Function at 0x419220
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6ecd
mov eax, dword fs:[0]
push eax
sub esp, 0x50c
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 0x514]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x4e8], 0
call fcn.00443cd0
mov dword [ebp - 4], 0
call fcn.004178a0
test al, al
jne 0x4192f8
mov edi, dword [0x521340]
mov eax, edi
cdq
sub eax, edx
xor ecx, ecx
mov ebx, eax
sar ebx, 1
mov esi, 0x24
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4c0], ebx
lea esp, [esp]
test ebx, ebx
jle 0x4192ed
mov eax, edi
cdq
and edx, 3
lea edi, [edx + eax]
sar edi, 2
xor edx, edx
test edi, edi
jle 0x4192dc
mov eax, edx
mov ecx, edi
lea ebx, [ebx]
add esi, eax
dec eax
dec ecx
jne 0x4192d0
mov ecx, dword [ebp - 0x4d4]
add edx, ecx
dec ebx
jne 0x4192c2
mov ebx, dword [ebp - 0x4c0]
mov edi, dword [0x521340]
inc ecx
mov dword [ebp - 0x4d4], ecx
cmp ecx, esi
jl 0x4192b0
push str.success
lea ecx, [ebp - 0x4f8]
call fcn.00443c90
lea eax, [ebp - 0x4f8]
push eax
push 0x4da4ec
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 1
call fcn.00444170
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0
call fcn.00443ee0
call fcn.00417b40
test al, al
jne 0x4193a5
xor esi, esi
call fcn.004a8009
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x324], xmm0
cmp esi, 0x61
jb 0x419344
xor ecx, ecx
mov eax, 0x60
cmp ecx, eax
jge 0x41939f
jmp 0x419370
movsd xmm0, qword [ebp + eax*8 - 0x31c]
movsd xmm1, qword [ebp + eax*8 - 0x324]
comisd xmm0, xmm1
jbe 0x41939a
movsd qword [ebp + eax*8 - 0x31c], xmm1
movsd qword [ebp + eax*8 - 0x324], xmm0
dec eax
cmp eax, ecx
jg 0x419370
inc ecx
cmp ecx, 0x61
jl 0x419362
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x4fc], esi
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov byte [ebp - 4], 2
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x4d4], ebx
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov byte [ebp - 4], 3
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x500], edi
mov ecx, dword [ebp - 0x4cc]
push str.hive
mov byte [ebp - 4], 5
call fcn.00444250
sub esp, 0x18
mov ecx, eax
push esp
call fcn.00444a40
lea eax, [ebp - 0x4e4]
push eax
call fcn.0044ff60
add esp, 0x1c
mov edx, dword [eax]
lea ecx, [esi - 0x10]
lea eax, [edx - 0x10]
mov byte [ebp - 4], 6
mov dword [ebp - 0x4c4], ecx
cmp eax, ecx
je 0x41950c
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x4d0], eax
jl 0x4194f7
mov eax, dword [edx - 0x10]
lea esi, [edx - 0x10]
mov dword [ebp - 0x4c0], eax
cmp eax, dword [ecx]
jne 0x4194f7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c0]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x419483
cmp ecx, dword [esi]
jne 0x419483
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4194cc
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x4c0], edx
test edx, edx
jne 0x41949d
call fcn.0040c350
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a8205
mov esi, dword [ebp - 0x4c0]
add esp, 0x10
mov ecx, dword [ebp - 0x4d0]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4194ec
mov edx, dword [ebp - 0x4c4]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0x4fc], esi
jmp 0x41950c
push dword [edx - 0xc]
lea ecx, [ebp - 0x4fc]
push edx
call fcn.004097a0
mov esi, dword [ebp - 0x4fc]
mov edx, dword [ebp - 0x4e4]
add edx, 0xfffffff0
or ecx, 0xffffffff
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419530
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
push ecx
mov ecx, dword [esi]
mov dword [ebp - 0x4d0], esp
mov eax, dword [ecx]
mov dword [ebp - 0x4e4], esi
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x419561
cmp ecx, dword [esi]
jne 0x419561
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4195aa
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x4c0], edx
test edx, edx
jne 0x41957b
call fcn.0040c350
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a8205
mov esi, dword [ebp - 0x4c0]
add esp, 0x10
mov ecx, dword [ebp - 0x4d0]
lea eax, [esi + 0x10]
mov dword [ecx], eax
call fcn.00415480
add esp, 4
mov dword [ebp - 0x4c0], eax
test eax, eax
jne 0x4196e1
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x4c4]
push str.readReg_hive_error_
push eax
call fcn.0040b870
add esp, 0xc
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x49c]
push eax
mov byte [ebp - 4], 7
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 8
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 9
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 8
call fcn.00443ee0
cmp dword [ebp - 0x488], 0x10
