Function at 0x411925
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x433f06
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x442080]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push esi
push edi
mov eax, dword [0x442080]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
lea eax, [esp + 0x28]
mov esi, ecx
push 0x439fb8
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
call fcn.00413ad1
mov eax, dword [eax]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [esp + 0x24]
setne byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00401053
cmp byte [esp + 0x13], bl
je 0x4119bd
xor al, al
jmp 0x411cfb
mov eax, dword [0x44970c]
mov ecx, 0x44970c
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
push ebx
lea eax, [esp + 0x18]
push 0x43a044
push eax
mov dword [esp + 0x274], ebx
call fcn.00413ad1
add esp, 0xc
mov byte [esp + 0x268], 1
push dword [eax]
lea eax, [esp + 0x24]
push dword [esp + 0x1c]
push eax
call fcn.0041175e
lea edi, [esp + 0x24]
mov byte [esp + 0x268], 2
call fcn.004040c1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
call fcn.00401053
mov byte [esp + 0x268], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00401053
xor eax, eax
push 0x206
mov word [esp + 0x50], ax
lea eax, [esp + 0x52]
push ebx
push eax
call fcn.0041ca10
add esp, 0xc
xor edi, edi
mov dword [esp + 0x20], ebx
cmp dword [esi + 0x34], ebx
jbe 0x411a7a
cmp edi, dword [esi + 0x34]
jae 0x411aa2
mov eax, dword [esi + 0x30]
lea eax, [eax + edi*4]
mov eax, dword [eax]
cmp eax, ebx
je 0x411a74
mov esi, eax
call fcn.00411719
mov esi, dword [esp + 0x1c]
inc edi
cmp edi, dword [esi + 0x34]
jb 0x411a5d
add esi, 0x30
mov eax, dword [esi]
cmp eax, ebx
je 0x411a8c
push eax
call fcn.0041b196
pop ecx
mov dword [esi], ebx
push 0x104
lea eax, [esp + 0x50]
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push ebx
jmp 0x411cd1
push 0x80070057
call fcn.00401000
inc dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
lea eax, [esp + 0x58]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411cc3
push 0x18
call fcn.0041ad6c
pop ecx
cmp eax, ebx
je 0x411ae9
mov edi, eax
call fcn.00411618
mov esi, eax
jmp 0x411aeb
xor esi, esi
push ebx
lea eax, [esp + 0x2c]
push 0x438f14
push eax
mov dword [esp + 0x50], esi
call fcn.00413ad1
add esp, 0xc
mov byte [esp + 0x268], 3
push dword [eax]
lea eax, [esp + 0x34]
push dword [esp + 0x18]
push eax
call fcn.0041175e
lea edi, [esi + 4]
mov byte [esp + 0x268], 4
call fcn.004040c1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
call fcn.00401053
mov byte [esp + 0x268], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
call fcn.00401053
push ebx
lea eax, [esp + 0x3c]
push 0x43a068
push eax
call fcn.00413ad1
add esp, 0xc
mov byte [esp + 0x268], 5
push dword [eax]
lea eax, [esp + 0x44]
push dword [esp + 0x18]
push eax
call fcn.0041175e
lea edi, [esi + 8]
mov byte [esp + 0x268], 6
call fcn.004040c1
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
call fcn.00401053
mov byte [esp + 0x268], bl
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
call fcn.00401053
push ebx
lea eax, [esp + 0x30]
push 0x43a074
push eax
call fcn.00413ad1
add esp, 0xc
mov byte [esp + 0x268], 7
push dword [eax]
lea eax, [esp + 0x4c]
push dword [esp + 0x18]
push eax
call fcn.0041175e
lea edi, [esi + 0xc]
mov byte [esp + 0x268], 8
call fcn.004040c1
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
call fcn.00401053
mov byte [esp + 0x268], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
call fcn.00401053
push ebx
lea eax, [esp + 0x40]
push 0x43a098
push eax
call fcn.00413ad1
add esp, 0xc
mov byte [esp + 0x268], 9
push dword [eax]
lea eax, [esp + 0x38]
push dword [esp + 0x18]
push eax
call fcn.0041175e
lea edi, [esi + 0x10]
mov byte [esp + 0x268], 0xa
call fcn.004040c1
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
call fcn.00401053
mov byte [esp + 0x268], bl
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
call fcn.00401053
lea eax, [esp + 0x4c]
push eax
push esi
call fcn.00401aa8
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00404102
neg eax
sbb al, al
inc al
mov byte [esi + 0x14], al
je 0x411ca8
mov edi, dword [esp + 0x1c]
add edi, 4
lea eax, [esi + 4]
call fcn.004040c1
mov edi, dword [esp + 0x1c]
add edi, 8
lea eax, [esi + 8]
call fcn.004040c1
mov edi, dword [esp + 0x1c]
add edi, 0xc
mov eax, esi
call fcn.004040c1
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x20]
add eax, 0x30
call fcn.00412f99
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x28]
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x411aac
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.00401053
mov al, 1
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.0041a944
mov esp, ebp
pop ebp
ret