Function at 0x411b10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x274
mov eax, dword [0x45e088]
xor eax, esp
mov dword [esp + 0x270], eax
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ecx
push ebx
mov ebx, dword [esp + 0x27c]
push ebp
mov ecx, dword [eax + 0xc]
push esi
mov esi, dword [esp + 0x288]
or ecx, 0x20019
mov dword [esp + 0xc], eax
mov eax, dword [eax]
mov dword [esp + 0x20], vtable.ErrorClass.0
mov ebp, dword [esi + 0x10]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.TextErrorClass.0
mov dword [esp + 0x28], 0x441510
mov dword [esp + 0x2c], 0
mov dword [esp + 0x18], edx
push edi
mov edi, dword [esp + 0x290]
cmp eax, 0x80000004
je 0x411bea
cmp eax, 0x80000050
je 0x411bea
lea edx, [esp + 0x14]
push edx
push ecx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x411be5
push 0
push ebp
push eax
lea ecx, [esp + 0x30]
call fcn.00414cf0
test al, al
jne 0x411be5
or dword [ebx + 0x14], 0x200
mov ecx, ebx
push 1
push dword [esp + 0x30]
call fcn.00413f10
mov bl, al
jmp 0x411f6e
mov ebp, dword [esi + 0x10]
jmp 0x411bee
mov dword [esp + 0x14], eax
movzx edx, word [ebp]
xor esi, esi
mov ecx, ebp
test dx, dx
je 0x411c16
nop dword [eax + eax]
add ecx, 2
cmp dx, 0x5c
mov eax, ecx
cmovne eax, esi
mov esi, eax
movzx edx, word [ecx]
test dx, dx
jne 0x411c00
mov eax, dword [ebx]
test esi, esi
mov ecx, ebx
cmovne ebp, esi
push ebp
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x411f6c
or dword [ebx + 0x14], 1
xor ebp, ebp
cmp dword [ebx + 0x24], ebp
jne 0x411c77
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x14]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x411c5e
cmp eax, 0xea
jne 0x411c77
lea eax, [esp + 0x48]
mov dword [esp + 0x34], ebp
push eax
lea ecx, [esp + 0x38]
call fcn.0040c000
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x24], eax
mov ecx, dword [edi]
lea eax, [esp + 0x70]
mov dword [esp + 0x6c], eax
xor eax, eax
mov word [esp + 0x70], ax
mov eax, ecx
shr eax, 2
not al
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0x64], 2
mov dword [esp + 0x68], 0x108
test al, 1
je 0x411dd1
mov ecx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [esp + 0x20], ecx
nop dword [eax]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x80]
push ebp
push dword [esp + 0x30]
call ecx
test eax, eax
je 0x411cf5
cmp eax, 0xea
jne 0x411dcf
push 1
push dword [esp + 0x70]
mov ecx, ebx
inc ebp
call fcn.00407180
mov esi, eax
test esi, esi
je 0x411f56
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
add edx, 0x2ac18000
push 0
push 0x989680
adc ecx, 0xfe624e21
push ecx
push edx
call fcn.00420df0
mov ecx, eax
add ecx, 0xffff573f
adc edx, 0xffffffff
test edx, edx
ja 0x411d48
jb 0x411d4a
cmp ecx, 0x7fff573d
jbe 0x411d4a
xor eax, eax
mov dword [esi + 0x24], eax
mov eax, dword [edi]
shr eax, 3
not al
test al, 1
je 0x411db0
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x40]
push 0x45b4e0
push 0x20019
mov dword [esp + 0x48], 0
push dword [eax + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], 0
push dword [eax]
call fcn.00410830
test al, al
je 0x411da5
push dword [edi]
mov ecx, dword [esp + 0x14]
push 0x45b4e0
push 0
push esi
push 0
push dword [esp + 0x54]
call fcn.00411fd0
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x411db9
nop dword [eax]
mov ecx, dword [esp + 0x20]
jmp 0x411cc0
push eax
call dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x40], 0
jmp 0x411cc0
mov ecx, dword [edi]
shr ecx, 1
xor esi, esi
not cl
test cl, 1
je 0x411e74
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop word [eax + eax]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x54]
push eax
push 0
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], 0
push eax
push 0
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x80]
push esi
push dword [esp + 0x30]
call ebp
test eax, eax
je 0x411e2c
cmp eax, 0xea
jne 0x411e74
mov eax, dword [esp + 0x6c]
mov ecx, ebx
cmp word [eax], 0
je 0x411e4a
push 0
push eax
call fcn.00407180
mov ecx, eax
test ecx, ecx
je 0x411f56
mov eax, dword [esp + 0x58]
inc esi
mov dword [ecx + 0x20], eax
lea eax, [esp + 0x24]
push dword [edi]
push eax
push dword [esp + 0x40]
push ecx
push dword [esp + 0x7c]
mov ecx, dword [esp + 0x24]
push dword [esp + 0x28]
call fcn.00411fd0
jmp 0x411df0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x411e89
push eax
call dword [esp + 0x20]
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x294]
test esi, esi
je 0x411f0c
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x411f0c
nop dword [eax + eax]
test byte [ebx + 0x14], 1
je 0x411f05
push dword [ebx + 0x18]
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.00407220
test al, al
je 0x411f56
mov ecx, dword [esp + 0x10]
lea eax, [esi - 1]
push eax
push edi
push ebp
push ebx
call fcn.00411b10
test al, al
je 0x411f56
mov ecx, ebp
call fcn.00408220
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x411f05
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 4]
cmp eax, dword [edi + 4]
jb 0x411ef2
cmp eax, dword [edi + 0x14]
jbe 0x411ef8
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
test esi, esi
jne 0x411ee2
mov esi, dword [esp + 0x294]
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x411ea0
mov bl, 1
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x411f6e
mov eax, dword [esp + 0x5c]
shr eax, 5
test al, 1
je 0x411f3b
mov eax, dword [esp + 0x64]
imul eax, dword [esp + 0x68]
test eax, eax
je 0x411f3b
nop
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x411f30
mov al, byte [esp + 0x5c]
test al, 2
je 0x411f5a
push 0x8000
push 0
push dword [esp + 0x74]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x411f6e
xor bl, bl
jmp 0x411f0e
test al, 1
je 0x411f6e
push dword [esp + 0x6c]
call fcn.00427100
add esp, 4
jmp 0x411f6e
xor bl, bl
cmp dword [esp + 0x30], 0
mov dword [esp + 0x24], vtable.TextErrorClass.0
je 0x411f99
push dword [esp + 0x2c]
call fcn.00427100
add esp, 4
mov dword [esp + 0x2c], 0x441510
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], vtable.ErrorClass.0
test eax, eax
je 0x411fae
push eax
call dword [esp + 0x20]
mov ecx, dword [esp + 0x280]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420cb2
add esp, 0x274
ret 0x10