Function at 0x4018f6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28c
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 8]
push edi
push 0x13
pop ecx
push 5
mov esi, str.SOFTWARETencent_bugReportQQExternal
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.QQExternal
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x278]
push eax
push 0x20019
movsw word es:[edi], word [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x68]
push eax
push closesocket
mov dword [ebp - 0x278], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401ac5
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 4
pop ebx
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x274]
push eax
push esi
push str.auto
push dword [ebp - 0x278]
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x274], esi
call edi
test eax, eax
jne 0x401ab8
cmp dword [ebp - 0x274], ebx
jne 0x401ab8
cmp dword [ebp - 0x284], 1
jne 0x401ab8
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x274]
push eax
push esi
push str.version
push dword [ebp - 0x278]
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x274], esi
call edi
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x274]
push eax
push esi
push 0x4088b0
push dword [ebp - 0x278]
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x274], esi
call edi
xor eax, eax
push 0x206
mov word [ebp - 0x270], ax
lea eax, [ebp - 0x26e]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_TXLog::GetSession_void_]
push eax
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_NLS::GetLCID_void_]
push eax
push 1
push 1
push dword [ebp - 0x280]
lea eax, [ebp - 0x270]
push esi
push esi
push dword [ebp - 0x28c]
push eax
lea eax, [ebp - 0x1c]
push eax
push eax
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::InitBugReport_wchar_t_const___wchar_t_const___wchar_t_const___wchar_t_const___unsigned_short_int__unsigned_short_int__unsigned_long_int__int__int__unsigned_long_int__unsigned_long_int__int____stdcall___struct_TXBugReport::tagBugReportInfo___char_const___char_const___wchar_t_const___wchar_t_const___void____unsigned_long_int___void___]
push 3
call dword [sym.imp.Common.dll_int___cdecl_TXBugReport::SetBugReportFlag_unsigned_long_int_]
push esi
push dword [ebp - 0x288]
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::SetBugReportUin_unsigned_long_int__int_]
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::ValidateBugReport_void_]
push dword [ebp - 0x280]
lea eax, [ebp - 0x1c]
push eax
call fcn.00404b0b
add esp, 0x44
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.004073f8
leave
ret