Function at 0x411414
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xb8
mov eax, 0x47fe32
call fcn.00408d9b
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x411994
push 8
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x84], esi
call fcn.004015a0
pop ecx
xor edi, edi
pop ecx
mov dword [ebp - 0x7c], edi
mov eax, dword [esi]
lea ecx, [ebp - 0x7c]
push ecx
push 0x413eb8
push edi
push edi
push esi
mov dword [ebp - 4], edi
call dword [eax + 0x24]
mov esi, eax
cmp esi, edi
jl 0x431ff5
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0xb4]
push eax
call esi
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0xb4]
push edx
push 0x410f30
push eax
call dword [ecx + 0xc]
cmp eax, edi
mov dword [ebp - 0x74], eax
jl 0x43201d
push 8
pop eax
cmp ax, word [ebp - 0xb4]
jne 0x43222b
push dword [ebp - 0xac]
lea edi, [ebx + 0x58]
mov ecx, edi
call fcn.004113ee
xor eax, eax
mov word [ebp - 0xb4], ax
lea eax, [ebp - 0xc4]
push eax
call esi
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
push 0
lea edx, [ebp - 0xc4]
push edx
push 0x410ecc
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4116d2
push 8
pop eax
cmp ax, word [ebp - 0xc4]
jne 0x4116d2
push dword [ebp - 0xbc]
lea ecx, [ebx + 0x54]
call fcn.004113ee
mov ecx, dword [ebp - 0x80]
xor eax, eax
push ebx
mov word [ebp - 0xc4], ax
call fcn.00411c39
mov edi, eax
test edi, edi
jl 0x432032
lea eax, [ebp - 0xa4]
push eax
call esi
mov eax, dword [ebp - 0x7c]
mov ecx, dword [eax]
xor esi, esi
push esi
lea edx, [ebp - 0xa4]
push edx
push 0x410dd8
push eax
mov byte [ebp - 4], 2
call dword [ecx + 0xc]
cmp eax, esi
mov dword [ebp - 0x74], eax
jl 0x4116e0
push 8
pop ecx
cmp cx, word [ebp - 0xa4]
jne 0x4116e0
lea eax, [ebx + 0x88]
push eax
push dword [ebp - 0x9c]
call dword [sym.imp.ole32.dll_CLSIDFromString]
cmp eax, esi
mov dword [ebp - 0x74], eax
jl 0x43209b
push 8
pop eax
cmp ax, word [ebp - 0xa4]
jne 0x4320c2
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x78]
call fcn.00407b85
mov ecx, dword [ebp - 0x80]
push 0x4116ec
push dword [ebp - 0x78]
mov byte [ebp - 4], 3
call fcn.004119d1
cmp eax, esi
mov dword [ebp - 0x74], eax
jge 0x4320b6
mov dword [ebx + 0x38], esi
push dword [ebx + 0x38]
push eax
push dword [ebp - 0x78]
push 0x411828
push 8
call fcn.004015a0
add esp, 0x14
push dword [ebp - 0x78]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x80]
cmp dword [eax + 0x84], esi
jne 0x4320d9
push 4
pop ecx
mov edi, 0x40f424
lea esi, [ebx + 0x78]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
mov esi, dword [sym.imp.msvcrt.dll_wcsstr]
jne 0x411616
mov eax, dword [ebx + 0x54]
push 0x4117d8
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4320e5
mov eax, dword [ebx + 0x54]
push 0x411788
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x4320f1
push dword [ebp - 0x84]
lea ecx, [ebp - 0x88]
call fcn.0040ccd1
mov eax, dword [ebp - 0x88]
xor edi, edi
cmp eax, edi
je 0x432212
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x8c], edi
mov ecx, dword [eax]
lea edx, [ebp - 0x94]
push edx
push eax
mov byte [ebp - 4], 5
call dword [ecx + 0xc]
cmp eax, edi
jge 0x4320fd
push eax
push 0x411700
push 8
call fcn.004015a0
add esp, 0xc
mov dword [ebp - 0x74], edi
lea ecx, [ebp - 0x94]
call fcn.004030f0
mov eax, dword [ebp - 0x88]
mov byte [ebp - 4], 2
cmp eax, edi
je 0x4116a9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x7c]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x4116c7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x74]
call fcn.00408e35
ret 8
push edi
lea ecx, [ebp - 0x78]
call fcn.00451ec7
jmp 0x43205a
push eax
push 0x411900
jmp 0x4320a1
push esi
push 0x432828
push 1
call fcn.004015a0
mov eax, dword [ebp - 0x7c]
or dword [ebp - 4], 0xffffffff
add esp, 0xc
cmp eax, edi
je 0x432016
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
jmp 0x4116ca
push eax
push 0x432790
push 1
call fcn.004015a0
add esp, 0xc
jmp 0x4116b6
push edi
push 0x4326e8
push 1
call fcn.004015a0
mov eax, dword [ebp - 0x7c]
or dword [ebp - 4], 0xffffffff
add esp, 0xc
test eax, eax
je 0x432053
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x4116ca
mov eax, dword [ebp - 0x78]
and dword [ebp - 0x78], 0
lea ecx, [ebx + 0x54]
push eax
mov byte [ebp - 4], 1
call fcn.004113ee
mov ecx, dword [ebp - 0x80]
push ebx
push dword [ebp - 0x7c]
call fcn.004696ed
test eax, eax
jge 0x43208e
push eax
push 0x432630
push 8
call fcn.004015a0
add esp, 0xc
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x41151e
push eax
push 0x4325b8
push 1
call fcn.004015a0
add esp, 0xc
cmp dword [ebp - 0x74], esi
jge 0x41157c
jmp 0x4320c2
mov dword [ebx + 0x38], 1
jmp 0x4115bc
push dword [ebp - 0x74]
push 0x432518
push 8
call fcn.004015a0
add esp, 0xc
jmp 0x4115db
or dword [ebx + 0x10c], 1
jmp 0x4115ea
or dword [ebx + 0x10c], 1
jmp 0x411616
or dword [ebx + 0x10c], 1
jmp 0x41162b
xor eax, eax
push 0x4e
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push edi
push eax
mov dword [ebp - 0x80], 1
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push 0x4324c8
push dword [ebp - 0x94]
mov dword [ebp - 0x78], 0x50
call esi
cmp eax, edi
mov dword [ebp - 0x74], eax
jle 0x432154
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], edi
jge 0x43216a
push dword [ebp - 0x74]
push 0x432448
push 8
call fcn.004015a0
jmp 0x4321a0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
cmp eax, edi
mov dword [ebp - 0x74], eax
jl 0x432190
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebx + 0x98]
call fcn.0040585c
jmp 0x4321a3
push eax
push 0x4323d8
push 8
call fcn.004015a0
mov dword [ebp - 0x74], edi
add esp, 0xc
test byte [ebx + 0x10c], 1
jne 0x41168a
push 4
pop eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x80]
push eax
push edi
push 0x432388
push dword [ebp - 0x94]
mov dword [ebp - 0x84], edi
call esi
cmp eax, edi
mov dword [ebp - 0x74], eax
jle 0x4321f0
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], edi
jl 0x411687
cmp dword [ebp - 0x84], 1
jne 0x41168a
or dword [ebx + 0x10c], 1
jmp 0x41168a
push 0x80004002
push 0x432300
push 8
call fcn.004015a0
add esp, 0xc
jmp 0x411695
push 0x432268
push 1
call fcn.004015a0
pop ecx
pop ecx
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x7c]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x432257
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 0x80070057
jmp 0x4116ca