Function at 0x411ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x274
mov eax, dword [0x45e068]
xor eax, esp
mov dword [esp + 0x270], eax
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ecx
push ebx
mov ebx, dword [esp + 0x27c]
push ebp
mov ecx, dword [eax + 0xc]
push esi
mov esi, dword [esp + 0x288]
or ecx, 0x20019
mov dword [esp + 0xc], eax
mov eax, dword [eax]
mov dword [esp + 0x20], vtable.ErrorClass.0
mov ebp, dword [esi + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.TextErrorClass.0
mov dword [esp + 0x28], 0x441510
mov dword [esp + 0x2c], 0
mov dword [esp + 0x18], edx
push edi
mov edi, dword [esp + 0x290]
cmp eax, 0x80000004
je 0x411b8a
cmp eax, 0x80000050
je 0x411b8a
lea edx, [esp + 0x14]
push edx
push ecx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411b85
push 0
push ebp
push eax
lea ecx, [esp + 0x30]
call fcn.00414ca0
test al, al
jne 0x411b85
or dword [ebx + 0x14], 0x200
mov ecx, ebx
push 1
push dword [esp + 0x30]
call fcn.00413ed0
mov bl, al
jmp 0x411f0e
mov ebp, dword [esi + 0x10]
jmp 0x411b8e
mov dword [esp + 0x14], eax
movzx edx, word [ebp]
xor esi, esi
mov ecx, ebp
test dx, dx
je 0x411bb6
nop dword [eax + eax]
add ecx, 2
cmp dx, 0x5c
mov eax, ecx
cmovne eax, esi
mov esi, eax
movzx edx, word [ecx]
test dx, dx
jne 0x411ba0
mov eax, dword [ebx]
test esi, esi
mov ecx, ebx
cmovne ebp, esi
push ebp
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x411f0c
or dword [ebx + 0x14], 1
xor ebp, ebp
cmp dword [ebx + 0x24], ebp
jne 0x411c17
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x411bfe
cmp eax, 0xea
jne 0x411c17
lea eax, [esp + 0x48]
mov dword [esp + 0x34], ebp
push eax
lea ecx, [esp + 0x38]
call fcn.0040c020
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x24], eax
mov ecx, dword [edi]
lea eax, [esp + 0x70]
mov dword [esp + 0x6c], eax
xor eax, eax
mov word [esp + 0x70], ax
mov eax, ecx
shr eax, 2
not al
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], 2
mov dword [esp + 0x68], pe_nt_image_headers32
test al, 1
je 0x411d71
mov ecx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [esp + 0x20], ecx
nop dword [eax]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x80]
push ebp
push dword [esp + 0x30]
call ecx
test eax, eax
je 0x411c95
cmp eax, 0xea
jne 0x411d6f
push 1
push dword [esp + 0x70]
mov ecx, ebx
inc ebp
call fcn.00407160
mov esi, eax
test esi, esi
je 0x411ef6
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
add edx, 0x2ac18000
push 0
push 0x989680
adc ecx, 0xfe624e21
push ecx
push edx
call fcn.00420d10
mov ecx, eax
add ecx, 0xffff573f
adc edx, 0xffffffff
test edx, edx
ja 0x411ce8
jb 0x411cea
cmp ecx, 0x7fff573d
jbe 0x411cea
xor eax, eax
mov dword [esi + 0x24], eax
mov eax, dword [edi]
shr eax, 3
not al
test al, 1
je 0x411d50
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
push 0x45b4e0
push 0x20019
mov dword [esp + 0x48], 0
push dword [eax + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], 0
push dword [eax]
call fcn.004107f0
test al, al
je 0x411d45
push dword [edi]
mov ecx, dword [esp + 0x14]
push 0x45b4e0
push 0
push esi
push 0
push dword [esp + 0x54]
call fcn.00411f70
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x411d59
nop dword [eax]
mov ecx, dword [esp + 0x20]
jmp 0x411c60
push eax
call dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], 0
jmp 0x411c60
mov ecx, dword [edi]
shr ecx, 1
xor esi, esi
not cl
test cl, 1
je 0x411e14
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop word [eax + eax]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x54]
push eax
push 0
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push eax
push 0
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x80]
push esi
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x411dcc
cmp eax, 0xea
jne 0x411e14
mov eax, dword [esp + 0x6c]
mov ecx, ebx
cmp word [eax], 0
je 0x411dea
push 0
push eax
call fcn.00407160
mov ecx, eax
test ecx, ecx
je 0x411ef6
mov eax, dword [esp + 0x58]
inc esi
mov dword [ecx + 0x20], eax
lea eax, [esp + 0x24]
push dword [edi]
push eax
push dword [esp + 0x40]
push ecx
push dword [esp + 0x7c]
mov ecx, dword [esp + 0x24]
push dword [esp + 0x28]
call fcn.00411f70
jmp 0x411d90
mov eax, dword [esp + 0x14]
test eax, eax
je 0x411e29
push eax
call dword [esp + 0x20]
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x294]
test esi, esi
je 0x411eac
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x411eac
nop dword [eax + eax]
test byte [ebx + 0x14], 1
je 0x411ea5
push dword [ebx + 0x18]
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.00407200
test al, al
je 0x411ef6
mov ecx, dword [esp + 0x10]
lea eax, [esi - 1]
push eax
push edi
push ebp
push ebx
call fcn.00411ab0
test al, al
je 0x411ef6
mov ecx, ebp
call fcn.00408200
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x411ea5
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 4]
cmp eax, dword [edi + 4]
jb 0x411e92
cmp eax, dword [edi + 0x14]
jbe 0x411e98
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
test esi, esi
jne 0x411e82
mov esi, dword [esp + 0x294]
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x411e40
mov bl, 1
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x411f0e
mov eax, dword [esp + 0x5c]
shr eax, 5
test al, 1
je 0x411edb
mov eax, dword [esp + 0x64]
imul eax, dword [esp + 0x68]
test eax, eax
je 0x411edb
nop
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x411ed0
mov al, byte [esp + 0x5c]
test al, 2
je 0x411efa
push 0x8000
push 0
push dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x411f0e
xor bl, bl
jmp 0x411eae
test al, 1
je 0x411f0e
push dword [esp + 0x6c]
call fcn.00426f61
add esp, 4
jmp 0x411f0e
xor bl, bl
cmp dword [esp + 0x30], 0
mov dword [esp + 0x24], vtable.TextErrorClass.0
je 0x411f39
push dword [esp + 0x2c]
call fcn.00426f61
add esp, 4
mov dword [esp + 0x2c], 0x441510
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], vtable.ErrorClass.0
test eax, eax
je 0x411f4e
push eax
call dword [esp + 0x20]
mov ecx, dword [esp + 0x280]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420bdf
add esp, 0x274
ret 0x10