Function at 0x41176e
Capabilities:
Access the windows event log
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2e4]
sub esp, 0x364
mov eax, dword [0x414050]
push ebx
xor ebx, ebx
push esi
push edi
push 0x409f34
push 0xa
mov dword [ebp + 0x2e0], eax
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x6c], ebx
call fcn.0040adfe
cmp dword [0x41646c], ebx
pop ecx
pop ecx
mov byte [ebp + 0x1d4], bl
mov byte [ebp + 0x2dc], bl
mov byte [ebp + 0xcc], bl
je 0x41185e
push 0x409ec8
push 0xa
call fcn.0040adfe
mov eax, dword [0x416450]
xor esi, esi
pop ecx
inc esi
cmp eax, ebx
pop ecx
je 0x41184b
push esi
push eax
push 5
push esi
push dword [0x41643c]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov edi, eax
cmp edi, ebx
jne 0x41181d
push 0x409e78
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
mov dword [0x416460], esi
jmp 0x41184b
push edi
push 0x409e20
push 0x14
call fcn.0040adfe
add esp, 0xc
push edi
push 0x400007d4
call fcn.0040a987
push 0x409db0
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
call fcn.00410231
push 0x409d60
push 0xa
call fcn.0040adfe
mov eax, esi
jmp 0x412769
mov esi, 0x401594
push esi
push 0x409d38
push 0xa
call fcn.0040adfe
xor edi, edi
add esp, 0xc
inc edi
cmp dword [0x416468], ebx
je 0x411889
cmp dword [0x414040], ebx
mov dword [ebp - 0x3c], edi
jne 0x41188c
mov dword [ebp - 0x3c], ebx
cmp dword [0x41643c], ebx
jne 0x4118d1
push 0x41643c
push 0x2001b
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
je 0x4118d1
push esi
push 0x409cf0
push 0x14
call fcn.0040adfe
add esp, 0xc
push esi
push 0x800003e8
call fcn.0040a987
jmp 0x412724
cmp dword [0x41645c], ebx
jne 0x411942
push 0x409ca0
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
mov dword [0x41645c], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [0x416450], eax
jne 0x411933
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push 0x409c48
push 0x14
call fcn.0040adfe
add esp, 0xc
push esi
push 0x800007d3
call fcn.0040a987
push 0x409be0
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
jmp 0x411942
push eax
push 0x409b98
push ebx
call fcn.0040adfe
add esp, 0xc
mov eax, dword [0x416450]
cmp eax, ebx
je 0x4119a6
push edi
push eax
push 5
push edi
push dword [0x41643c]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov esi, eax
cmp esi, ebx
jne 0x411978
push 0x409e78
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
mov dword [0x416460], edi
jmp 0x4119a6
push esi
push 0x409e20
push 0x14
call fcn.0040adfe
add esp, 0xc
push esi
push 0x400007d4
call fcn.0040a987
push 0x409db0
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
call fcn.00410231
or dword [0x414048], 0xffffffff
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xd0]
push eax
mov dword [ebp - 0x40], ebx
mov edi, 0x104
mov dword [0x41404c], 0x270f
push ebx
jmp 0x411e5e
cmp esi, ebx
jne 0x411eba
lea eax, [ebp + 0xd0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4119f1
sub eax, edx
push eax
lea eax, [ebp + 0xd0]
push eax
push 0x409b58
push ebx
call fcn.0040adfe
mov eax, dword [ebp - 0x50]
add esp, 0x10
dec eax
je 0x411d44
sub eax, 3
je 0x411a44
lea eax, [ebp + 0xd0]
push eax
push 0x409b1c
push ebx
call fcn.0040adfe
push 0x409ad0
push ebx
call fcn.0040adfe
add esp, 0x14
jmp 0x411e3d
push 0x409a98
push ebx
call fcn.0040adfe
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
lea eax, [ebp + 0xd0]
push 0x401578
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x411a8e
push 0x409a60
push ebx
call fcn.0040adfe
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x414010], eax
mov dword [ebp - 0x5c], 1
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x401e7c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411acb
push 0x409a20
push ebx
