Function at 0x415cb0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x10]
push 0x64
mov dword [ebp - 0xd8], eax
lea eax, [ebp - 0x68]
push 0
push eax
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xe0], 0
call fcn.00411960
mov eax, dword [ebp - 0xd8]
add esp, 0xc
test eax, eax
je 0x4161ed
test esi, esi
je 0x4161ed
test ebx, ebx
je 0x4161ed
push 0x32
lea ecx, [ebp - 0x68]
push ecx
push eax
call fcn.0041e5a0
add esp, 0xc
test eax, eax
mov eax, dword [ebp - 0xd8]
push eax
jne 0x415d5f
push 0x4a05e8
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xdc]
mov ecx, 0x49e448
test edx, edx
mov eax, ecx
cmovne eax, edx
test edi, edi
push eax
cmovne ecx, edi
push ecx
push 0x4a0628
push 0x20
call fcn.00446b80
add esp, 0x14
cmp dword [ebp + 0x14], 0
jne 0x415db7
cmp dword [ebx], 4
je 0x415db7
push ebx
push 4
push 0x4a0650
push 1
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xd0]
push eax
push 1
push 0
push 0x49f010
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xd8], eax
test eax, eax
je 0x415e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, dword [ebp - 0xd8]
cmp eax, 2
jne 0x415e11
push 0x4a0684
push 4
call fcn.00446b80
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push ecx
push eax
push 0x4a06c0
push 4
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push 0x4a0700
push 0x10
call fcn.00446b80
add esp, 8
test edi, edi
je 0x415f5e
push 0x64
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.00411960
mov eax, dword [ebp - 0xdc]
add esp, 0xc
test eax, eax
je 0x415e88
cmp byte [eax], 0
je 0x415e88
push eax
push edi
push 0x49f2e4
lea eax, [ebp - 0xcc]
push 0x32
push eax
call fcn.00419510
add esp, 0x14
jmp 0x415e9f
push edi
push 0x49f2f0
lea eax, [ebp - 0xcc]
push 0x32
push eax
call fcn.00419510
add esp, 0x10
lea eax, [ebp - 0xd4]
push eax
push 1
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xdc], eax
test eax, eax
je 0x415f46
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov eax, dword [ebp - 0xdc]
cmp eax, 2
jne 0x415f0f
lea eax, [ebp - 0xcc]
push eax
push 0x4a0728
push 4
call fcn.00446b80
add esp, 0xc
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xcc]
push edx
push ecx
push eax
push 0x4a0758
push 1
call fcn.00446b80
add esp, 0x14
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xcc]
push eax
push 0x4a0794
push 0x10
call fcn.00446b80
add esp, 0xc
jmp 0x415f6d
push 0x4a07b8
push 0x20
call fcn.00446b80
add esp, 8
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0
push eax
push 0
lea eax, [ebp - 0xe0]
test edi, edi
push eax
push 0
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0xd0]
cmovne eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x416004
cmp eax, 2
jne 0x415fc1
lea eax, [ebp - 0x68]
push eax
push 0x4a07f0
push 4
call fcn.00446b80
add esp, 0xc
jmp 0x415fd5
push eax
lea eax, [ebp - 0x68]
push eax
push 0x4a0820
push 1
call fcn.00446b80
add esp, 0x10
test edi, edi
je 0x415fe5
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xe0]
lea eax, [ebp - 0x68]
push eax
push 0x4a0858
push 0x20
call fcn.00446b80
mov eax, dword [ebp - 0xe0]
add esp, 0x10
cmp dword [ebp + 0x14], 0
jne 0x4160dd
cmp eax, 4
je 0x416049
cmp eax, 5
je 0x416049
push eax
push 0x4a0880
push 1
call fcn.00446b80
add esp, 0xc
jmp 0x415fd5
push ebx
push esi
lea eax, [ebp - 0xe0]
test edi, edi
push eax
push 0
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0xd0]
cmovne eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x416094
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
push 0x4a08cc
push 1
call fcn.00446b80
add esp, 0x14
jmp 0x415fd5
movsx eax, byte [esi]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x4a0904
push 0x10
call fcn.00446b80
add esp, 0x10
test edi, edi
je 0x4160bb
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp eax, 4
je 0x416137
cmp eax, 5
je 0x416137
push ebx
push esi
lea eax, [ebp - 0xe0]
test edi, edi
push eax
push 0
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0xd0]
cmovne eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x41611f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
jmp 0x41607c
lea eax, [ebp - 0x68]
push eax
push 0x4a0978
push 0x10
call fcn.00446b80
add esp, 0xc
jmp 0x4160ab
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xd8], 0
push eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xdc], 4
push eax
lea eax, [ebp - 0xe0]
test edi, edi
push eax
push 0
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0xd0]
cmovne eax, dword [ebp - 0xd4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xe4], eax
test eax, eax
je 0x416198
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xe4]
jmp 0x41607c
push dword [ebp - 0xd8]
lea eax, [ebp - 0x68]
push eax
push 0x4a0934
push 0x30
call fcn.00446b80
push dword [ebp - 0xd8]
mov eax, dword [ebx]
push 0x4a0970
shr eax, 1
push eax
push esi
call fcn.00419510
add esp, 0x20
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4161d0
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 2]
mov dword [ebx], eax
jmp 0x4160ab
push ebx
push esi
push eax
push 0x4a05ac
push 1
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret