Function at 0x4173b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420cb4
mov eax, dword fs:[0]
push eax
sub esp, 0x7a0
mov eax, dword [0x4231e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x758], ecx
and dword [ebp - 0x76c], 0
and dword [ebp - 0x730], 0
lea eax, [ebp - 0x730]
push eax
push 0x4054e0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41775a
and dword [ebp - 0x734], 0
jmp 0x417426
mov eax, dword [ebp - 0x734]
inc eax
mov dword [ebp - 0x734], eax
push 0x40
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x734]
push dword [ebp - 0x730]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x41774e
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x730]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x417749
and dword [ebp - 0x738], 0
jmp 0x417481
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
push 0x40
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x738]
push dword [ebp - 0x740]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x41773d
mov dword [ebp - 0x75c], 0x208
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x740]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x417738
push 0x484
call fcn.0040b3d0
mov dword [ebp - 0x744], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x744], 0
je 0x417507
mov ecx, dword [ebp - 0x744]
call fcn.00413e89
mov dword [ebp - 0x748], eax
jmp 0x41750e
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x760], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x72c], eax
cmp dword [ebp - 0x72c], 0
jne 0x417538
jmp 0x417474
mov eax, dword [ebp - 0x72c]
mov dword [eax + 4], 3
lea eax, [ebp - 0x110]
push eax
call fcn.0040b696
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x74c], 0
je 0x417578
mov eax, dword [ebp - 0x72c]
add eax, 8
push eax
push dword [ebp - 0x74c]
call dword [sym.imp.ole32.dll_CLSIDFromString]
jmp 0x4175d8
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x73c], eax
cmp dword [ebp - 0x73c], 0
je 0x4175cc
push 1
mov eax, dword [ebp - 0x73c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x750], eax
mov ecx, dword [ebp - 0x750]
call dword [0x42486c]
mov ecx, dword [ebp - 0x73c]
call dword [ebp - 0x750]
mov dword [ebp - 0x768], eax
jmp 0x4175d3
and dword [ebp - 0x768], 0
jmp 0x417474
push 2
pop eax
imul eax, eax, 0
xor ecx, ecx
mov edx, dword [ebp - 0x72c]
mov word [edx + eax + 0x18], cx
mov eax, dword [ebp - 0x72c]
mov dword [eax + 0x6c], 4
mov eax, dword [ebp - 0x72c]
mov dword [eax + 0x70], 4
push 0x10
push 0
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov ecx, dword [ebp - 0x72c]
mov word [ecx + 0x68], ax
push 0x2e
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
mov dword [ebp - 0x754], eax
cmp dword [ebp - 0x754], 0
je 0x417665
push 0x10
push 0
mov eax, dword [ebp - 0x754]
inc eax
inc eax
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
mov ecx, dword [ebp - 0x72c]
mov word [ecx + 0x6a], ax
jmp 0x417671
xor eax, eax
mov ecx, dword [ebp - 0x72c]
mov word [ecx + 0x6a], ax
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x318]
test eax, eax
jne 0x41769f
lea eax, [ebp - 0x110]
push eax
push 0x405498
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x318]
push eax
push 0x4054f0
lea eax, [ebp - 0x728]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x758]
mov eax, dword [eax + 0x58]
mov dword [ebp - 0x7ac], eax
mov dword [ebp - 0x7a8], 0xffff0003
and dword [ebp - 0x798], 0
mov dword [ebp - 0x7a4], 0x27
mov eax, dword [ebp - 0x72c]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x780], eax
lea eax, [ebp - 0x728]
mov dword [ebp - 0x794], eax
lea eax, [ebp - 0x7ac]
push eax
mov ecx, dword [ebp - 0x758]
call fcn.004179ae
mov ecx, eax
call fcn.00417f0b
jmp 0x417474
push dword [ebp - 0x740]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x417419
push dword [ebp - 0x730]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f3a0
leave
ret 4