Function at 0x419d7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x429e8a
call fcn.0041bd3c
mov eax, 0x1064
call fcn.0041e5d0
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
push 0x20019
xor ebp, ebp
push ebp
push dword [esp + 0x109c]
mov dword [esp + 0x30], ebp
push dword [esp + 0x109c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
call fcn.0041a1da
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, 3
jae 0x419dd4
push str.Local495
push ebp
push ebp
call edi
call fcn.0041a1da
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
cmp eax, 2
jae 0x419dfb
push str.Local12301
push 1
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x419dfb
push eax
call esi
call fcn.0041a1da
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp eax, 2
jae 0x419e1d
push str.828828
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x419e1d
push eax
call ebp
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x419e3f
push 0
push 0
call dword [sym.imp.USER32.dll_IsDialogMessageA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.0041a1da
cmp eax, 2
jae 0x419e61
push str.Local12306
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x419e61
push eax
call esi
call fcn.0041a1da
push 2
pop esi
cmp eax, esi
jae 0x419e80
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0041a1da
cmp eax, esi
jae 0x419e9b
push 0x42e1b4
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x419e9b
push eax
call ebp
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x419ed7
mov esi, 0x34e
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x34e
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
pop ecx
dec esi
jne 0x419eac
push 2
pop esi
call fcn.0041a1da
cmp eax, esi
jae 0x419ef7
push ecx
push 1
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x419ef7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], eax
mov byte [esp + 0x34], al
mov dword [esp + 0x107c], 1
test ebx, ebx
jne 0x41a18b
mov dword [esp + 0x14], 0x1000
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x419f48
push ebx
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
call fcn.0041a1da
cmp eax, 3
jae 0x419f5b
push str.Local850
push ebx
push ebx
call edi
call fcn.0041a1da
cmp eax, esi
jae 0x419f73
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0041a1da
cmp eax, esi
jae 0x419f8b
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0041a1da
cmp eax, 3
jae 0x419f9e
push str.Local394
push ebx
push ebx
call edi
call fcn.0041a1da
cmp eax, esi
jae 0x419fbd
push esi
call fcn.0041a976
pop ecx
test eax, eax
je 0x419fbd
push eax
mov byte [eax + 1], 8
call fcn.0040c4f8
pop ecx
call fcn.0041a1da
cmp eax, esi
jae 0x419fd8
push str.832832
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
je 0x419fd8
push eax
call ebp
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x419ff4
push ebx
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x41a024
mov edi, 0x145
mov esi, edi
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
dec esi
jne 0x41a005
call fcn.0041a1da
mov esi, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ebp, 0x1f0001
cmp eax, 3
jae 0x41a04f
push str.Global674
push ebx
push ebp
call edi
test eax, eax
je 0x41a04f
push eax
call esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push dword [esp + 0x10a4]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
mov byte [esp + ecx + 0x70], bl
test eax, eax
jne 0x41a0d8
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 2
ja 0x41a173
push ecx
lea eax, [esp + 0x74]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
call fcn.00406721
mov byte [esp + 0x107c], 2
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x38]
call fcn.0040e4d1
mov byte [esp + 0x107c], 1
lea ecx, [esp + 0x4c]
call fcn.0040165f
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0041a1da
cmp eax, 3
jae 0x41a0fc
push str.Global726
push ebx
push ebp
call edi
test eax, eax
je 0x41a0fc
push eax
call esi
call fcn.0041a1da
cmp eax, 2
jae 0x41a121
push str.Local12326
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x41a121
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
call fcn.0041a1da
cmp eax, 3
jae 0x41a13b
push str.Global229
push ebx
push ebp
call edi
test eax, eax
je 0x41a13b
push eax
call esi
call fcn.0041a1da
cmp eax, 2
jae 0x41a154
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x41a18d
push ebx
push ebx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x41a18d
lea ecx, [esp + 0x64]
call fcn.0041bbe7
push 0x435158
lea eax, [esp + 0x68]
push eax
call fcn.0041bcde
xor ebx, ebx
mov esi, dword [esp + 0x1088]
lea eax, [esp + 0x34]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
push eax
mov ecx, esi
mov byte [esi], bl
call fcn.00407815
mov dword [esp + 0x20], 1
mov byte [esp + 0x107c], bl
lea ecx, [esp + 0x34]
call fcn.0040165f
mov ecx, dword [esp + 0x1074]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret