Function at 0x41ffc9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push edi
xor edi, edi
mov dword [ebp - 0x910], eax
inc ecx
mov dword [ebp - 0x8e8], edi
push 0x4041e0
push ebx
mov esi, edx
mov dword [ebp - 0x8ec], edi
mov dword [ebp - 0x8e4], ecx
mov dword [ebp - 0x8fc], edi
mov dword [ebp - 0x8f0], edi
mov dword [ebp - 0x908], ecx
mov dword [ebp - 0x900], ecx
mov dword [ebp - 0x8f8], edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x420051
push ebx
push esi
mov dword [ebp - 0x8f8], 1
push 0x4041f0
jmp 0x420071
push 0x404230
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
push ebx
push esi
test eax, eax
jne 0x42006c
push 0x404238
jmp 0x420071
push 0x404278
mov edi, 0x121
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.00418481
add esp, 0x14
lea eax, [ebp - 0x248]
push ebx
push 0x4042a0
push edi
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x8e8]
xor esi, esi
push esi
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x248]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42017a
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push esi
push esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420137
cmp dword [ebp - 0x8e4], 1
je 0x42010c
cmp dword [ebp - 0x8e4], 2
jne 0x420137
lea edx, [ebp - 0x48c]
lea ecx, [ebp - 0x248]
call fcn.0041e51f
test eax, eax
jne 0x42016e
lea ecx, [ebp - 0x48c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x42012a
jmp 0x42014b
lea ecx, [ebp - 0x48c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x420140
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x8e8]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4209c6
lea eax, [ebp - 0x8e0]
mov dword [ebp - 0x8e0], esi
push eax
push 1
push esi
push 0x40403c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42031e
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push esi
push esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420312
cmp dword [ebp - 0x8e4], 1
jne 0x420312
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x420312
mov eax, ecx
push 0x404048
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x420312
mov dword [ebp - 0x904], esi
lea eax, [ebp - 0x90c]
push ecx
mov esi, 0x122
lea ecx, [ebp - 0x248]
push eax
mov edx, esi
call fcn.00418514
test eax, eax
js 0x420278
mov eax, dword [ebp - 0x90c]
sub esi, eax
push ecx
push 0x4042d4
push ecx
lea ecx, [ebp - 0x248]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.00418577
lea eax, [ebp - 0x904]
xor esi, esi
push eax
push 1
push esi
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420312
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push esi
push esi
push dword [ebp - 0x904]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420306
cmp dword [ebp - 0x8e4], 1
je 0x4202de
cmp dword [ebp - 0x8e4], 2
jne 0x420306
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x420306
mov eax, ecx
mov edx, ebx
push eax
push 2
pop ecx
call fcn.0041e5a9
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x908], esi
push dword [ebp - 0x904]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x8e0]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x40416c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4209ba
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push esi
push esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42053b
cmp dword [ebp - 0x8e4], 1
je 0x420393
cmp dword [ebp - 0x8e4], 2
jne 0x42053b
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x42053b
mov eax, ecx
mov edx, ebx
push eax
push 2
pop ecx
call fcn.0041e5a9
test eax, eax
je 0x420491
mov eax, dword [ebp - 0x900]
lea ecx, [ebp - 0x8dc]
mov dword [ebp - 0x8fc], eax
mov edx, edi
lea eax, [ebp - 0x248]
push eax
call fcn.00418392
lea eax, [ebp - 0x8dc]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea ecx, [ebp - 0x8dc]
call fcn.0041e3eb
test eax, eax
jne 0x420439
lea ecx, [ebp - 0x248]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x420401
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push esi
push 0x4040a4
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x420445
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x8f0], eax
lea edx, [ebp - 0x48c]
lea ecx, [ebp - 0x248]
call fcn.0041e51f
test eax, eax
jne 0x420491
lea ecx, [ebp - 0x48c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x420463
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [ebp - 0x8f0]
xor edi, edi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8fc], 0
je 0x4209b8
mov edx, 0x105
lea ecx, [ebp - 0x8a4]
call fcn.00424ce1
test eax, eax
je 0x4209b8
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push edi
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420508
cmp dword [ebp - 0x8e4], 1
je 0x42058b
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x42050d
sub ecx, edx
xor edi, edi
sar ecx, 1
inc edi
lea eax, [ecx*2 + 2]
push eax
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x420590
mov eax, dword [ebp - 0x900]
lea ecx, [ebp - 0x48c]
mov esi, dword [ebp - 0x908]
lea edx, [ecx + 2]
mov dword [ebp - 0x8fc], eax
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x420558
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x420499
xor edi, edi
xor ebx, ebx
inc edi
push ebx
push ebx
push ebx
push ebx
push 0x4042e8
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4205c3
push 0xc
push 0x4042fc
push edi
push ebx
push 0x4042e8
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
push ebx
push ebx
push ebx
push 0x404308
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x420603
push 4
lea eax, [ebp - 0x8f0]
mov dword [ebp - 0x8f0], 0x100002
push eax
push 3
push ebx
push 0x404308
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x404194
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4207d3
mov dword [ebp - 0x8ec], 0x244
test esi, esi
jne 0x4206bf
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4206bf
cmp dword [ebp - 0x8e4], edi
je 0x420677
cmp dword [ebp - 0x8e4], 2
jne 0x4206bf
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x4206bf
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x420689
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x4040a4
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [ebp - 0x910]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4206ca
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
xor edi, edi
inc edi
push edi
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x8a4]
push eax
push 0x40431c
lea eax, [ebp - 0x698]
push 0x105
push eax
call fcn.00418481
add esp, 0x10
test eax, eax
js 0x4207c7
lea eax, [ebp - 0x8ec]
mov dword [ebp - 0x8ec], 0x244
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push 0x4031d0
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42078d
cmp dword [ebp - 0x8e4], edi
je 0x420762
cmp dword [ebp - 0x8e4], 2
jne 0x42078d
lea edx, [ebp - 0x698]
lea ecx, [ebp - 0x248]
call fcn.0041e51f
test eax, eax
jne 0x4207c7
lea ecx, [ebp - 0x698]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x420780
jmp 0x4207a1
lea ecx, [ebp - 0x698]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x420796
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x698]
push eax
push edi
push ebx
push 0x4031d0
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x40403c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42089f
mov dword [ebp - 0x8ec], 0x244
test esi, esi
jne 0x42087d
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42087d
cmp dword [ebp - 0x8e4], edi
jne 0x42087d
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
test eax, eax
je 0x42087d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42084c
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push edi
push ebx
push 0x4040a4
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x4011a0
push edi
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x4041c8
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4209b8
mov dword [ebp - 0x8ec], 0x244
test esi, esi
jne 0x420979
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420979
cmp dword [ebp - 0x8e4], edi
je 0x420913
cmp dword [ebp - 0x8e4], 2
jne 0x420979
lea ecx, [ebp - 0x248]
call fcn.0041e3a4
mov esi, dword [ebp - 0x8f4]
test eax, eax
je 0x42097f
mov eax, ecx
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x42097f
lea ecx, [ebp - 0x248]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x420941
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x4040a4
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x42097f
mov esi, dword [ebp - 0x8f4]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x420984
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 2
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8f8], 0
je 0x420a44
cmp dword [ebp - 0x8fc], 0
je 0x420a44
lea eax, [ebp - 0x8e8]
push eax
push 0x2001f
push esi
push 0x404330
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420a44
push 4
pop ebx
push ebx
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0x8f8], esi
push eax
push ebx
push esi
push 0x4043b8
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
lea eax, [ebp - 0x8f8]
push eax
push ebx
push esi
push 0x4043c4
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret 8