Function at 0x4176b1
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x15c
mov eax, 0x46b866
call fcn.0042dc0b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x130]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x138], eax
call fcn.0040699e
and dword [ebp - 4], 0
mov esi, str.HKCU
push esi
call fcn.00436130
push eax
push edi
push esi
call fcn.00438a59
mov esi, eax
xor eax, eax
test esi, esi
push str.HKEY_CURRENT_USER
sete al
mov dword [ebp - 0x13c], eax
call fcn.00436130
push eax
push edi
push str.HKEY_CURRENT_USER
call fcn.00438a59
add esp, 0x20
neg eax
sbb eax, eax
inc eax
test esi, esi
je 0x417f3c
test eax, eax
jne 0x417f3c
mov bh, 1
mov byte [ebp - 0x141], al
push 0x104
mov bl, al
mov dword [ebp - 0x14c], eax
mov byte [ebp - 0x131], bh
mov dword [ebp - 0x13c], eax
call fcn.00432c26
mov dword [ebp - 0x140], eax
pop ecx
test eax, eax
jne 0x4177a7
push 6
mov esi, 0x493f4c
push str.Operations::_RegKeyOp__szSubKey
mov ecx, esi
call fcn.0040c5b8
mov byte [ebp - 0x141], bh
jmp 0x417d6b
mov esi, dword [ebp - 0x148]
test esi, esi
je 0x417d54
push str.modify
push esi
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x4177d2
cmp dword [ebp - 0x15c], eax
je 0x417d54
test edi, edi
je 0x417d54
cmp dword [ebp - 0x154], 0
je 0x417d54
push str.removemultisz
push esi
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417804
cmp dword [ebp - 0x150], eax
je 0x417d54
push esi
push edi
push dword [ebp - 0x154]
lea eax, [ebp - 0x130]
push str.IN_Operations::_RegKeyOp_:_Entering__RegKeyOp___main_parameters:__s___s___s
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x130]
add esp, 0x14
cmp dword [eax - 4], 1
jle 0x41783a
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 4
push dword [ebp - 0x130]
mov esi, 0x493f4c
mov ecx, esi
call fcn.0040c5b8
cmp dword [ebp - 0x138], 0
je 0x4179ae
call fcn.0040c31e
push dword [ebp - 0x138]
mov dword [ebp - 0x154], eax
push 0x474984
call fcn.004359a0
pop ecx
pop ecx
test eax, eax
jne 0x4178a6
mov ecx, esi
cmp dword [ebp - 0x154], eax
jne 0x417892
push 5
push str.IN_Operations::_RegKeyOp_:_Invalid_parameter__64_bit_view_is_not_available_on_this_platform
jmp 0x417d62
push str.IN_Operations::_RegKeyOp_:_Using_64_bit_registry_view
call fcn.0040c5a7
mov dword [ebp - 0x13c], 1
and dword [ebp - 0x11c], 0
mov ecx, edi
mov dword [ebp - 0x118], 0xf
mov byte [ebp - 0x12c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4178c3
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x12c]
call fcn.00404230
cmp dword [ebp - 0x118], 0x10
lea ecx, [ebp - 0x12c]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x11c]
cmovae ecx, edx
mov dword [ebp - 0x160], ecx
cmp eax, 0xd
jb 0x417950
add eax, 0xfffffff4
add eax, ecx
mov dword [ebp - 0x154], eax
jmp 0x417932
push 0xd
push str.Wow6432Node_
push eax
call fcn.0042fe0d
mov ecx, dword [ebp - 0x138]
add esp, 0xc
test eax, eax
je 0x417a31
mov eax, dword [ebp - 0x154]
inc ecx
sub eax, ecx
push eax
push 0x5c
push ecx
call fcn.0042fd60
add esp, 0xc
mov dword [ebp - 0x138], eax
test eax, eax
jne 0x41790d
mov edx, dword [ebp - 0x12c]
or ecx, 0xffffffff
xor eax, eax
cmp ecx, 0xffffffff
cmove eax, dword [ebp - 0x13c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x118]
cmp eax, 0x10
jb 0x4179ae
inc eax
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x154], eax
cmp eax, 0x1000
jb 0x4179a5
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00401311
mov eax, dword [ebp - 0x154]
mov edx, dword [ebp - 0x138]
