Function at 0x417c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov dword [ebp - 0x18c], ecx
mov eax, dword [0x449df8]
movzx ecx, byte [eax + 0x449c24]
test ecx, ecx
jne 0x417ca6
push 0x43dfd4
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
jmp 0x417ced
mov eax, dword [0x449df8]
movzx ecx, byte [eax + 0x449c24]
test ecx, ecx
je 0x417ced
mov edx, dword [0x449df8]
movzx eax, byte [edx + 0x449c24]
cmp eax, 0xff
je 0x417ced
mov ecx, dword [0x449df8]
movzx edx, byte [ecx + 0x449c24]
push edx
push 0x43e000
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x17c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x178]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
je 0x417d23
xor al, al
jmp 0x4180f2
mov dword [ebp - 0x180], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x180]
push edx
push 0
push 0x43e02c
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417d72
mov ecx, dword [ebp - 0x17c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov edx, dword [ebp - 0x188]
and edx, 0xffff
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x2ec]
mov dword [ecx + 0x3c], edx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
push 0x43e03c
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417dd2
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
movzx ecx, byte [ebp - 0x188]
and ecx, 0xff
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 0x2ec]
mov byte [eax + 0x28], cl
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x180]
push eax
push 0
push 0x43e048
mov ecx, dword [ebp - 0x17c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417e33
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov eax, dword [ebp - 0x188]
xor ecx, ecx
mov edx, dword [ebp - 0x18c]
mov edx, dword [edx + 0x2ec]
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], ecx
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x2ec]
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
mov cl, 0x20
call fcn.00421ec0
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx + 0x2ec]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
push 0x43e060
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417ebd
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x2ec]
mov eax, dword [ebp - 0x188]
xor ecx, ecx
add eax, dword [edx + 0x20]
mov edx, dword [edx + 0x24]
adc edx, ecx
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ecx + 0x2ec]
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
push 0x43e074
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417f30
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x2ec]
mov eax, dword [ebp - 0x188]
mov dword [edx], eax
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x188]
push edx
lea eax, [ebp - 0x180]
push eax
push 0
push 0x43e084
mov ecx, dword [ebp - 0x17c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417f89
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov eax, dword [ebp - 0x18c]
mov ecx, dword [eax + 0x2ec]
mov edx, dword [ebp - 0x188]
mov dword [ecx + 4], edx
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x188]
push ecx
lea edx, [ebp - 0x180]
push edx
push 0
push 0x43e098
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x417fe3
mov ecx, dword [ebp - 0x17c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov edx, dword [ebp - 0x18c]
mov eax, dword [edx + 0x2ec]
mov cl, byte [ebp - 0x188]
mov byte [eax + 0xc], cl
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x180]
push ecx
push 0
push 0x43e0a0
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41803d
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
mov ecx, dword [ebp - 0x18c]
mov edx, dword [ecx + 0x2ec]
mov eax, dword [ebp - 0x188]
mov dword [edx + 8], eax
mov dword [ebp - 8], 0x64
mov dword [ebp - 0x180], 1
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x70]
push edx
lea eax, [ebp - 0x180]
push eax
push 0
push 0x43e0b0
mov ecx, dword [ebp - 0x17c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41809b
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x4180f2
push 0x64
push 0
mov eax, dword [ebp - 0x18c]
add eax, 0x23e
push eax
call fcn.00421600
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x4180c5
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x64
jge 0x4180e3
mov edx, dword [ebp - 0x18c]
add edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x70]
mov byte [edx + 0x23e], cl
jmp 0x4180bc
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret