Function at 0x404ec0
Capabilities:
Access peb ldr_data
Delete registry value
Get number of processors
Get process heap flags
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x1868
call fcn.00410490
sub esp, eax
movzx ebx, dx
mov eax, dword [esp + eax]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x182c], eax
lea eax, [ebx + 0x7f18]
cmp ax, 0x63
jbe 0x4052e8
cmp ebx, 0x8066
ja 0x4051b0
cmp ebx, 0x8001
jbe case.0x404f1a.32771
lea eax, [ebx - 0x8002]
cmp eax, 0x64
ja case.0x404f1a.32771
jmp dword [eax*4 + 0x4122bc]
cmp ebx, 0x800e
je 0x405f5b
cmp word [0x4167e0], 0
je case.0x404f1a.32825
xor eax, eax
mov edx, 9
mov dword [esp + 0xc], eax
mov eax, dword [0x416e20]
mov ecx, 0x110a
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
mov ebx, eax
je case.0x404f1a.32825
mov eax, 0xffffffff
mov esi, 1
mov dword [esp + 8], eax
mov eax, 0x100c
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov dword [esp + 0xc], esi
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [ebp - 0x1818], eax
sub esp, 0x10
mov eax, 0x7f02
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._LoadCursorW_8
sub esp, 8
mov dword [esp], eax
call sym._SetCursor_4
sub esp, 4
mov esi, eax
mov dword [esp + 4], ebx
lea eax, [ebp - 0x1818]
mov dword [esp + 0x10], eax
mov eax, dword [0x41102c]
mov dword [esp + 0xc], eax
mov eax, 0x4167e0
mov dword [esp + 8], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._FindNext
mov dword [esp], esi
mov ebx, eax
call sym._SetCursor_4
sub esp, 4
test ebx, ebx
je 0x406039
mov dword [esp + 0xc], ebx
mov eax, 9
mov dword [esp + 8], eax
mov eax, 0x110b
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x416e20]
xor ecx, ecx
mov edx, 1
sub esp, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._InvalidateRect_12
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
sub esp, 0xc
mov dword [esp], eax
call sym._UpdateWindow_4
sub esp, 4
cmp dword [ebp - 0x1818], 0xffffffff
je 0x4060be
mov eax, dword [0x416e20]
mov ebx, 3
xor ecx, ecx
mov dword [ebp - 0x1008], ebx
mov esi, 0xffffffff
mov edi, 0x102b
mov dword [ebp - 0x100c], ecx
lea ebx, [ebp - 0x1018]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, 3
mov dword [ebp - 0x100c], eax
mov eax, 3
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0x1818]
sub esp, 0x10
mov dword [esp + 8], eax
mov eax, 0x102b
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov dword [esp + 0xc], ebx
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
sub esp, 0x10
mov dword [esp], eax
call sym._SetFocus_4
sub esp, 4
mov ebx, 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 4
lea eax, [ebp - 0x182c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
mov dword [esp + 0xc], esi
mov dword [esp], edi
mov ebx, eax
mov dword [esp + 8], ebx
lea eax, [ebp - 0x1018]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x182c]
mov dword [esp + 4], eax
call sym._CreateValue
test eax, eax
jne 0x4053b0
mov dword [esp + 8], ebx
mov eax, dword fs:[0x18]
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp case.0x404f1a.32825
mov esi, 1
jmp 0x405122
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, 0x814e
je 0x4053c8
jbe 0x405228
cmp ebx, 0x8151
jne case.0x404f1a.32771
xor eax, eax
mov edx, 9
mov dword [esp + 0xc], eax
mov eax, dword [0x416e20]
mov ecx, 0x110a
mov dword [esp + 8], edx
mov ebx, 3
mov esi, 0x1102
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [0x416e20]
mov dword [esp + 8], ebx
mov ebx, 1
mov dword [esp + 4], esi
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x405113
cmp ebx, 0x814c
mov esi, 7
je 0x405122
cmp ebx, 0x814d
jne case.0x404f1a.32771
lea ebx, [ebp - 0x1818]
mov eax, edi
lea esi, [ebp - 0x1018]
mov edx, ebx
call sym._InitOpenFileName
mov eax, pe_nt_image_headers32
mov dword [esp + 0xc], eax
mov eax, 0x91
mov dword [esp + 4], eax
mov eax, dword [0x416ec0]
mov dword [esp + 8], esi
mov dword [esp], eax
call sym._LoadStringW_16
mov edx, 0x80066
mov ecx, sym._ExportRegistryFile_OFNHookProc_16
mov dword [ebp - 0x17e8], esi
mov esi, 0x83
mov dword [ebp - 0x17e4], edx
mov dword [ebp - 0x17d4], ecx
mov dword [ebp - 0x17d0], esi
sub esp, 0x10
mov dword [esp], ebx
call sym._GetSaveFileNameW_4
sub esp, 4
test eax, eax
je 0x405c20
mov eax, dword [ebp - 0x1800]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x17d8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x17fc]
mov dword [esp], eax
call sym._export_registry_key
jmp case.0x404f1a.32825
mov dword [esp], 0x80000001
lea eax, [ebp - 0x1828]
mov dword [esp + 0x10], eax
mov eax, 0x20019
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp + 4], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne case.0x404f1a.32825
mov eax, 0x400
xor edi, edi
mov dword [ebp - 0x1824], eax
lea eax, [ebp - 0x1820]
sub ebx, 0x80e8
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x181c]
xor ecx, ecx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1824]
mov edx, 0x1000
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x1818]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1828]
lea esi, [ebp - 0x1018]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [ebp - 0x1820], edx
mov dword [ebp - 0x181c], ecx
call sym._RegEnumValueW_32
sub esp, 0x20
test eax, eax
je 0x405bd8
mov eax, dword [ebp - 0x1828]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp case.0x404f1a.32825
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._StartValueRename
jmp 0x405170
mov esi, 2
jmp 0x405122
lea ebx, [ebp - 0x1818]
xor esi, esi
mov dword [ebp - 0x181c], esi
mov edx, ebx
mov eax, edi
call sym._InitOpenFileName
lea esi, [ebp - 0x1018]
mov eax, pe_nt_image_headers32
mov dword [esp + 0xc], eax
mov eax, 0x90
mov dword [esp + 4], eax
mov eax, dword [0x416ec0]
mov dword [esp + 8], esi
or dword [ebp - 0x17e4], 0x800000
mov dword [esp], eax
call sym._LoadStringW_16
mov dword [ebp - 0x17e8], esi
sub esp, 0x10
mov dword [esp], ebx
call sym._GetOpenFileNameW_4
sub esp, 4
test eax, eax
je 0x405c60
mov eax, dword [ebp - 0x17fc]
mov ebx, 0x412280
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wfopen]
test eax, eax
mov ebx, eax
je 0x405c70
mov dword [esp], eax
call sym._import_registry_file
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_fclose]
test esi, esi
je 0x405c70
test eax, eax
jne 0x405c70
mov dword [esp], edi
mov eax, dword [ebp - 0x17fc]
mov dword [esp + 0x10], eax
mov eax, 0x7e2
mov dword [esp + 0xc], eax
mov eax, 0x67
mov dword [esp + 8], eax
mov eax, 0x40
mov dword [esp + 4], eax
call sym._messagebox
mov eax, dword [0x416e20]
xor edi, edi
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._RefreshTreeView
lea eax, [ebp - 0x181c]
mov dword [esp + 8], eax
mov eax, dword [0x416e20]
mov dword [esp + 4], edi
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
mov ebx, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x181c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._RefreshListView
jmp 0x405170
mov esi, 3
jmp 0x405122
lea eax, [ebp - 0x182c]
mov dword [esp + 8], eax
lea ebx, [ebp - 0x1018]
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
mov dword [esp + 0xc], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
mov esi, eax
mov eax, dword [ebp - 0x182c]
mov dword [esp + 4], eax
call sym._CreateKey
test eax, eax
jne 0x405ca8
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
jmp 0x40517a
lea eax, [ebp - 0x1018]
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax]
mov dword [esp], eax
call sym._GetClientRect_8
mov eax, dword [0x416e20]
mov edx, dword [ebp - 0x100c]
mov edi, dword [ebp - 0x1018]
mov esi, dword [eax + 0x10]
mov ebx, edx
shr ebx, 0x1f
sub esp, 8
add ebx, edx
sar ebx, 1
add esi, edi
mov dword [ebp - 0x1818], esi
lea edx, [ebp - 0x1818]
mov dword [ebp - 0x1814], ebx
mov dword [esp + 4], edx
mov eax, dword [eax]
mov dword [esp], eax
call sym._ClientToScreen_8
sub esp, 8
test eax, eax
je case.0x404f1a.32825
