c3b
cmp byte [esi], 0
je 0x412010
xor ebx, ebx
cmp dword [edi + 0x18], ebx
je 0x411c4c
mov eax, 0xb7
jmp 0x412013
push 0x140
lea eax, [ebp - 0x248]
mov dword [ebp - 0x26c], ebx
push ebx
push eax
mov dword [ebp - 0x260], ebx
call fcn.0045b1d0
push 0x104
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0045b1d0
add esp, 0x18
test esi, esi
je 0x411ca0
push esi
call fcn.00461890
mov esi, eax
mov dword [esp], 0x494cdc
call fcn.00461890
add eax, esi
pop ecx
mov dword [ebp - 0x260], eax
push 1
mov ecx, edi
call fcn.00410633
and dword [ebp - 0x25c], 0
mov esi, eax
mov eax, dword [edi + 0xa8]
and dword [ebp - 0x268], 0
push 0xa
pop ebx
push 4
mov dword [ebp - 0x264], eax
pop eax
push 0x494ce0
push 0x494cfc
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x258], eax
call fcn.004660fd
pop ecx
pop ecx
test eax, eax
jne 0x411d03
mov ebx, dword [edi + 0xa8]
jmp 0x411da8
push 0x494ce0
push 0x494d04
call fcn.004660fd
pop ecx
pop ecx
test eax, eax
je 0x411da8
mov ebx, 0x494ce0
push ebx
push ebx
call fcn.004660fd
pop ecx
pop ecx
test eax, eax
jne 0x411d36
mov ebx, dword [edi + 0xb4]
jmp 0x411d6e
push ebx
push 0x494d10
call fcn.004660fd
pop ecx
pop ecx
test eax, eax
jne 0x411d4f
mov ebx, dword [edi + 0xac]
jmp 0x411da8
push ebx
push 0x494d1c
call fcn.004660fd
pop ecx
pop ecx
test eax, eax
jne 0x411d68
mov ebx, dword [edi + 0xb0]
jmp 0x411da8
mov ebx, dword [ebp - 0x268]
test esi, esi
je 0x411da8
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0
push 0x494ce0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411da8
cmp dword [ebp - 0x24c], 4
jne 0x411da8
mov ebx, dword [ebp - 0x25c]
lea eax, [ebp - 0x250]
mov ecx, edi
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00412238
push dword [edi + 0x14]
call fcn.00461890
push dword [edi + 0xc]
mov esi, eax
call fcn.00461890
push 0x494cec
add esi, eax
call fcn.00461890
push 0x494bbc
add esi, eax
call fcn.00461890
mov ecx, dword [ebp - 0x260]
add eax, esi
add ecx, 4
add esp, 0x10
add eax, ecx
mov dword [ebp - 0x24c], eax
call fcn.00459690
mov esi, esp
test esi, esi
je 0x411ff5
push dword [ebp - 0x24c]
push 0
push esi
call fcn.0045b1d0
push dword [edi + 0xc]
push dword [edi + 0x14]
push 0x494bc0
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
cmp dword [edi + 0x10], 0
je 0x411e58
push 0x494cdc
push dword [ebp - 0x24c]
push esi
call fcn.00465e4f
push dword [edi + 0x10]
push dword [ebp - 0x24c]
push esi
call fcn.00465e4f
add esp, 0x18
lea eax, [ebp - 0x108]
push 0x494cec
cmp ebx, dword [ebp - 0x250]
jb 0x411ed1
push 0
push str._0.3u_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x24c]
push esi
call fcn.00465e4f
add esp, 0x1c
mov ecx, edi
push 2
push esi
call fcn.00411aff
and dword [ebp - 0x258], 0
mov ebx, eax
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x411ec5
push 4
lea eax, [ebp - 0x258]
push eax
push 4
push 0
push 0x494ce0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
and dword [edi + 0xb4], 0
jmp 0x412001
push ebx
push str._0.3u_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x24c]
push esi
call fcn.00465e4f
add esp, 0x1c
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x411f18
push 2
push esi
mov ecx, edi
call fcn.00411aff
mov ebx, eax
jmp 0x411ffb
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x264]
jae 0x411f31
push 3
jmp 0x411f09
push dword [edi + 0xc]
lea eax, [ebx + 1]
cmp eax, dword [ebp - 0x250]
push dword [edi + 0x14]
sbb ecx, ecx
and ecx, eax
push 0x494bc0
push esi
mov dword [ebp - 0x250], ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [ebp - 0x24c]
add esp, 0x10
cmp dword [edi + 0x10], 0
je 0x411f7e
push 0x494cdc
push ebx
push esi
call fcn.00465e4f
push dword [edi + 0x10]
push ebx
push esi
call fcn.00465e4f
add esp, 0x18
push 0x494cec
push dword [ebp - 0x250]
lea eax, [ebp - 0x108]
push str._0.3u_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x108]
push eax
push ebx
push esi
call fcn.00465e4f
add esp, 0x1c
mov ecx, edi
push 2
push esi
call fcn.00411aff
mov esi, dword [ebp - 0x254]
mov ebx, eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x258], eax
test esi, esi
je 0x411fed
push 4
lea eax, [ebp - 0x258]
push eax
push 4
push 0
push 0x494ce0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x250]
mov dword [edi + 0xb4], eax
jmp 0x412001
mov ebx, dword [ebp - 0x26c]
mov esi, dword [ebp - 0x254]
test esi, esi
je 0x41200c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x412013
push 0x57
pop eax
lea esp, [ebp - 0x278]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00458eeb
leave
ret