pop ecx
pop ecx
push eax
push edx
call fcn.0042d727
pop ecx
pop ecx
lea eax, [ebp - 0x140]
push eax
push edi
call fcn.0041697b
mov dword [ebp - 0x138], eax
pop ecx
pop ecx
test eax, eax
je 0x417d4b
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push eax
call fcn.0041593b
add esp, 0xc
mov dword [ebp - 0x14c], eax
test eax, eax
jne 0x417a42
push edi
lea eax, [ebp - 0x130]
push str.IN_Operations::_RegKeyOp_:_RegKey__s_doesnt_exist
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x417a19
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 4
push dword [ebp - 0x130]
mov ecx, esi
call fcn.0040c5b8
xor bh, bh
mov bl, 1
jmp 0x417d6b
sub ecx, dword [ebp - 0x160]
mov edx, dword [ebp - 0x12c]
jmp 0x417953
push str.remove
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417ac7
mov eax, dword [ebp - 0x14c]
cmp eax, 1
jne 0x417a9d
mov eax, dword [ebp - 0x158]
push dword [ebp - 0x13c]
test eax, eax
jne 0x417a86
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.00416cf8
jmp 0x417abd
push eax
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.004155c9
add esp, 0x10
jmp 0x417ac0
cmp eax, 2
jne 0x417d6b
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.00415792
add esp, 0xc
mov bl, al
jmp 0x417d6b
mov ebx, dword [ebp - 0x148]
push str.modify
push ebx
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417c27
mov eax, dword [ebp - 0x14c]
cmp eax, 2
je 0x417b38
cmp eax, 1
jne 0x417afc
mov ebx, dword [ebp - 0x158]
test ebx, ebx
jne 0x417b3e
push edi
push str.IN_Operations::_RegKeyOp_:_RegKey__s_is_not_a_value__failed_to_modify_registry_value
lea eax, [ebp - 0x130]
push eax
call fcn.00406b1a
add esp, 0xc
mov eax, dword [ebp - 0x130]
cmp dword [eax - 4], 1
jle 0x417b2b
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 5
push dword [ebp - 0x130]
jmp 0x417d60
mov ebx, dword [ebp - 0x158]
push str.REG_SZ
push dword [ebp - 0x15c]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417b75
push dword [ebp - 0x13c]
test ebx, ebx
jne 0x417b67
push dword [ebp - 0x150]
push ebx
jmp 0x417bda
push ebx
push dword [ebp - 0x150]
push 0
jmp 0x417bfd
mov ebx, dword [ebp - 0x15c]
push str.REG_DWORD
push ebx
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417c1c
push dword [ebp - 0x150]
call fcn.00437f31
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x417bc8
push dword [ebp - 0x150]
push 0x474af0
call fcn.004359a0
pop ecx
pop ecx
test eax, eax
je 0x417bc8
push dword [ebp - 0x150]
push str.IN_Operations::_RegKeyOp_:_Invalid_DWORD_value__s
jmp 0x417b02
mov eax, dword [ebp - 0x158]
push dword [ebp - 0x13c]
test eax, eax
jne 0x417bf9
push eax
push ebx
push dword [ebp - 0x15c]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.00416737
add esp, 0x18
jmp 0x417d38
push eax
push 0
push ebx
push dword [ebp - 0x15c]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.004164ba
add esp, 0x1c
jmp 0x417d38
push ebx
push str.IN_Operations::_RegKeyOp_:_Value_Type__s_is_not_valid
jmp 0x417b02
push str.removemultisz
push ebx
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417cb2
mov eax, dword [ebp - 0x14c]
cmp eax, 2
je 0x417c5d
cmp eax, 1
jne 0x417c52
mov eax, dword [ebp - 0x158]
test eax, eax
jne 0x417c8c
push edi
push str.IN_Operations::_RegKeyOp_:_RegKey__s_is_not_a_value__failed_to_remove_registry_multi_string_value
jmp 0x417b02
mov eax, dword [ebp - 0x158]
test eax, eax
jne 0x417c8c
push dword [ebp - 0x13c]
push dword [ebp - 0x150]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.00419934