mov eax, dword [ebp - 0x1814]
shl ebx, 0x10
movzx esi, si
or ebx, esi
mov esi, 0x201
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1818]
mov dword [esp], eax
call sym._SetCursorPos_8
mov ecx, 0x7f84
sub esp, 8
mov dword [esp + 4], ecx
mov dword [esp], 0
call sym._LoadCursorW_8
sub esp, 8
mov dword [esp], eax
call sym._SetCursor_4
mov eax, dword [0x416e20]
sub esp, 4
mov dword [esp + 0xc], ebx
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [eax]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
jmp case.0x404f1a.32825
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemFullPath
test eax, eax
mov ebx, eax
je case.0x404f1a.32825
mov dword [esp], edi
call sym._OpenClipboard_4
sub esp, 4
test eax, eax
je 0x405170
call sym._EmptyClipboard_0
test eax, eax
je 0x4056fe
cmp word [ebx], 0
mov eax, ebx
je 0x405699
nop
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x405690
mov dword [esp], 0x42
sub eax, ebx
add eax, 2
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_GlobalAlloc]
sub esp, 8
mov esi, eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov ecx, eax
sub esp, 4
xor eax, eax
lea esi, [esi]
lea edi, [edi]
movzx edx, word [ebx + eax]
mov word [ecx + eax], dx
add eax, 2
test edx, edx
jne 0x4056d0
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], 0xd
call sym._SetClipboardData_8
sub esp, 8
call sym._CloseClipboard_0
jmp 0x405170
lea eax, [ebp - 0x182c]
xor edi, edi
mov dword [esp + 8], eax
mov eax, dword [0x416e20]
mov dword [esp + 4], edi
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
test eax, eax
mov ebx, eax
je 0x405738
cmp word [eax], 0
jne 0x405cdf
mov dword [esp], 0x10
call sym._MessageBeep_4
sub esp, 4
jmp 0x405170
mov dword [esp], edi
mov ebx, 1
call sym._DestroyWindow_4
sub esp, 4
jmp 0x405113
mov dword [esp], edi
call sym._ShowAboutBox
jmp case.0x404f1a.32825
mov dword [esp], edi
xor eax, eax
mov ebx, 1
mov dword [esp + 0xc], eax
mov eax, 0xb
mov dword [esp + 8], eax
mov eax, 0x4122aa
mov dword [esp + 4], eax
call sym._WinHelpW_16
sub esp, 0x10
jmp 0x405113
xor edx, edx
xor eax, eax
mov dword [ebp + eax - 0x1008], edx
mov dword [ebp + eax - 0x1004], edx
add eax, 8
cmp eax, 0x30
jb 0x40579f
xor edx, edx
mov ecx, 0x42
mov word [ebp + eax - 0x1008], dx
mov eax, 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x1000], eax
mov eax, 0xffff0001
xor esi, esi
mov dword [ebp - 0xffc], eax
mov eax, 1
mov word [ebp - 0xff8], ax
lea eax, [ebp - 0x1018]
mov dword [ebp - 0x1014], edi
mov edi, 0x40100
mov dword [esp], eax
mov dword [ebp - 0x1018], ecx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], esi
mov dword [ebp - 0x1004], edi
call sym._PrintDlgW_4
sub esp, 4
test eax, eax
je case.0x404f1a.32825
test byte [0x411030], 1
jne 0x406000
mov eax, dword [ebp - 0x1008]
mov dword [esp], eax
call sym._DeleteDC_4
sub esp, 4
jmp case.0x404f1a.32825
mov dword [esp + 8], edi
xor eax, eax
mov edx, 0x86
mov dword [esp + 0x10], eax
mov eax, sym._removefavorite_dlgproc_16
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], 0
call sym._DialogBoxParamW_20
sub esp, 0x14
cmp eax, 1
mov ebx, eax
jne case.0x404f1a.32825
mov dword [esp], 0x80000001
lea eax, [ebp - 0x1018]
mov dword [esp + 0x10], eax
mov eax, 0x2001f
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp + 4], eax
call sym._RegOpenKeyExW_20
sub esp, 0x14
test eax, eax
jne 0x405113
mov eax, dword [ebp - 0x1018]
mov edi, 0x4168e0
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._RegDeleteValueW_8
mov eax, dword [ebp - 0x1018]
sub esp, 8
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x405113
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._GetValueName
mov ebx, eax
lea eax, [ebp - 0x182c]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
mov dword [esp], edi
mov dword [esp + 0xc], ebx
mov edi, dword fs:[0x18]
mov dword [esp + 8], eax
mov esi, eax
mov eax, dword [ebp - 0x182c]
mov dword [esp + 4], eax
call sym._ModifyValue
xor eax, eax