call fcn.0040adfe
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x74], eax
sete cl
mov dword [0x41403c], ecx
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x409a14
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411b03
push 0x4099d4
push ebx
call fcn.0040adfe
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x416438], eax
mov dword [ebp - 0x78], 1
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x4099c8
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411b40
push 0x409978
push ebx
call fcn.0040adfe
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x80], eax
sete cl
mov dword [0x416454], ecx
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x409960
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411b7d
push 0x409900
push ebx
call fcn.0040adfe
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x6c], eax
sete cl
mov dword [0x414040], ecx
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x407504
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411bba
push 0x4098a0
push ebx
call fcn.0040adfe
xor eax, eax
pop ecx
inc eax
pop ecx
xor ecx, ecx
cmp dword [ebp + 0x1d8], eax
mov dword [ebp - 0x7c], eax
sete cl
mov dword [0x416468], ecx
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x409890
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411bf2
push 0x409830
push ebx
call fcn.0040adfe
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x416420], eax
mov dword [ebp - 0x60], 1
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x409820
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411c2a
push 0x4097c0
push ebx
call fcn.0040adfe
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x416410], eax
mov dword [ebp - 0x4c], 1
jmp 0x411e3d
cmp dword [0x414044], ebx
je 0x411c63
lea eax, [ebp + 0xd0]
push 0x4054bc
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411c63
push 0x409770
push ebx
call fcn.0040adfe
mov eax, dword [ebp + 0x1d8]
pop ecx
pop ecx
mov dword [0x416688], eax
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x40975c
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411cc1
push 0x409700
push ebx
call fcn.0040adfe
mov esi, dword [ebp + 0x1d8]
push esi
push 0x4096b0
push ebx
call fcn.0040adfe
add esp, 0x14
cmp esi, ebx
je 0x411cb4
cmp esi, 0x418937
ja 0x411cb4
imul esi, esi, 0x3e8
mov dword [0x414048], esi
jmp 0x411e3d
push dword [0x414048]
push 0x409668
jmp 0x411d13
lea eax, [ebp + 0xd0]
push 0x409650
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411d21
push 0x409608
push ebx
call fcn.0040adfe
mov esi, dword [ebp + 0x1d8]
push esi
push 0x4095b0
push ebx
call fcn.0040adfe
add esp, 0x14
cmp esi, 0x7fffffff
ja 0x411d08
mov dword [0x41404c], esi
jmp 0x411e3d
push dword [0x41404c]
push 0x409568
push ebx
call fcn.0040adfe
add esp, 0xc
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push eax
push 0x409b1c
push ebx
call fcn.0040adfe
lea eax, [ebp + 0x1d8]
push eax
push 0x409528
jmp 0x411e34
push 0x4094f0
push ebx
call fcn.0040adfe
mov esi, dword [sym.imp.msvcrt.dll__stricmp]
lea eax, [ebp + 0xd0]
push 0x4094dc
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x411d97
push 0x40949c
push ebx
call fcn.0040adfe
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x416470
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [ebp - 0x70], 1
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x401584
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411dd8
push 0x409460
push ebx
call fcn.0040adfe
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x414068
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [0x414278], 1
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push 0x409450
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x411e16
push 0x409414
push ebx
call fcn.0040adfe
push edi
lea eax, [ebp + 0x1d8]
push eax
push 0x416578
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0x14
mov dword [ebp - 0x68], 1
jmp 0x411e3d
lea eax, [ebp + 0xd0]
push eax
push 0x409b1c
push ebx
call fcn.0040adfe
lea eax, [ebp + 0x1d8]
push eax
push 0x4093d4
push ebx
call fcn.0040adfe
add esp, 0x18
inc dword [ebp - 0x40]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0xd0]
push eax
push dword [ebp - 0x40]
push dword [0x41643c]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x54], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
cmp esi, 0x103
jne 0x4119e0
cmp dword [0x416460], ebx
jne 0x411e8b
call fcn.00410293
push 0x409388
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x70], ebx
pop ecx
pop ecx
jne 0x411ef0
push 0x409338
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0xc00003fa
call fcn.0040a918
jmp 0x412724
push dword [ebp - 0x40]
push esi
push 0x4092d8
push 0x14
call fcn.0040adfe
add esp, 0x10
push dword [ebp - 0x40]
push esi
push 0xc00003f8
call fcn.0040aa6d
mov dword [0x416460], ebx
call fcn.00410231
call fcn.00410293
jmp 0x412724
push 0x409290
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x68], ebx
pop ecx
pop ecx
jne 0x411f17
push 0x409240
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0xc00003fb
jmp 0x411eb0
push 0x4091f8
push ebx
call fcn.0040adfe
cmp dword [0x414278], ebx
pop ecx
pop ecx
push 0x414068
jne 0x411f38
push 0x409198
jmp 0x411f3d
push 0x409148
push ebx
call fcn.0040adfe
add esp, 0xc
push 0x409100
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x5c], ebx
pop ecx
pop ecx
push dword [0x414010]
jne 0x411f65
push 0x4090a0
jmp 0x411f6a
push 0x409050
push ebx
call fcn.0040adfe
add esp, 0xc
push 0x409008
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x78], ebx
pop ecx
pop ecx
jne 0x411f9e
mov esi, 0x1000
push esi
push 0x408fa8
push ebx
call fcn.0040adfe
mov dword [0x416438], esi
jmp 0x411faf
push dword [0x416438]
push 0x408f58
push ebx
call fcn.0040adfe
add esp, 0xc
mov esi, 0x408f18
push esi
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x80], ebx
pop ecx
pop ecx
push dword [0x416454]
jne 0x411fd2
push 0x408ec0
jmp 0x411fd7
push 0x408e78
push ebx
call fcn.0040adfe
add esp, 0xc
push esi
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x74], ebx
pop ecx
pop ecx
push dword [0x41403c]
jne 0x411ffb
push 0x408e18
jmp 0x412000
push 0x408dc8
push ebx
call fcn.0040adfe
add esp, 0xc
push 0x408d70
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x6c], ebx
pop ecx
pop ecx
jne 0x412034
push 0x408d10
push ebx
call fcn.0040adfe
pop ecx
pop ecx
mov dword [0x414040], 1
jmp 0x412048
push dword [0x414040]
push 0x408cc0
push ebx
call fcn.0040adfe
add esp, 0xc
push 0x408c70
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x7c], ebx
pop ecx
pop ecx
jne 0x41206f
push 0x408c18
push ebx
call fcn.0040adfe
pop ecx
pop ecx
mov dword [0x416468], ebx
jmp 0x412083
push dword [0x416468]
push 0x408bc8
push ebx
call fcn.0040adfe
add esp, 0xc
push 0x408b78
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x60], ebx
pop ecx
pop ecx
jne 0x4120b1
mov esi, 0x1f4
push esi
push 0x408b18
push ebx
call fcn.0040adfe
add esp, 0xc
mov dword [0x416420], esi
jmp 0x4120ee
push dword [0x416420]
push 0x408ac8
push ebx
call fcn.0040adfe
add esp, 0xc
push 2
pop esi
cmp dword [0x416420], esi
jae 0x4120ee
push 0x408a68
push ebx
call fcn.0040adfe
pop ecx
pop ecx
push esi
push 0x800003f2
mov dword [0x416420], esi
call fcn.0040a987
push 0x408a18
push ebx
call fcn.0040adfe
cmp dword [ebp - 0x4c], ebx
pop ecx
pop ecx
jne 0x41211c
mov esi, 0x12c
push esi
push 0x4089b8
push ebx
call fcn.0040adfe
add esp, 0xc
mov dword [0x416410], esi
jmp 0x412159
push dword [0x416410]