add esp, 0x10
jmp 0x417d38
push dword [ebp - 0x13c]
push eax
push dword [ebp - 0x150]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.00419546
add esp, 0x14
jmp 0x417d38
push str.deletelink
push ebx
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417cfd
cmp dword [ebp - 0x14c], 2
jne 0x417ce4
push str.IN_Operations::_RegKeyOp_:_Invalid_parameter__registry_values_cannot_be_used_as_links
lea eax, [ebp - 0x130]
push eax
call fcn.00406b1a
pop ecx
pop ecx
jmp 0x417b11
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.0041545c
jmp 0x417d35
push str.forceremovelink
push ebx
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417d42
cmp dword [ebp - 0x14c], 2
jne 0x417d1e
push str.IN_Operations::_RegKeyOp_:__forceremovelink__Invalid_parameter__registry_values_cannot_be_used_as_links
jmp 0x417cd1
push dword [ebp - 0x13c]
push dword [ebp - 0x140]
push dword [ebp - 0x138]
call fcn.00415fe8
add esp, 0xc
mov bh, byte [ebp - 0x131]
mov bl, al
jmp 0x417d6b
push 5
push str.IN_Operations::_RegKeyOp_:_Invalid_action
jmp 0x417d60
push 5
push str.IN_Operations::_RegKeyOp_:_unable_to_parse_registry_key
jmp 0x417d60
push 4
push str.IN_Operations::_RegKeyOp_:_Invalid_parameters__returning
mov esi, 0x493f4c
mov ecx, esi
call fcn.0040c5b8
xor bh, bh
xor bl, bl
call fcn.00413e75
test al, al
je 0x417d7d
xor bl, bl
mov byte [ebp - 0x141], 1
mov eax, dword [ebp - 0x140]
test eax, eax
je 0x417d8e
push eax
call fcn.00432c0b
pop ecx
test bl, bl
je 0x417e7d
test bh, bh
je 0x417e47
push str.remove
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417de7
cmp dword [ebp - 0x14c], 1
jne 0x417ddf
mov eax, dword [ebp - 0x158]
test eax, eax
je 0x417ddf
push edi
push eax
push str._s_removed_successfully_from_registry_key__s
lea eax, [ebp - 0x130]
push eax
call fcn.00406b1a
add esp, 0x10
jmp 0x417e5c
push edi
push str._s_removed_successfully
jmp 0x417e4d
push str.modify
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417e05
push edi
push str._s_modified_successfully
jmp 0x417e4d
push str.removemultisz
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417e29
push edi
push dword [ebp - 0x150]
push str.__s__in__s_removed_successfully
jmp 0x417dce
push str.deletelink
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417e5c
push edi
push str.__s__link_deleted_successfully
jmp 0x417e4d
push edi
push str._s_does_not_exist
lea eax, [ebp - 0x130]
push eax
call fcn.00406b1a
add esp, 0xc
mov eax, dword [ebp - 0x130]
cmp dword [eax - 4], 1
jle 0x417e76
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 2
jmp 0x417f2a
cmp byte [ebp - 0x141], 0
jne 0x418260
test bh, bh
je 0x418260
push str.remove
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417eb0
push edi
push str.Failed_to_remove__s
jmp 0x417ecc
push str.modify
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417edd
push edi
push str.Failed_to_modify__s
lea eax, [ebp - 0x130]
push eax
call fcn.00406b1a
add esp, 0xc
jmp 0x417f0e
push str.removemultisz
push dword [ebp - 0x148]
call fcn.00435a9e
pop ecx
pop ecx
test eax, eax
jne 0x417f0e
push edi
push dword [ebp - 0x150]
lea eax, [ebp - 0x130]
push str.Failed_to_remove___s__from__s
push eax
call fcn.00406b1a
add esp, 0x10
mov eax, dword [ebp - 0x130]
cmp dword [eax - 4], 1
jle 0x417f28
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 3
push dword [ebp - 0x130]
mov ecx, esi
call fcn.0040c5b8
jmp 0x418260
push edi
lea eax, [ebp - 0x130]
push str.IN_Operations::_RegKeyOp_:_trying_to_operate_on_HKCU_key:__s
