Function at 0x414190
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4efba2
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push esi
push edi
mov eax, dword [0x535a40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
cmp ebx, 0xffffffff
jne 0x4143ca
push 0x4f9d20
mov dword [ebp - 0x34], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x34], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x30], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x2c], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x2c], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x28], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x28], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x24], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x24], eax
call fcn.004c8d5f
test esi, esi
mov dword [ebp - 0x14], 0
mov edi, 0x4f9d20
cmovne edi, esi
push edi
call fcn.004c8d00
push 0
mov dword [ebp - 0x14], eax
call fcn.004c8d5f
mov eax, dword [ebp + 0x10]
mov esi, 0x4f9d20
test eax, eax
mov dword [ebp - 0x18], 0
cmovne esi, eax
push esi
call fcn.004c8d00
push 0
mov dword [ebp - 0x18], eax
call fcn.004c8d5f
add esp, 0x40
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call fcn.00409cf0
mov ebx, eax
push edi
mov dword [ebp - 0x1c], 0
call fcn.004c8d00
mov dword [ebp - 0x1c], eax
push 0
call fcn.004c8d5f
push esi
mov dword [ebp - 0x20], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x20], eax
call fcn.004c8d5f
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
call fcn.00409cf0
push 0xffffffffffffffff
push 0
push 0
lea ecx, [ebp - 0x34]
mov edi, dword [ebp + 8]
push ecx
push 1
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xb
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push eax
push 0
push 0xffffffffffffffff
push 0
push edi
call fcn.00405550
add esp, 0x74
mov ebx, eax
mov dword [ebp + 0x18], ebx
push dword [ebp - 0x44]
call fcn.004c8d5f
push dword [ebp - 0x20]
call fcn.004c8d5f
push dword [ebp - 0x1c]
call fcn.004c8d5f
push dword [ebp - 0x3c]
call fcn.004c8d5f
push dword [ebp - 0x18]
call fcn.004c8d5f
push dword [ebp - 0x14]
call fcn.004c8d5f
push dword [ebp - 0x24]
call fcn.004c8d5f
push dword [ebp - 0x10]
call fcn.004c8d5f
push dword [ebp - 0x28]
call fcn.004c8d5f
push dword [ebp - 0x2c]
call fcn.004c8d5f
push dword [ebp - 0x30]
call fcn.004c8d5f
push dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8d5f
mov esi, dword [ebp + 0x14]
add esp, 0x30
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
push eax
push 0x20019
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004086c0
mov eax, dword [ebp - 0x40]
add esp, 0x14
test eax, eax
jne 0x414405
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push ecx
push 0
push 0
push 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call esi
test eax, eax
jne 0x414af8
push 2
call fcn.004c8d7a
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov edx, 2
shr eax, 1
add eax, 2
mov dword [ebp - 4], 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c3a3e
add esp, 8
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
push eax
push ebx
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x40]
call esi
mov eax, dword [ebp - 0x38]
shr eax, 1
mov dword [ebp - 0x38], eax
cmp eax, 2
jbe 0x414aed
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov eax, dword [ebp - 0x38]
mov word [ebx + eax*2], cx
cmp word [ebx], cx
je 0x414aed
nop dword [eax + eax]
push 2
call fcn.004c8d7a
xor ecx, ecx
mov dword [ebp - 0x88], eax
mov word [eax], cx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xd
push eax
push ebx
call fcn.00408a50
mov esi, dword [ebp - 0x20]
push ebx
call fcn.004c8d00
push esi
mov dword [ebp - 0x20], eax
call fcn.004c8d5f
push 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.004069d0
add esp, 0x24
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4145a5
push 0x10
push str.File_not_found:
push eax
call fcn.004c95b0
add esp, 0xc
test eax, eax
jne 0x4145a2
push 0xa
push str.autocheck
push ebx
call fcn.004c95b0
add esp, 0xc
test eax, eax
jne 0x4145a2
push ebx
call fcn.004c8d00
mov esi, eax
push 0
mov dword [ebp - 0x8c], esi
call fcn.004c8d5f
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebx + 0x14]
push eax
call fcn.00408a50
push 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.004069d0
mov edi, dword [ebp - 0x14]
mov ecx, 0x4f9d20
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004c8d00
push edi
mov dword [ebp - 0x14], eax
call fcn.004c8d5f
push dword [ebp - 0xa8]
call fcn.004c8d5f
push esi
call fcn.004c8d5f
mov edi, dword [ebp + 8]
add esp, 0x30
mov eax, dword [ebp - 0x14]
cmp word [eax], 0
je 0x414a46
push 2
call fcn.004c8d7a
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov word [eax], cx
push 2
call fcn.004c8d7a
xor ecx, ecx
mov dword [ebp - 0x70], eax
mov word [eax], cx
push 2
call fcn.004c8d7a
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mov word [eax], cx
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push edi
call fcn.004069c0
push ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
mov eax, dword [ebp + 0x14]
mov ebx, 0x4f9d20
test eax, eax
mov dword [ebp - 0x28], 0
cmovne ebx, eax
push ebx
mov dword [ebp - 0x44], ebx
call fcn.004c8d00
push 0
mov dword [ebp - 0x28], eax
call fcn.004c8d5f
mov ecx, dword [ebp + 0x10]
mov eax, 0x4f9d20
test ecx, ecx
mov dword [ebp - 0x2c], 0
cmovne eax, ecx
push eax
mov dword [ebp - 0x18], eax
call fcn.004c8d00
push 0
mov dword [ebp - 0x2c], eax
call fcn.004c8d5f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x94]
push eax
call fcn.00409cf0
add esp, 0x44
mov esi, eax
push ebx
mov dword [ebp - 0x30], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x30], eax
call fcn.004c8d5f
push dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
call fcn.004c8d00
mov dword [ebp - 0x34], eax
push 0
call fcn.004c8d5f
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x90]
push eax
call fcn.00409cf0
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x19
push ecx
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
push edi
call fcn.00405240
add esp, 0x40
mov bl, al
push dword [ebp - 0x90]
call fcn.004c8d5f
push dword [ebp - 0x34]
call fcn.004c8d5f
push dword [ebp - 0x30]
call fcn.004c8d5f
push dword [ebp - 0x94]
call fcn.004c8d5f
push dword [ebp - 0x2c]
call fcn.004c8d5f
push dword [ebp - 0x28]
call fcn.004c8d5f
push dword [ebp - 0x10]
call fcn.004c8d5f
add esp, 0x1c
test bl, bl
je 0x414a25
cmp dword [ebp + 0x18], 0xffffffff
jne 0x414927
push 0x4f9d20
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x5c], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x5c], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x58], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x58], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x54], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x54], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x50], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x50], eax
call fcn.004c8d5f
push 0x4f9d20
mov dword [ebp - 0x4c], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x4c], eax
call fcn.004c8d5f
mov ebx, dword [ebp - 0x44]
push ebx
mov dword [ebp - 0x48], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x48], eax
call fcn.004c8d5f
push dword [ebp - 0x18]
mov dword [ebp - 0x78], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x78], eax
call fcn.004c8d5f
add esp, 0x40
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x9c]
push eax
call fcn.00409cf0
mov esi, eax
push ebx
mov dword [ebp - 0x74], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x74], eax
call fcn.004c8d5f
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0
call fcn.004c8d00
mov dword [ebp - 0x24], eax
push 0
call fcn.004c8d5f
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x98]
push eax
call fcn.00409cf0
push 0xffffffffffffffff
push 0
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x25
push ecx
push 1
push 0
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push esi
push eax
push 0
push 0xffffffffffffffff
push 0
push edi
call fcn.00405550
add esp, 0x74
mov dword [ebp + 0x18], eax
push dword [ebp - 0x98]
call fcn.004c8d5f
push dword [ebp - 0x24]
call fcn.004c8d5f
push dword [ebp - 0x74]
call fcn.004c8d5f
push dword [ebp - 0x9c]
call fcn.004c8d5f
push dword [ebp - 0x78]
call fcn.004c8d5f
push dword [ebp - 0x48]
call fcn.004c8d5f
push dword [ebp - 0x4c]
call fcn.004c8d5f
push dword [ebp - 0x50]
call fcn.004c8d5f
push dword [ebp - 0x54]
call fcn.004c8d5f
push dword [ebp - 0x58]
call fcn.004c8d5f
push dword [ebp - 0x5c]
call fcn.004c8d5f
push dword [ebp - 0x10]
call fcn.004c8d5f
add esp, 0x30
jmp 0x41492a
mov ebx, dword [ebp - 0x44]
push 0x4f9d20
mov dword [ebp - 0x10], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8d5f
mov edi, dword [ebp - 0xa0]
push ebx
mov dword [ebp - 0x68], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x68], eax
call fcn.004c8d5f
push dword [ebp - 0x18]
mov dword [ebp - 0x64], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x64], eax
call fcn.004c8d5f
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xa4]
push eax
call fcn.00409cf0
mov esi, eax
mov ebx, dword [ebp - 0x3c]
push ebx
mov dword [ebp - 0x60], 0
call fcn.004c8d00
push 0
mov dword [ebp - 0x60], eax
call fcn.004c8d5f
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x2a
push eax
movzx eax, byte [ebp + 0x1c]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push 5
push dword [ebp + 0x18]
push dword [ebp - 0x8c]
push dword [ebp + 8]
call fcn.00405550
add esp, 0x74
push dword [ebp - 0x60]
call fcn.004c8d5f
push dword [ebp - 0xa4]
call fcn.004c8d5f
push dword [ebp - 0x64]
call fcn.004c8d5f
push dword [ebp - 0x68]
call fcn.004c8d5f
push dword [ebp - 0x10]
call fcn.004c8d5f
add esp, 0x14
jmp 0x414a28
mov ebx, dword [ebp - 0x3c]
push dword [ebp - 0x6c]
call fcn.004c8d5f
push dword [ebp - 0x70]
call fcn.004c8d5f
push dword [ebp - 0x1c]
call fcn.004c8d5f
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call fcn.004c8d5f
mov esi, dword [ebp - 0x84]
add esp, 4
mov byte [ebp - 4], 0xc
test esi, esi
je 0x414abf
mov edi, dword [ebp - 0x80]
cmp esi, edi
je 0x414a7b
push dword [esi]
call fcn.004c8d5f
add esi, 4
add esp, 4
cmp esi, edi
jne 0x414a64
mov esi, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x7c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x414a9d
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414b16
push ecx
push esi
call fcn.004c34a9
add esp, 8
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
push dword [ebp - 0x88]
call fcn.004c8d5f
lea eax, [ebx + 2]
push 0
push eax
call fcn.004c56b8
add esp, 0xc
cmp word [eax + 2], 0
lea ebx, [eax + 2]
mov dword [ebp - 0x3c], ebx
je 0x414aed
mov edi, dword [ebp + 8]
jmp 0x4144a0
push dword [ebp - 0x20]
call fcn.004c8d5f
add esp, 4
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004c8caf
int3