Function at 0x419d70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4d044c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x419dca
push 0x14
lea eax, [ebx + 1]
push str.:WINDOWSSysnative_
push eax
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x419dca
lea eax, [ebx + 0x15]
push eax
movsx eax, byte [ebx]
push eax
lea eax, [ebp - 0x108]
push str._c:WINDOWSSystem32_s
push eax
call esi
add esp, 0x10
lea ebx, [ebp - 0x108]
test edi, edi
je 0x419e04
push 0x14
lea eax, [edi + 1]
push str.:WINDOWSSysnative_
push eax
call fcn.0048e4b1
add esp, 0xc
test eax, eax
jne 0x419e04
lea eax, [edi + 0x15]
push eax
movsx eax, byte [edi]
push eax
lea eax, [ebp - 0x20c]
push str._c:WINDOWSSystem32_s
push eax
call esi
add esp, 0x10
lea edi, [ebp - 0x20c]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
push eax
push 0xf003f
xor esi, esi
mov dword [ebp - 0x218], 0
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419f82
mov edx, ebx
mov dword [ebp - 0x214], esi
lea ecx, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x419e50
sub edx, ecx
test edi, edi
je 0x419e77
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x210], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419e68
sub ecx, dword [ebp - 0x210]
jmp 0x419e79
xor ecx, ecx
lea eax, [ecx + 0xc]
add eax, edx
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x419eaf
cmp eax, 2
jne 0x419f82
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x210]
cmp eax, 0x10000
jae 0x419f82
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x210], esi
test esi, esi
je 0x419f82
lea eax, [ebp - 0x214]
push eax
push esi
lea eax, [ebp - 0x220]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419f13
dec esi
add esi, dword [ebp - 0x214]
push ebx
push str.___s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esi, eax
add esp, 0xc
mov byte [esi], 0
inc esi
test edi, edi
je 0x419f3f
push edi
push str.____s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add esi, eax
mov byte [esi], 0
inc esi
mov byte [esi], 0
sub esi, dword [ebp - 0x210]
inc esi
push esi
mov dword [ebp - 0x214], esi
mov esi, dword [ebp - 0x210]
push esi
push 7
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
mov edx, 1
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x21c], ecx
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x419f93
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x419fa7
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jne 0x419ff7
xor esi, esi
test ebx, ebx
je 0x419fe1
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419fb6
sub ecx, edx
lea eax, [ecx*2 + 2]
push eax
call fcn.0048b928
mov esi, eax
add esp, 4
test esi, esi
je 0x419fe1
push 0xffffffffffffffff
push ebx
push esi
call fcn.0048c669
add esp, 0xc
xor edx, edx
mov ecx, esi
call fcn.004196c0
test esi, esi
je 0x419ff7
push esi
call fcn.0048b923
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x21c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004606ac
mov esp, ebp
pop ebp
ret