Function at 0x41567b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x3c
lea ebp, [esp - 4]
mov eax, dword [0x571268]
xor eax, ebp
mov dword [ebp + 0x3c], eax
push 0x8c
mov eax, 0x50c724
call fcn.004ec730
mov eax, dword [ebp + 0x48]
xor esi, esi
mov dword [ebp + 0x10], ecx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
push eax
mov dword [ebp - 4], esi
call fcn.00412eee
mov edi, eax
cmp edi, esi
jne 0x4156eb
mov edi, 0x3e81
xor ebx, ebx
lea esi, [ebp + 8]
call fcn.00411b1f
mov eax, edi
mov edx, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3c]
xor ecx, ebp
call fcn.004e6e1c
add ebp, 0x40
leave
ret 4
mov eax, dword [ebp + 0x10]
push 8
pop ebx
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], esi
cmp dword [eax + 0x18], ebx
jb 0x415701
mov eax, dword [eax + 4]
jmp 0x415704
add eax, 4
lea ecx, [ebp + 0x1c]
push ecx
lea ecx, [ebp]
push ecx
lea ecx, [ebp + 0x18]
push ecx
push esi
push eax
push edi
mov dword [ebp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x415728
mov dword [ebp + 0x1c], eax
jmp 0x4157bf
cmp dword [ebp + 0x18], 0xb
je 0x4157bc
mov dword [ebp + 0x1c], 0xd
call fcn.00411dd9
cmp byte [eax], 0
jne 0x4157de
lea eax, [ebp - 0x98]
push eax
call fcn.004071c6
push dword [ebp + 0x10]
mov ebx, 0x525218
push ebx
lea eax, [ebp - 0x90]
push str.CRegistry::getQWValue_...___for_key
push eax
mov byte [ebp - 4], 1
call fcn.004058d5
pop ecx
pop ecx
push eax
call fcn.004058d5
pop ecx
pop ecx
push eax
call fcn.00405173
pop ecx
pop ecx
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x98]
call fcn.0040574e
lea edi, [ebp + 0x20]
mov byte [ebp - 4], 2
call fcn.00405549
push esi
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0
call fcn.00405a60
jmp 0x415912
mov dword [ebp + 0x1c], esi
cmp dword [ebp + 0x1c], esi
jne 0x415739
push edi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov edi, eax
mov ebx, ecx
jmp 0x4156c0
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 3
call fcn.00405430
mov byte [ebp - 4], 4
call fcn.00411dd9
lea ecx, [ebp + 0x20]
call fcn.00405346
mov byte [ebp - 4], 5
cmp dword [eax + 0x18], ebx
jb 0x41580d
mov edi, dword [eax + 4]
jmp 0x415810
lea edi, [eax + 4]
lea eax, [ebp - 0x90]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push edi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CRegistry::getQWValue_...___for_key
push eax
call fcn.004058d5
pop ecx
pop ecx
mov ebx, 0x525218
push ebx
push eax
call fcn.004058d5
pop ecx
pop ecx
push dword [ebp + 0x10]
push eax
call fcn.00405173
pop ecx
pop ecx
push esi
push 1
lea esi, [ebp + 0x20]
mov byte [ebp - 4], 4
call fcn.0040754f
lea eax, [ebp + 0x14]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov edi, 0x2710
push edi
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x4158c1
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x90]
call fcn.0040532c
push 0x1a8
push str..Registry.cpp
push eax
push edi
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 7
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp + 0x20]
call fcn.0040754f
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 4
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.0040539b
and dword [ebp - 4], 0
jmp 0x415917
mov edi, 0x2710
call fcn.00411dd9
cmp byte [eax], 0
jne 0x415992
lea eax, [ebp - 0x98]
push eax
call fcn.004071c6
mov byte [ebp - 4], 0xa
push dword [ebp + 0x1c]
lea eax, [ebp - 0x90]
push ebx
push str.CRegistry::getQWValue_...___QueryQWORDValue_error
push eax
call fcn.004058d5
pop ecx
pop ecx
push eax
call fcn.004058d5
pop ecx
pop ecx
push eax
call fcn.00403746
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x98]
call fcn.0040574e
lea edi, [ebp + 0x20]
mov byte [ebp - 4], 0xb
call fcn.00405549
push 0
push 1
mov esi, edi
call fcn.0040754f
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0
call fcn.00405a60
xor edi, edi
jmp 0x4156be
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 0xc
call fcn.00405430
mov byte [ebp - 4], 0xd
call fcn.00411dd9
lea ecx, [ebp + 0x20]
call fcn.00405346
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 8
jb 0x4159c2
mov esi, dword [eax + 4]
jmp 0x4159c5
lea esi, [eax + 4]
lea eax, [ebp - 0x90]
push 0x5251c8
push eax
call fcn.004058d5
pop ecx
pop ecx
push esi
push eax
call fcn.004058d5
pop ecx
pop ecx
push 0x5251c0
push eax
call fcn.004058d5
pop ecx
pop ecx
push str.CRegistry::getQWValue_...___QueryQWORDValue_error
push eax
call fcn.004058d5
pop ecx
pop ecx
push ebx
push eax
call fcn.004058d5
pop ecx
pop ecx
push dword [ebp + 0x1c]
push eax
call fcn.00403746
push 0
push 1
lea esi, [ebp + 0x20]
mov byte [ebp - 4], 0xd
call fcn.0040754f
lea eax, [ebp + 0x14]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
push edi
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0xf
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x415a6b
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x90]
call fcn.0040532c
push 0x1a9
push str..Registry.cpp
push eax
push edi
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0x10
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push 0
push 1
lea esi, [ebp + 0x20]
call fcn.0040754f
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0xd
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 0xc
call fcn.0040539b
jmp 0x41598b