Function at 0x414768
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x74
push 0x421298
call fcn.004208d8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x80], edx
xor edi, edi
mov dword [ebp - 0x74], edi
mov eax, dword [ebp - 0x78]
mov dword [eax], edi
mov eax, dword [ebp - 0x80]
mov dword [eax], edi
mov dword [ebp - 0x68], edi
mov ebx, edi
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x84]
push eax
push 0x30
lea eax, [ebp - 0x54]
push eax
push 2
push dword [ebp - 0x7c]
call dword [sym.imp.ntdll.dll_ZwQueryKey]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
jns 0x4147c4
cmp esi, 0x80000005
jne 0x414983
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x64], edx
test edx, edx
jne 0x4147d8
mov esi, edi
mov dword [ebp - 0x58], esi
jmp 0x414983
mov eax, dword [ebp - 0x3c]
lea ebx, [eax + 2]
cmp ebx, eax
jb 0x4147e6
mov esi, edi
jmp 0x4147ee
or ebx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], esi
test esi, esi
js 0x41481e
mov eax, ebx
mul edx
mov ebx, eax
cmp edx, edi
ja 0x41480d
jb 0x414809
cmp ebx, 0xffffffff
ja 0x41480d
mov esi, edi
jmp 0x414815
or ebx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], esi
mov edx, dword [ebp - 0x64]
mov ecx, edi
test esi, esi
js 0x414980
mov ecx, edx
xor eax, eax
shld eax, ecx, 2
shl ecx, 2
cmp eax, edi
ja 0x414842
jb 0x41483e
cmp ecx, 0xffffffff
ja 0x414842
mov esi, edi
jmp 0x41484a
or ecx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0x58], esi
test esi, esi
js 0x414980
lea eax, [ecx + ebx]
cmp eax, ecx
jb 0x414862
mov ecx, eax
mov esi, edi
jmp 0x41486a
or ecx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0x58], esi
test esi, esi
js 0x414980
push ecx
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
mov dword [ebp - 0x5c], ebx
test ebx, ebx
jne 0x414899
mov esi, 0xc000009a
jmp 0x4147d0
mov eax, dword [ebp - 0x64]
lea eax, [ebx + eax*4]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x1a
cmp eax, 0x1a
jb 0x4148b1
mov esi, edi
jmp 0x4148b9
or eax, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x58], esi
test esi, esi
js 0x414983
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, eax
mov dword [ebp - 0x68], edx
test edx, edx
je 0x41488f
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x60], eax
mov ebx, edi
cmp dword [ebp - 0x64], 0
jbe 0x41496e
jmp 0x4148f4
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x70]
push edx
push edi
push ebx
push dword [ebp - 0x7c]
call dword [sym.imp.ntdll.dll_ZwEnumerateKey]
mov esi, eax
mov dword [ebp - 0x58], esi
cmp esi, 0x8000001a
je 0x41496a
test esi, esi
js 0x414980
mov edx, dword [ebp - 0x68]
lea esi, [edx + 0xc]
mov eax, dword [esi]
add eax, 2
cmp eax, dword [ebp - 0x60]
ja 0x414963
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ebx*4], ecx
push dword [esi]
lea eax, [edx + 0x10]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x6c]
add eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x6c], eax
push 0xfffffffffffffffe
pop eax
sub eax, dword [esi]
add dword [ebp - 0x60], eax
inc ebx
cmp ebx, dword [ebp - 0x64]
jb 0x4148f1
jmp 0x41496e
mov esi, 0xc0000023
jmp 0x41497d
test ebx, ebx
je 0x414980
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
mov dword [eax], ebx
mov esi, edi
mov dword [ebp - 0x58], esi
mov ebx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x41499b
push eax
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
jns 0x4149b4
test ebx, ebx
je 0x4149b4
push ebx
push edi
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp esi, 0xc000017d
jne 0x4149f0
mov dword [ebp - 4], edi
int3
mov eax, esi
call fcn.00420920
ret 4