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x417f6b
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 4
push dword [ebp - 0x130]
mov esi, 0x493f4c
mov ecx, esi
call fcn.0040c5b8
mov eax, dword fs:[0x2c]
mov ecx, dword [0x494610]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x494188]
cmp eax, dword [ecx + 4]
jg 0x418276
cmp dword [0x49417c], 0
jne 0x418122
xor eax, eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
push 0x20019
push eax
push SysStringLen
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 1
call fcn.0040dd83
test eax, eax
je 0x418038
push eax
lea eax, [ebp - 0x130]
push str.IN_Operations::_RegKeyOp_:_Can_not_open_HKEY_USERS__error_u
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x41800d
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 4
push dword [ebp - 0x130]
mov ecx, esi
call fcn.0040c5b8
cmp dword [ebp - 0x120], 0
je 0x418031
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x418260
xor ebx, ebx
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.0042f1f0
add esp, 0xc
mov dword [ebp - 0x160], 0x104
lea eax, [ebp - 0x168]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x418103
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x14c]
call fcn.0040c993
push dword [eax]
mov ecx, 0x494178
mov byte [ebp - 4], 2
call fcn.00413bd1
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.00406c57
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x130]
push str.IN_Operations::_RegKeyOp_:_Adding_to_user_list:__s
push eax
call fcn.00406b1a
mov eax, dword [ebp - 0x130]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x4180ee
push dword [eax - 0xc]
lea ecx, [ebp - 0x130]
call fcn.00406aae
push 4
push dword [ebp - 0x130]
mov ecx, esi
call fcn.0040c5b8
inc ebx
jmp 0x41803a
cmp dword [ebp - 0x120], 0
mov ebx, dword [ebp - 0x148]
mov byte [ebp - 4], 0
je 0x418122
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x140], esi
cmp dword [0x49417c], esi
jbe 0x41825e
push edi
lea ecx, [ebp - 0x14c]
call fcn.0040c993
lea ecx, [ebp - 0x148]
call fcn.0040699e
cmp dword [ebp - 0x13c], 0
mov byte [ebp - 4], 4
je 0x41819b
push str.HKCU
call fcn.00436130
pop ecx
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00414b14
push esi
mov ecx, 0x494178
mov byte [ebp - 4], 5
call fcn.00413d74
mov esi, dword [ebp - 0x160]
jmp 0x4181da
push str.HKEY_CURRENT_USER
call fcn.00436130
pop ecx
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x14c]
call fcn.00414b14
push esi
mov ecx, 0x494178
mov byte [ebp - 4], 6
call fcn.00413d74
mov esi, dword [ebp - 0x164]
push esi
push dword [eax]
lea eax, [ebp - 0x148]
push str.HKEY_USERS_s_s
push eax
call fcn.00406b1a
add esp, 0x10
mov byte [ebp - 4], 4
lea ecx, [esi - 0x10]
call fcn.00406c57
push dword [ebp - 0x138]
mov esi, dword [ebp - 0x148]
push dword [ebp - 0x158]
push dword [ebp - 0x150]
push dword [ebp - 0x15c]
push ebx
push esi
push dword [ebp - 0x154]
call fcn.004176b1
add esp, 0x1c
lea ecx, [esi - 0x10]
call fcn.00406c57
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00406c57
mov esi, dword [ebp - 0x140]
inc esi
mov dword [ebp - 0x140], esi
cmp esi, dword [0x49417c]
jb 0x418136
mov bl, 1
mov ecx, dword [ebp - 0x130]
add ecx, 0xfffffff0
call fcn.00406c57
mov al, bl
call fcn.0042dbb5
ret
push 0x494188
call fcn.0042dab9
cmp dword [0x494188], 0xffffffff
pop ecx
jne 0x417f9f
push 0x46e9f4
call fcn.0042d971
mov dword [esp], 0x494188
call fcn.0042da6f
pop ecx
jmp 0x417f9f