Function at 0x412f74
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x422cf7
call fcn.00414d1c
mov eax, 0x1038
call fcn.004175b0
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x1050], ebx
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push dword [esp + 0x1070]
mov dword [esp + 0x2c], ebx
push dword [esp + 0x1070]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [esp + 0x105c]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [esp + 0x1050], ebx
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
test eax, eax
jne 0x41321a
mov eax, dword [0x42f1fc]
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
lea esi, [eax + eax]
mov eax, dword [0x42f1f8]
or esi, ecx
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
neg ecx
add eax, eax
or eax, ecx
mov dword [0x42f1fc], esi
mov dword [0x42f1f8], eax
test esi, esi
jne 0x41302e
push 0x208
mov eax, 0x4263dc
push eax
push eax
push ebx
call ebp
mov esi, dword [0x42f1fc]
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
shl esi, 0x19
or esi, 1
mov dword [0x42f1fc], esi
jne 0x41304c
push 0
call ebx
mov esi, dword [0x42f1fc]
shl esi, 0x19
or esi, 1
mov dword [0x42f1fc], esi
jne 0x413064
push 0
call ebx
mov esi, dword [0x42f1fc]
mov eax, dword [0x42f1f8]
mov ecx, eax
not ecx
and ecx, 0x2b2
neg ecx
sbb ecx, ecx
lea edx, [eax + eax]
neg ecx
or edx, ecx
mov eax, edx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
neg eax
add edx, edx
or edx, eax
or esi, 0x201
mov dword [0x42f1f8], edx
mov dword [0x42f1fc], esi
jne 0x4130b5
push 0
call ebx
mov esi, dword [0x42f1fc]
mov edx, dword [0x42f1f8]
mov eax, edx
not eax
and eax, 0x2b2
neg eax
sbb eax, eax
mov ecx, 0x80000000
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
xor ebx, ebx
mov dword [0x42f1f8], edx
test esi, esi
jne 0x4130f5
push 0x27e
mov eax, 0x4263e0
push eax
push eax
push ebx
call ebp
mov edx, dword [0x42f1f8]
mov ecx, 0x80000000
mov eax, edx
not eax
mov ebp, 0x2b2
and eax, ebp
neg eax
sbb eax, eax
and eax, ecx
add eax, ecx
shr edx, 1
or edx, eax
mov ecx, edx
not ecx
and ecx, ebp
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [edx + edx]
or eax, ecx
mov dword [0x42f1f8], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x20]
push eax
push ebx
push dword [esp + 0x1078]
mov dword [esp + 0x24], 0x1000
push dword [esp + 0x28]
mov dword [0x42f1fc], 0x20001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov byte [esp + edx + 0x44], bl
test eax, eax
jne 0x413210
mov ecx, dword [0x42f1f8]
mov eax, ecx
not eax
and eax, ebp
neg eax
sbb eax, eax
shr ecx, 1
mov esi, 0x80000000
and eax, esi
add eax, esi
or ecx, eax
mov eax, dword [0x42f1fc]
or eax, 0xae
mov dword [0x42f1f8], ecx
mov ecx, 0x1f1
cmp eax, ecx
cmove eax, ecx
or eax, 0x9a
lea ecx, [ebp + 0x5b]
cmp eax, ecx
cmove eax, ecx
mov ecx, 0x150
cmp eax, ecx
cmove eax, ecx
mov dword [0x42f1fc], eax
mov eax, dword [esp + 0x18]
dec eax
cmp eax, 2
ja 0x413230
push edx
lea eax, [esp + 0x48]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004021fe
mov dword [esp + 0x1050], 1
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call fcn.00409c9a
mov byte [esp + 0x1050], bl
lea ecx, [esp + 0x20]
call fcn.0040150a
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1048]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [esp + 0x38]
call fcn.00414bc7
push 0x42cea4
lea eax, [esp + 0x3c]
push eax
call fcn.00414cbe
int3