Function at 0x411f9b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
push 0xff
push dword [ebp + 0xc]
lea esi, [edi + 0x108]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4121ff
push esi
call fcn.0041852a
pop ecx
test eax, eax
je 0x4121ff
lea eax, [ebp + 0xc]
push eax
push 1
push 0
push 0x4387f4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4121ff
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x988]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x43881c
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x400
call esi
mov ebx, eax
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x588]
push eax
lea eax, [ebp - 4]
push eax
neg ebx
push 0
sbb bl, bl
push 0x43882c
push dword [ebp + 0xc]
inc bl
and bl, 1
mov dword [ebp + 8], 0x400
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x208]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438840
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x100
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1408]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438854
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x104
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1008]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438864
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x400
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x100
push eax
lea eax, [edi + 0xd88]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438870
push dword [ebp + 0xc]
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0xe88]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438880
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x100
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0xf88]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x43888c
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x80
call esi
neg eax
sbb al, al
inc al
and bl, al
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1590]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x438898
push dword [ebp + 0xc]
mov dword [ebp + 8], 0x80
call esi
test eax, eax
jne 0x412187
cmp dword [ebp + 8], 3
jb 0x412187
mov dword [edi + 0x1610], 1
cmp dword [edi + 0x1610], 0
mov dword [ebp + 8], 0x80
je 0x4121c3
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x1510]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x4388a4
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x4121bc
cmp dword [ebp + 8], 0x40
je 0x4121c3
and dword [edi + 0x1610], 0
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test bl, bl
setne al
pop ebx
mov dword [edi + 0x150c], eax
test eax, eax
jne 0x4121e9
push str.Error_reading_cached_update_information_from_the_registry._n
call fcn.0041866b
pop ecx
mov eax, dword [edi + 0x150c]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x412204
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8