Function at 0x415870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497224
mov eax, dword fs:[0]
push eax
mov eax, 0x5054
call fcn.004765f0
mov eax, dword [0x4bc040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x5045], dl
mov dword [ebp - 0x5044], ecx
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x501c], 0
movq qword [ebp - 0x5024], xmm0
mov dword [ebp - 0x5024], 0
mov dword [ebp - 0x5020], 0
mov dword [ebp - 0x501c], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5060]
push 1
xor eax, eax
mov dword [ebp - 0x5050], 0
push 0x4b0944
mov dword [ebp - 0x504c], 7
mov word [ebp - 0x5060], ax
call fcn.004015e0
lea eax, [ebp - 0x5060]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x5024]
call fcn.00414910
mov byte [ebp - 4], 3
add esp, 4
mov edx, dword [ebp - 0x504c]
cmp edx, 8
jb 0x41597b
mov ecx, dword [ebp - 0x5060]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415971
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4160e9
push edx
push ecx
call fcn.00475cec
add esp, 8
mov edi, dword [ebp - 0x5020]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x5024]
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4159cc
lea eax, [ebp + 8]
push eax
cmp edi, dword [ebp - 0x501c]
je 0x4159ba
mov ecx, edi
call fcn.00405bf0
add dword [ebp - 0x5020], 0x18
jmp 0x4159c6
push edi
lea ecx, [ebp - 0x5024]
call fcn.0040e4d0
mov esi, dword [ebp - 0x5024]
mov ebx, dword [esi + 0x14]
mov edi, esi
cmp ebx, 8
jb 0x4159d8
mov edi, dword [esi]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x5014], eax
cmp eax, 0x11
jne 0x415a11
mov ecx, str.HKEY_CLASSES_ROOT
mov edx, eax
sub edi, ecx
nop
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415a0b
add ecx, 2
sub edx, 1
jne 0x4159f0
mov esi, SysReAllocString
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
mov edi, esi
cmp ebx, 8
jb 0x415a1a
mov edi, dword [esi]
cmp eax, 0x11
jne 0x415a51
mov ecx, str.HKEY_CURRENT_USER
mov edx, eax
sub edi, ecx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415a4b
add ecx, 2
sub edx, 1
jne 0x415a30
mov esi, SysReAllocString
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
mov edi, esi
cmp ebx, 8
jb 0x415a5a
mov edi, dword [esi]
cmp eax, 0x12
jne 0x415a91
mov ecx, str.HKEY_LOCAL_MACHINE
mov edx, eax
sub edi, ecx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415a8b
add ecx, 2
sub edx, 1
jne 0x415a70
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
mov edi, esi
cmp ebx, 8
jb 0x415a9a
mov edi, dword [esi]
cmp eax, 0xa
jne 0x415ad1
mov ecx, str.HKEY_USERS
mov edx, eax
sub edi, ecx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415acb
add ecx, 2
sub edx, 1
jne 0x415ab0
mov esi, SysStringLen
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
mov edi, esi
cmp ebx, 8
jb 0x415ada
mov edi, dword [esi]
cmp eax, 0x13
jne 0x415b11
mov ecx, str.HKEY_CURRENT_CONFIG
mov edx, eax
sub edi, ecx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415b0b
add ecx, 2
sub edx, 1
jne 0x415af0
mov esi, VariantCopy
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
mov edi, esi
cmp ebx, 8
jb 0x415b1a
mov edi, dword [esi]
cmp eax, 0x15
jne 0x415b4e
mov ecx, str.HKEY_PERFORMANCE_DATA
mov edx, eax
sub edi, ecx
nop dword [eax + eax]
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415b48
add ecx, 2
sub edx, 1
jne 0x415b30
mov esi, SysStringLen
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
mov edi, esi
cmp ebx, 8
jb 0x415b57
mov edi, dword [esi]
cmp eax, 0x18
jne 0x415b83
mov ecx, str.HKEY_PERFORMANCE_NLSTEXT
mov edx, eax
sub edi, ecx
mov ax, word [edi + ecx]
cmp ax, word [ecx]
jne 0x415b7d
add ecx, 2
sub edx, 1
jne 0x415b65
mov esi, 0x80000060
jmp 0x415bba
mov eax, dword [ebp - 0x5014]
cmp ebx, 8
jb 0x415b8a
mov esi, dword [esi]
cmp eax, 0x15
jne 0x415feb
mov ecx, str.HKEY_PERFORMANCE_TEXT
mov edx, eax
sub esi, ecx
nop dword [eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x415feb
add ecx, 2
sub edx, 1
jne 0x415ba0
mov esi, 0x80000050
mov edi, 7
mov dword [ebp - 0x502c], 0
xor eax, eax
mov dword [ebp - 0x5028], edi
mov word [ebp - 0x503c], ax
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
push dword [ebp - 0x5018]
cmp dword [ebp + 0x1c], 8
mov ebx, dword [ebp + 0x18]
mov edx, ebx
cmovae ecx, dword [ebp + 8]
push 1
sub esp, 8
call fcn.004160f0
add esp, 0x10
cmp eax, 0xffffffff
je 0x415caa
lea edx, [eax + 1]
mov dword [ebp - 0x5050], 0
xor eax, eax
mov dword [ebp - 0x504c], edi
mov word [ebp - 0x5060], ax
cmp ebx, edx
jb 0x4160e4
sub ebx, edx
lea eax, [ebp + 8]
or ecx, 0xffffffff
cmp ebx, 0xffffffff
cmovb ecx, ebx
cmp dword [ebp + 0x1c], 8
push ecx
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x5060]
lea eax, [eax + edx*2]
push eax
call fcn.004015e0
lea eax, [ebp - 0x5060]
push eax
lea ecx, [ebp - 0x503c]
call fcn.00405b60
mov edx, dword [ebp - 0x504c]
cmp edx, 8
jb 0x415ca4
mov ecx, dword [ebp - 0x5060]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415c9a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4160e9
push edx
push ecx
call fcn.00475cec
add esp, 8
mov edi, dword [ebp - 0x5028]
cmp byte [ebp - 0x5045], 0
lea ecx, [ebp - 0x5040]
lea eax, [ebp - 0x503c]
push ecx
je 0x415cc7
push 0x20019
jmp 0x415ccc
push 0x20119
cmp edi, 8
push 0
cmovae eax, dword [ebp - 0x503c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x415d43
mov eax, dword [0x4be6ac]
test eax, eax
je 0x415d17
push ecx
push str.getRegistryValue:_RegOpenKeyExW_failed_with_error__ld
push 0x4aeee0
push 0x4aeee0
push str.OSUtils
push str.OOBEUtils
push 0x28
call eax
add esp, 0x1c
xor bl, bl
jmp 0x415f8c
mov edx, dword [0x4be6b0]
test edx, edx
je 0x415d3c
mov eax, dword [edx]
push ecx
push str.getRegistryValue:_RegOpenKeyExW_failed_with_error__ld
push str.OSUtils
push 0x4aeee0
push 0x28
push edx
call dword [eax + 0x34]
add esp, 0x18
xor bl, bl
jmp 0x415f8c
xor bl, bl
lea esi, [ebp + 0x38]
cmp dword [ebp + 0x4c], 8
cmovae esi, dword [ebp + 0x38]
cmp dword [ebp + 0x48], 9
jne 0x415e57
mov ecx, str.REG_DWORD
mov edx, 9
sub esi, ecx
nop word [eax + eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x415e57
add ecx, 2
sub edx, 1
jne 0x415d70
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x5018]
push ecx
lea ecx, [ebp - 0x5014]
mov dword [ebp - 0x5018], 4
push ecx
push edx
lea eax, [ebp + 0x20]
mov dword [ebp - 0x5014], edx
cmovae eax, dword [ebp + 0x20]
push edx
push eax
push dword [ebp - 0x5040]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x415e24
mov esi, dword [ebp - 0x5014]
push 0xb0
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.00478880
add esp, 4
lea ecx, [ebp - 0xc0]
call fcn.004106e0
push 0
push esi
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 6
call fcn.00410830
mov edi, dword [ebp - 0x5044]
lea ecx, [ebp - 0xc0]
mov edx, edi
