Function at 0x417a11
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4231e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], ecx
and dword [ebp - 0x22c], 0
and dword [ebp - 0x214], 0
cmp dword [ebp + 8], 0
jne 0x417a47
xor eax, eax
jmp 0x417efd
mov eax, dword [ebp - 0x210]
add eax, 8
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jge 0x417a70
xor eax, eax
jmp 0x417efd
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 1
push dword [ebp + 8]
push 0x401d6c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417efb
push dword [ebp - 0x214]
call fcn.004179b1
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x417adf
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 8
jmp 0x417aec
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 1
mov dword [ebp - 0x218], 0x208
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x402fa4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x417bb8
push 3
push 0x405110
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x417bb3
push 0x405118
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417ba6
push 0x405128
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417ba6
push 0x40513c
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417ba6
push 0x405150
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417ba6
push 0x405164
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x417bb3
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 7
jmp 0x417c42
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x402fc4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x417c42
push 3
push 0x405110
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x417c42
push 0x405178
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417c38
push 0x40518c
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417c38
push 0x405198
lea eax, [ebp - 0x206]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x417c42
mov eax, dword [ebp - 0x210]
and dword [eax + 0x70], 0
lea eax, [ebp - 0x21c]
push eax
push 0x4051ac
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417c99
cmp dword [ebp - 0x220], 0
je 0x417c76
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 0xc
jmp 0x417c83
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 6
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417e65
lea eax, [ebp - 0x21c]
push eax
push 0x4051c0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417cf0
cmp dword [ebp - 0x220], 0
je 0x417ccd
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 0xa
jmp 0x417cda
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 3
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417e65
lea eax, [ebp - 0x21c]
push eax
push 0x4051d0
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417d47
cmp dword [ebp - 0x220], 0
je 0x417d24
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 9
jmp 0x417d31
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 2
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417e65
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x218], 0x28
lea eax, [ebp - 0x218]
push eax
mov eax, dword [ebp - 0x210]
add eax, 0x18
push eax
push 0x4051e8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x417e65
mov eax, dword [ebp - 0x210]
add eax, 0x18
push eax
push 0x4051f8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417df8
cmp dword [ebp - 0x220], 0
je 0x417ddb
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 8
jmp 0x417de8
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 1
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417e65
mov eax, dword [ebp - 0x210]
add eax, 0x18
push eax
push 0x40521c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417e65
cmp dword [ebp - 0x220], 0
je 0x417e4c
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 9
jmp 0x417e59
mov eax, dword [ebp - 0x210]
mov dword [eax + 0x70], 2
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x210]
mov ecx, dword [ecx + 0x70]
mov dword [eax + 0x6c], ecx
mov dword [ebp - 0x218], 0x208
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x405238
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x417ec7
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x405258
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x417edf
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x210]
add ecx, 0x80
call sub.MFC42u.dll_CString::operator_1
cmp dword [ebp - 0x214], 0
je 0x417ef4
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x417efd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f3a0
leave
ret 4