mov dword [esp + 8], esi
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
xor eax, eax
sub esp, 0xc
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [edi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp case.0x404f1a.32825
call sym._GetFocus_0
mov ebx, eax
mov eax, dword [0x416e20]
mov edx, dword [eax + 4]
cmp ebx, edx
je 0x405f92
cmp ebx, dword [eax + 8]
je 0x405d14
mov dword [esp + 4], ebx
mov dword [esp], edx
call sym._IsChild_8
sub esp, 8
test eax, eax
jne 0x4059ca
mov dword [esp + 4], ebx
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._IsChild_8
sub esp, 8
test eax, eax
je case.0x404f1a.32825
xor eax, eax
mov edx, 0x2e
mov dword [esp], ebx
mov ecx, 0x100
mov ebx, 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x405113
lea eax, [ebp - 0x182c]
xor ecx, ecx
mov dword [esp + 8], eax
mov eax, dword [0x416e20]
xor esi, esi
mov dword [esp + 4], ecx
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
mov ebx, eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._RefreshTreeView
mov eax, dword [ebp - 0x182c]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
jmp 0x4054ec
mov ebx, dword [0x416ec4]
mov dword [esp], ebx
call sym._IsWindowVisible_4
sub esp, 4
mov esi, eax
mov eax, 2
mov dword [esp + 4], eax
mov eax, dword [0x416ecc]
mov dword [esp], eax
call sym._GetSubMenu_8
sub esp, 8
test esi, esi
je 0x405c30
mov dword [esp], eax
xor edx, edx
mov ecx, 0x8006
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sym._CheckMenuItem_12
xor eax, eax
sub esp, 0xc
mov dword [esp], ebx
lea ebx, [ebp - 0x1018]
mov dword [esp + 4], eax
call sym._ShowWindow_8
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._GetClientRect_8
mov edx, ebx
mov eax, edi
mov ebx, 1
sub esp, 8
call sym._resize_frame_rect
jmp 0x405113
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemFullPath
test eax, eax
mov ebx, eax
je case.0x404f1a.32825
mov dword [esp + 8], edi
mov eax, sym._addtofavorites_dlgproc_16
xor esi, esi
mov dword [esp + 0xc], eax
mov eax, 0x85
mov dword [esp + 0x10], esi
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._DialogBoxParamW_20
sub esp, 0x14
dec eax
jne 0x405170
xor eax, eax
xor edx, edx
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1018]
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegeditFavorites
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov eax, 0x2001f
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], 0x80000001
call sym._RegCreateKeyExW_36
sub esp, 0x24
test eax, eax
jne 0x405170
cmp word [ebx], 0
mov eax, ebx
je 0x405b89
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x405b80
sub eax, ebx
mov ecx, 1
add eax, 2
xor esi, esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1018]
mov edi, 0x4168e0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._RegSetValueExW_24
mov eax, dword [ebp - 0x1018]
sub esp, 0x18
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x405170
mov dword [esp + 4], esi
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._FindPathInTree
mov dword [esp + 0xc], eax
mov eax, 9
mov dword [esp + 8], eax
mov eax, 0x110b
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x40539a
call sym._CommDlgExtendedError_0
jmp case.0x404f1a.32825
mov dword [esp], eax
mov edx, 0x8006
mov esi, 8
mov dword [esp + 8], esi
mov dword [esp + 4], edx
call sym._CheckMenuItem_12
mov eax, 5
sub esp, 0xc
jmp 0x405a8e
call sym._CommDlgExtendedError_0
jmp 0x4054aa
mov eax, dword [ebp - 0x17fc]
mov edx, 0x67
mov ecx, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
mov dword [esp + 0x10], eax
mov eax, 0x7e3
mov dword [esp + 0xc], eax
call sym._messagebox
jmp case.0x404f1a.32825
mov dword [esp + 8], ebx
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._InsertNode
test eax, eax
je 0x405559
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._StartKeyRename
jmp 0x405559
call sym._GetFocus_0
mov edx, dword [0x416e20]
cmp eax, dword [edx + 4]
je 0x40602c
call sym._GetFocus_0