call fcn.004143f0
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 5
call fcn.0040fa60
mov bl, 1
jmp 0x415f00
mov eax, dword [0x4be6ac]
test eax, eax
je 0x415ed5
push edx
push str.getRegistryValue:_RegQueryValueExW_failed_with_error__ld
push 0x4aeee0
push 0x4aeee0
push str.OSUtils
push str.OOBEUtils
push 0x28
call eax
add esp, 0x1c
jmp 0x415efa
cmp dword [ebp + 0x34], 8
lea ecx, [ebp - 0x5018]
push ecx
lea ecx, [ebp - 0x5010]
mov dword [ebp - 0x5018], 0x5000
push ecx
push 0
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push 0
push eax
push dword [ebp - 0x5040]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x415ec8
lea ecx, [ebp - 0x5010]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415ea0
mov edi, dword [ebp - 0x5044]
lea eax, [ebp - 0x5010]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004015e0
mov bl, 1
jmp 0x415f00
mov eax, dword [0x4be6ac]
test eax, eax
jne 0x415e31
mov ecx, dword [0x4be6b0]
test ecx, ecx
je 0x415efa
mov eax, dword [ecx]
push edx
push str.getRegistryValue:_RegQueryValueExW_failed_with_error__ld
push str.OSUtils
push 0x4aeee0
push 0x28
push ecx
call dword [eax + 0x34]
add esp, 0x18
mov edi, dword [ebp - 0x5044]
push dword [ebp - 0x5040]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4be6ac], 0
je 0x415f4f
cmp dword [edi + 0x14], 8
jb 0x415f1d
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
movzx eax, bl
push eax
push str.getRegistryValue:_Status:_d_Value:_s_Error:_d
push 0x4aeee0
push 0x4aeee0
push str.OSUtils
push str.OOBEUtils
push 0xa
call dword [0x4be6ac]
add esp, 0x24
jmp 0x415f8c
mov esi, dword [0x4be6b0]
test esi, esi
je 0x415f8c
cmp dword [edi + 0x14], 8
jb 0x415f61
mov edi, dword [edi]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
movzx eax, bl
push eax
push str.getRegistryValue:_Status:_d_Value:_s_Error:_d
push str.OSUtils
push 0x4aeee0
push 0xa
push dword [0x4be6b0]
call dword [esi + 0x34]
add esp, 0x20
mov edx, dword [ebp - 0x5028]
cmp edx, 8
jb 0x415fcc
mov ecx, dword [ebp - 0x503c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x415fc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4160e9
push edx
push ecx
call fcn.00475cec
add esp, 8
xor eax, eax
mov dword [ebp - 0x502c], 0
mov dword [ebp - 0x5028], 7
mov word [ebp - 0x503c], ax
jmp 0x415fed
xor bl, bl
lea ecx, [ebp - 0x5024]
call fcn.00409dc0
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x416032
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416028
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4160e9
push edx
push ecx
call fcn.00475cec
add esp, 8
mov edx, dword [ebp + 0x34]
xor eax, eax
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 7
mov word [ebp + 8], ax
cmp edx, 8
jb 0x41607c
mov ecx, dword [ebp + 0x20]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x416072
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4160e9
push edx
push ecx
call fcn.00475cec
add esp, 8
mov edx, dword [ebp + 0x4c]
xor eax, eax
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 7
mov word [ebp + 0x20], ax
cmp edx, 8
jb 0x4160c6
mov ecx, dword [ebp + 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4160bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4160e9
push edx
push ecx
call fcn.00475cec
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00475cfa
mov esp, ebp
pop ebp
ret
call fcn.0040a030
call fcn.0047b37a
int3