Function at 0x4119b1
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x418010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x218], ecx
mov byte [ebp - 0x20d], bl
mov dword [ebp - 0x220], 1
cmp esi, ebx
je 0x411d42
cmp eax, ebx
je 0x411d42
cmp ecx, ebx
je 0x411d42
mov byte [eax], bl
push edi
mov byte [ecx], bl
call fcn.0041195c
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x214]
push ecx
push eax
push ebx
push esi
mov esi, 0x80000001
push esi
mov dword [ebp - 0x228], eax
call edi
test eax, eax
jne 0x411b53
cmp dword [ebp - 0x214], ebx
je 0x411b53
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004158b4
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x21c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411b35
cmp dword [ebp - 0x220], 1
jne 0x411b35
mov ecx, 0x406f54
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411ad8
cmp dx, bx
je 0x411ad4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411ad8
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x411ab2
xor eax, eax
jmp 0x411add
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x411aec
mov eax, dword [ebp - 0x218]
mov byte [eax], 1
jmp 0x411b2e
mov ecx, 0x406f58
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411b1d
cmp dx, bx
je 0x411b19
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411b1d
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x411af7
xor eax, eax
jmp 0x411b22
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x411b35
mov eax, dword [ebp - 0x218]
mov byte [eax], bl
mov byte [ebp - 0x20d], 1
push dword [ebp - 0x214]
call dword [entry0]
mov dword [ebp - 0x214], ebx
cmp byte [ebp - 0x20d], bl
jne 0x411d2f
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x228]
push ebx
push 0x406ed0
push esi
call edi
test eax, eax
jne 0x411c09
cmp dword [ebp - 0x214], ebx
je 0x411c09
or dword [ebp - 0x21c], 0xffffffff
push 4
pop esi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push 0x406ec0
push dword [ebp - 0x214]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411be9
cmp dword [ebp - 0x21c], 1
jne 0x411bd2
mov eax, dword [ebp - 0x218]
mov byte [eax], 1
jmp 0x411be2
cmp dword [ebp - 0x21c], ebx
jne 0x411be9
mov eax, dword [ebp - 0x218]
mov byte [eax], bl
mov byte [ebp - 0x20d], 1
push dword [ebp - 0x214]
call dword [entry0]
mov dword [ebp - 0x214], ebx
cmp byte [ebp - 0x20d], bl
jne 0x411d2f
jmp 0x411c0c
push 4
pop esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x228]
push ebx
push dword [ebp - 0x224]
push 0x80000002
call edi
test eax, eax
jne 0x411d2f
cmp dword [ebp - 0x214], ebx
je 0x411d2f
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.004158b4
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x220]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x224], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411d23
cmp dword [ebp - 0x220], 1
jne 0x411d23
mov ecx, 0x406f54
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411cc8
cmp dx, bx
je 0x411cc4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411cc8
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x411ca4
xor eax, eax
jmp 0x411ccd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x411cdc
mov eax, dword [ebp - 0x218]
mov byte [eax], 1
jmp 0x411d1c
mov ecx, 0x406f58
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411d0b
cmp dx, bx
je 0x411d07
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411d0b
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x411ce7
xor eax, eax
jmp 0x411d10
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x411d23
mov eax, dword [ebp - 0x218]
mov byte [eax], bl
mov byte [ebp - 0x20d], 1
push dword [ebp - 0x214]
call dword [entry0]
mov eax, dword [ebp - 0x22c]
mov cl, byte [ebp - 0x20d]
mov byte [eax], cl
xor eax, eax
pop edi
jmp 0x411d47
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00412315
leave
ret 0xc