push 0x408968
push ebx
call fcn.0040adfe
xor esi, esi
inc esi
add esp, 0xc
cmp dword [0x416410], esi
jae 0x412159
push 0x408910
push ebx
call fcn.0040adfe
pop ecx
pop ecx
push esi
push 0x800003f4
mov dword [0x416410], esi
call fcn.0040a987
cmp dword [0x414040], ebx
je 0x412169
cmp dword [0x416468], ebx
jne 0x4121be
cmp dword [ebp - 0x3c], ebx
je 0x4121db
push 0x4088b8
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
push 0x40000bc8
call fcn.0040a918
cmp dword [0x416464], ebx
je 0x4121ae
xor esi, esi
cmp dword [0x416430], ebx
jbe 0x4121ae
mov eax, dword [0x416428]
push dword [eax + esi*4]
call fcn.004103fd
inc esi
cmp esi, dword [0x416430]
jb 0x412198
cmp dword [0x414040], ebx
je 0x4121db
cmp dword [0x416468], ebx
je 0x4121db
cmp dword [ebp - 0x3c], ebx
jne 0x4121db
push 0x408858
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
push 0x40000bc9
call fcn.0040a918
push 0x416470
push 0x408820
push ebx
call fcn.0040adfe
push 0x416578
push 0x4087f0
push ebx
call fcn.0040adfe
push dword [0x416454]
push 0x4087a8
push ebx
call fcn.0040adfe
push dword [0x41403c]
push 0x408750
push ebx
call fcn.0040adfe
add esp, 0x30
cmp dword [0x416464], ebx
je 0x412247
push 0x408708
push ebx
call fcn.0040adfe
push 0x4086c0
push 0xa
call fcn.0040adfe
add esp, 0x10
jmp 0x412641
mov esi, 0x404948
push esi
push 0x409d38
push 0xa
mov dword [0x416464], 1
call fcn.0040adfe
add esp, 0xc
lea eax, [ebp - 0x44]
push eax
push 9
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
je 0x41229a
push esi
push 0x408678
push 0x14
call fcn.0040adfe
add esp, 0xc
push esi
push 0xc00003e9
jmp 0x4118c7
mov esi, 0x105
push esi
lea eax, [ebp + 0x1d8]
push eax
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], esi
push ebx
jmp 0x4125c6
cmp dword [ebp - 0x3c], ebx
jne 0x412649
call fcn.004116a6
lea eax, [ebp + 0x1d8]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
cmp eax, ebx
mov dword [ebp - 0x3c], eax
jne 0x41231b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40863c
push 0x14
mov dword [ebp - 0x4c], eax
call fcn.0040adfe
lea eax, [ebp + 0x1d8]
push eax
push 0x40860c
push 0x14
call fcn.0040adfe
add esp, 0x18
push dword [ebp - 0x4c]
lea eax, [ebp + 0x1d8]
push eax
push 0x80000bbf
call fcn.0040aba1
jmp 0x4125b9
push dword [ebp - 0x3c]
call fcn.004103fd
test eax, eax
je 0x41267c
mov eax, dword [0x416430]
lea eax, [eax*4 + 4]
push eax
push dword [0x416428]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x4126b2
push eax
push 0x4085cc
push ebx
mov dword [0x416428], eax
call fcn.0040adfe
mov eax, dword [0x416430]
mov ecx, dword [0x416428]
mov edx, dword [ebp - 0x3c]
mov dword [ecx + eax*4], edx
mov eax, dword [0x416434]
add esp, 0xc
add eax, 0x105
push eax
push dword [0x416424]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x4126c7
push eax
push 0x408588
push ebx
mov dword [0x416424], eax
call fcn.0040adfe
add dword [0x416434], esi
mov eax, dword [0x416424]
mov ecx, dword [0x416434]
mov byte [eax + ecx - 1], bl
push edi
lea eax, [ebp + 0x1d8]
push eax
mov eax, dword [0x416430]
imul eax, eax, 0x105
add eax, dword [0x416424]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
mov eax, dword [0x416430]
add esp, 0x18
lea eax, [eax*4 + 4]
push eax
push dword [0x41642c]
call sub.snmpapi.dll_SnmpUtilMemReAlloc
cmp eax, ebx
je 0x4126e1
push eax
push 0x408538
push ebx
mov dword [0x41642c], eax
call fcn.0040adfe
push edi
lea eax, [ebp - 0x38]
push 0x404948
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
lea eax, [ebp - 0x38]
add esp, 0x18
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412421
sub eax, esi
lea ecx, [ebp + 0x1d8]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x412435
sub ecx, eax
lea eax, [ecx + esi + 1]
cmp eax, edi
