Function at 0x417042
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x46b7a7
call fcn.0042dbd7
lea ecx, [ebp - 0x10]
xor ebx, ebx
call fcn.0040699e
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
call fcn.0040c993
lea ecx, [ebp - 0x18]
call fcn.0040699e
lea ecx, [ebp - 0x30]
call fcn.0040699e
lea ecx, [ebp - 0x2c]
call fcn.0040699e
push 4
push str.IN_Operations::_RegCompareValue_:_Entering__RegCompareValue__
mov ecx, 0x493f4c
mov byte [ebp - 4], 4
mov dword [ebp - 0x34], ebx
call fcn.0040c5b8
lea eax, [ebp - 0x34]
mov esi, 0x46f9b8
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00414d8f
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00413753
mov ecx, dword [ebp - 0x3c]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00406c57
mov edi, 0x487527
jmp 0x41711b
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.00413753
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00414d8f
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00413753
mov ecx, dword [ebp - 0x3c]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00406c57
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00413872
pop ecx
pop ecx
test al, al
jne 0x4170e2
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
mov esi, dword [ebp - 0x30]
mov eax, dword [eax - 0xc]
sub eax, dword [esi - 0xc]
dec eax
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00413e8b
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call fcn.00413753
mov ecx, dword [ebp - 0x3c]
mov byte [ebp - 4], 4
lea ecx, [ecx - 0x10]
call fcn.00406c57
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
push dword [eax - 0xc]
call fcn.00406be3
push dword [esi - 0xc]
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.00406be3
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4171d6
push eax
lea eax, [ebp - 0x10]
push str.RegOpenKeyEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x10]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x4171bf
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406aae
push 7
push dword [ebp - 0x10]
mov ecx, 0x493f4c
call fcn.0040c5b8
mov esi, dword [ebp - 0x28]
jmp 0x417335
cmp dword [ebp - 0x14], 0
jne 0x4171e5
push 4
push str.IN_Operations::_RegCompareValue_:_Opened_key_is_NULL
jmp 0x4171c4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x417241
push eax
lea eax, [ebp - 0x10]
push str.RegQueryValueEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x10]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x417225
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406aae
push 7
push dword [ebp - 0x10]
mov edi, 0x493f4c
mov ecx, edi
call fcn.0040c5b8
push 4
push str.IN_Operations::_RegCompareValue_:_Unable_to_get_size_of_registry_value
mov ecx, edi
jmp 0x4171c9
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x417254
push 4
push str.IN_Operations::_RegCompareValue_:_Registry_value_is_empty
jmp 0x4171c4
inc eax
push eax
call fcn.00432c26
mov esi, eax
pop ecx
test esi, esi
jne 0x41726e
push 6
push str.Operations::_RegCompareValue__szRegValue
jmp 0x41732b
cmp dword [ebp - 0x1c], 1
jne 0x4172cc
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x4172fe
push eax
lea eax, [ebp - 0x10]
push str.RegQueryValueEx___failed._Error:__d
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x10]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x4172b0
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00406aae
push 7
push dword [ebp - 0x10]
mov edi, 0x493f4c
mov ecx, edi
call fcn.0040c5b8
push 4
push str.IN_Operations::_RegCompareValue_:_Unable_to_get_registry_value
mov ecx, edi
jmp 0x417330
cmp dword [ebp - 0x1c], 4
jne 0x417324
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x41728a
mov eax, dword [ebp - 0x20]
push 9
inc eax
push eax
push esi
push dword [ebp - 0x38]
call fcn.00438189
add esp, 0x10
cmp byte [ebp + 0x14], 0
push dword [ebp + 0x10]
push esi
je 0x417317
call fcn.00438e14
pop ecx
pop ecx
test eax, eax
je 0x417335
mov bl, 1
jmp 0x417335
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417335
jmp 0x417313
push 4
push str.IN_Operations::_RegCompareValue_:_Invalid_registry_value_type
mov ecx, 0x493f4c
call fcn.0040c5b8
cmp dword [ebp - 0x14], 0
je 0x417344
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41734f
push esi
call fcn.00432c0b
pop ecx
mov ecx, dword [ebp - 0x2c]
lea ecx, [ecx - 0x10]
call fcn.00406c57
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx - 0x10]
call fcn.00406c57
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.00406c57
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00406c57
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00406c57
mov al, bl
call fcn.0042dba0
ret