Function at 0x41fe90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bddb4
mov eax, dword fs:[0]
push eax
sub esp, 0x390
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x388], eax
push ebx
push esi
push edi
mov eax, dword [0x4e44b4]
xor eax, esp
push eax
lea eax, [esp + 0x3a0]
mov dword fs:[0], eax
mov dword [esp + 0x20], 0
call fcn.0044f900
mov ecx, eax
call fcn.0044d330
call fcn.0041f400
call fcn.0041f5b0
call fcn.0041f7e0
call fcn.0041fb10
call fcn.0041fce0
lea eax, [esp + 0x1c]
push eax
push 0x20019
mov ecx, 0xc
mov esi, str.SOFTWARETencentQQ2009
lea edi, [esp + 0x164]
rep movsd dword es:[edi], dword [esi]
push 0
lea ecx, [esp + 0x168]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x190]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push str.QuickLaunch
mov edi, 1
mov ebx, 4
push edx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], 0x208
call esi
test eax, eax
jne 0x41ffb7
mov ecx, 0x4ced8c
lea eax, [esp + 0x18c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41ffa7
test dx, dx
je 0x41ffa3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41ffa7
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x41ff83
xor eax, eax
jmp 0x41ffac
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0x4ced90
push edx
mov dword [esp + 0x30], ebx
call esi
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push str.nShortcutQuickLaunch
push eax
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x2c]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
mov esi, 0xf
push esi
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], 0
push str.ShortcutDesktop
mov byte [ecx + 4], 0
call fcn.00402d90
call fcn.00401d20
add esp, 0x20
cmp dword [0x4e8f68], edi
mov bl, al
jne 0x420089
call fcn.004722e0
cmp eax, 3
jg 0x420089
test bl, bl
jne 0x420089
push 3
push 0x138
push str.R:BuildWorkTempQQ1.87HummerPack4921AutoProject_setup3HummerSetuppre_installcheck_system.cpp
lea ecx, [esp + 0x40]
call fcn.00473160
add eax, 4
push str.Check_failed:_restlt.
mov dword [esp + 0x3ac], 0
mov ebx, edi
push eax
mov dword [esp + 0x28], ebx
call fcn.004041d0
add esp, 8
jmp 0x42008d
mov ebx, dword [esp + 0x20]
test bl, 1
mov dword [esp + 0x3a8], 0xffffffff
je 0x4200a9
lea ecx, [esp + 0x34]
and ebx, 0xfffffffe
call fcn.00472c30
mov eax, dword [esp + 0x28]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x13
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], 0
push str.ShortcutQuickLaunch
mov byte [ecx + 4], 0
call fcn.00402d90
call fcn.00401d20
add esp, 0x20
cmp dword [0x4e8f68], edi
mov byte [esp + 0x17], al
jne 0x42012d
call fcn.004722e0
cmp eax, 3
jg 0x42012d
cmp byte [esp + 0x17], 0
jne 0x42012d
push 3
push 0x13b
push str.R:BuildWorkTempQQ1.87HummerPack4921AutoProject_setup3HummerSetuppre_installcheck_system.cpp
lea ecx, [esp + 0xd4]
call fcn.00473160
add eax, 4
push str.Check_failed:_restlt.
mov dword [esp + 0x3ac], edi
or ebx, 2
push eax
mov dword [esp + 0x28], ebx
call fcn.004041d0
add esp, 8
test bl, 2
mov dword [esp + 0x3a8], 0xffffffff
je 0x420149
lea ecx, [esp + 0xc8]
call fcn.00472c30
mov al, 1
mov ecx, dword [esp + 0x3a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x388]
xor ecx, esp
call fcn.00495cb8
mov esp, ebp
pop ebp
ret