ja 0x4126f6
lea eax, [ebp + 0x1d8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412452
lea edi, [ebp - 0x38]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x41245f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x38]
push eax
and ecx, 3
push 0x4084f0
push 0xa
rep movsb byte es:[edi], byte [esi]
call fcn.0040adfe
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x412728
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x1d8]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0x4084e0
push dword [ebp - 0x58]
mov dword [ebp - 0x48], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x412506
push eax
mov eax, dword [0x416430]
imul eax, eax, 0x105
add eax, dword [0x416424]
push eax
push 0x408480
push 0x14
call fcn.0040adfe
add esp, 0x10
mov eax, dword [0x416430]
mov ecx, dword [0x41642c]
mov dword [ecx + eax*4], ebx
jmp 0x412548
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp - 0x58]
mov dword [ebp - 0x64], 1
call fcn.004129be
cmp eax, ebx
je 0x412536
push eax
push 0x408430
push 0x14
call fcn.0040adfe
add esp, 0xc
jmp 0x4124f6
mov eax, dword [ebp - 0x60]
mov ecx, dword [0x416430]
mov edx, dword [0x41642c]
mov dword [edx + ecx*4], eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x416430]
imul eax, eax, 0x105
add eax, dword [0x416424]
push eax
push 0x4083fc
push ebx
call fcn.0040adfe
push dword [ebp - 0x3c]
push dword [0x416430]
push 0x4083c8
push ebx
call fcn.0040adfe
mov eax, dword [0x416430]
mov ecx, dword [0x41642c]
push dword [ecx + eax*4]
push eax
push 0x408388
push ebx
call fcn.0040adfe
add esp, 0x2c
inc dword [0x416430]
inc dword [ebp - 0x40]
mov dword [ebp - 0x48], 0x105
mov esi, 0x105
mov edi, 0x104
push dword [ebp - 0x48]
lea eax, [ebp + 0x1d8]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
mov dword [ebp - 0x3c], eax
jne 0x4122b3
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x416430]
push 0x408348
push ebx
call fcn.0040adfe
add esp, 0xc
xor edi, edi
cmp dword [0x416430], ebx
jbe 0x41263b
mov dword [ebp - 0x3c], ebx
mov eax, dword [0x416424]
mov ecx, dword [ebp - 0x3c]
add eax, ecx
push eax
mov eax, dword [0x416428]
push dword [eax + edi*4]
push edi
push 0x408318
push ebx
call fcn.0040adfe
add dword [ebp - 0x3c], esi
add esp, 0x14
inc edi
cmp edi, dword [0x416430]
jb 0x412607
cmp dword [0x416430], ebx
je 0x41275b
xor eax, eax
inc eax
jmp 0x41276b
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0x4082b8
push 0x14
call fcn.0040adfe
add esp, 0x10
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
push 0xc00003f9
call fcn.0040aa6d
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412724
push 0x408268
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0x80000bb9
call fcn.0040a918
push 0xc00007e3
call fcn.0040a918
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x412724
push 0x408228
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0xc0000bc2
jmp 0x412699
push 0x4081e4
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0xc0000bc4
call fcn.0040a918
jmp 0x412715
push 0x408198
push 0x14
call fcn.0040adfe
pop ecx
pop ecx
push 0xc0000bc5
jmp 0x4126da
lea eax, [ebp - 0x38]
push eax
push 0x408160
push 0x14
call fcn.0040adfe
push 0x408118
push 0xa
call fcn.0040adfe
add esp, 0x14
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [0x416430]
xor eax, eax
jmp 0x41276b
push esi
lea eax, [ebp - 0x38]
push eax
push 0x4080b0
push 0x14
call fcn.0040adfe
add esp, 0x10
push esi
lea eax, [ebp - 0x38]
push eax
push 0x80001393
call fcn.0040aba1
push 0x408118
push 0xa
call fcn.0040adfe
pop ecx
pop ecx
jmp 0x412715
push 0x408060
push 0x14
call fcn.0040adfe
xor eax, eax
pop ecx
pop ecx
mov ecx, dword [ebp + 0x2e0]
pop edi
pop esi
pop ebx
call fcn.00412b38
add ebp, 0x2e4
leave
ret