mov edx, dword [0x416e20]
cmp eax, dword [edx + 8]
jne 0x405170
mov dword [esp], eax
call sym._StartValueRename
jmp 0x405170
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], eax
mov ecx, 0x1032
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
je case.0x404f1a.32825
mov dword [esp], edi
dec eax
setne al
movzx eax, al
lea eax, [eax + eax + 0x8049]
mov dword [esp + 0xc], eax
mov eax, 0x8048
mov dword [esp + 8], eax
mov eax, 0x34
mov dword [esp + 4], eax
call sym._messagebox
cmp eax, 6
jne case.0x404f1a.32825
mov dword [esp + 4], 0
lea eax, [ebp - 0x182c]
mov dword [esp + 8], eax
mov eax, dword [0x416e20]
mov esi, dword fs:[0x18]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._GetItemPath
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x100c
mov dword [ebp - 0x183c], eax
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
mov dword [ebp - 0x1844], eax
mov eax, dword [0x416e20]
sub esp, 0x10
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x100c
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
je 0x40608a
mov dword [ebp - 0x1840], edi
jmp 0x405e48
mov eax, 0x100c
mov ebx, 2
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov edi, 0xffffffff
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
cmp eax, 0xffffffff
mov ebx, eax
je 0x40608a
mov dword [esp + 4], ebx
mov eax, dword [0x416e20]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._GetItemText
mov dword [esp + 0xc], eax
mov edi, eax
mov eax, dword [ebp - 0x183c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x182c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1840]
mov dword [esp], eax
call sym._DeleteValue
test eax, eax
je 0x406066
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], edi
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
mov dword [esp + 0xc], eax
mov eax, 0x1008
mov dword [esp + 4], eax
mov eax, dword [0x416e20]
mov dword [esp + 8], ebx
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
test ebx, ebx
jne 0x405e0f
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 8], eax
mov eax, dword [0x416e20]
mov dword [esp + 4], edx
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._AddEntryToList
mov ecx, dword [ebp - 0x1844]
test ecx, ecx
jne 0x405e0f
mov dword [ebp - 0x1008], 1
lea eax, [ebp - 0x1018]
mov dword [esp + 0xc], eax
mov eax, dword [0x416e20]
mov dword [ebp - 0x100c], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x102b
mov eax, dword [eax + 8]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x405e0f
xor ebx, ebx
mov eax, 0x87
mov dword [esp + 0x10], ebx
mov esi, sym._find_dlgproc_16
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._DialogBoxParamW_20
sub esp, 0x14
dec eax
jne case.0x404f1a.32825
jmp 0x404f2d
mov dword [esp], ebx
lea eax, [ebp - 0x182c]
xor esi, esi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call sym._GetItemPath
test eax, eax
mov ebx, eax
je 0x405738
cmp word [eax], 0
je 0x405738
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x182c]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._DeleteKey
test eax, eax
je 0x405170
mov dword [esp + 4], 0
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._DeleteNode
jmp 0x405170
mov dword [esp], 0
mov eax, str.PrintRegistryHive
mov edi, str.printing_is_not_yet_implemented._n
mov dword [esp + 8], eax
mov eax, 0x411030
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
call sym._wine_dbg_log.constprop.0_1
jmp 0x405833
mov dword [esp], eax
call sym._StartKeyRename
jmp 0x405170
mov dword [esp + 0x10], 0x4167e0
mov dword [esp + 0xc], 0x804a
mov dword [esp + 8], 0x67
mov dword [esp + 4], 0x40
mov dword [esp], edi
call sym._messagebox
jmp case.0x404f1a.32825
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x183c]
mov ebx, 1
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x405113
mov eax, dword [0x416e20]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym._SetFocus_4
push edx
jmp case.0x404f1a.32825