jb 0x419658
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x4c4]
add edx, 0xfffffff0
or esi, 0xffffffff
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41967e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41969b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4196b8
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4e4]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4196d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41a366
mov ecx, dword [ebp - 0x4cc]
push 0x4da994
call fcn.00444250
sub esp, 0x18
mov ecx, eax
push esp
call fcn.00444a40
lea eax, [ebp - 0x4dc]
push eax
call fcn.0044ff60
add esp, 0x1c
mov edx, dword [eax]
lea eax, [ebx - 0x10]
lea esi, [edx - 0x10]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x4c4], eax
cmp esi, eax
je 0x4197e2
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 0x4d0], ecx
jl 0x4197cd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x4197cd
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x419763
cmp ecx, dword [esi]
jne 0x419763
mov ebx, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4197a0
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov ebx, eax
test ebx, ebx
jne 0x419777
call fcn.0040c350
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.004a8205
add esp, 0x10
mov ecx, dword [ebp - 0x4d0]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4197c2
mov edx, dword [ebp - 0x4c4]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0x10
mov dword [ebp - 0x4d4], ebx
jmp 0x4197e5
push dword [edx - 0xc]
lea ecx, [ebp - 0x4d4]
push edx
call fcn.004097a0
mov ebx, dword [ebp - 0x4d4]
or esi, 0xffffffff
mov edx, dword [ebp - 0x4dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419808
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4cc]
push 0x4da998
call fcn.00444250
sub esp, 0x18
mov ecx, eax
push esp
call fcn.00444a40
lea eax, [ebp - 0x4d8]
push eax
call fcn.0044ff60
add esp, 0x1c
mov edx, dword [eax]
lea ecx, [edi - 0x10]
lea eax, [edx - 0x10]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x4c4], ecx
cmp eax, ecx
je 0x419920
cmp dword [ecx + 0xc], 0
lea eax, [ecx + 0xc]
mov dword [ebp - 0x4d0], eax
jl 0x41990b
mov eax, dword [edx - 0x10]
lea edi, [edx - 0x10]
mov dword [ebp - 0x4dc], eax
cmp eax, dword [ecx]
jne 0x41990b
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4dc]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
mov ecx, eax
jl 0x419898
cmp ecx, dword [edi]
jne 0x419898
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4198e1
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x4dc], edx
test edx, edx
jne 0x4198b2
call fcn.0040c350
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.004a8205
mov edi, dword [ebp - 0x4dc]
add esp, 0x10
mov ecx, dword [ebp - 0x4d0]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x419900
mov edx, dword [ebp - 0x4c4]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0x10
mov dword [ebp - 0x500], edi
jmp 0x419920
push dword [edx - 0xc]
lea ecx, [ebp - 0x500]
push edx
call fcn.004097a0
mov edi, dword [ebp - 0x500]
mov edx, dword [ebp - 0x4d8]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419943
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4cc]
xor eax, eax
push 0x4da9a0
mov dword [ebp - 0x4d0], eax
call fcn.004452a0
test al, al
je 0x41997e
mov ecx, dword [ebp - 0x4cc]
push 0x4da9a0
call fcn.00444250
mov ecx, eax
call fcn.00444940
mov dword [ebp - 0x4d0], eax
jmp 0x419980
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x4c4], ecx
cmp eax, 0x20
je 0x4199a7
test eax, eax
je 0x4199a7
cmp eax, 0x40
jne 0x4199b6
mov ecx, 0x20119
mov dword [ebp - 0x4c4], 0x20219
jmp 0x4199b6
mov ecx, 0x20219
mov dword [ebp - 0x4c4], 0x20119
lea eax, [ebp - 0x4e8]
push eax
push ecx
push 0
push ebx
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
cmp ecx, 2
jne 0x4199fc
mov eax, dword [ebp - 0x4d0]
test eax, eax
jne 0x419a04
lea eax, [ebp - 0x4e8]
push eax
push dword [ebp - 0x4c4]
push 0
push ebx
push dword [ebp - 0x4c0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x419b48
push ecx
lea eax, [ebp - 0x4d8]
push eax
call fcn.0043f5e0
add esp, 8
push eax
lea eax, [ebp - 0x4c0]
push 0x4da9a4
push eax
mov byte [ebp - 4], 0xc
call fcn.0040b870
add esp, 0xc
mov edx, dword [ebp - 0x4d8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419a50
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0xf
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x10
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0xf
call fcn.00443ee0
cmp dword [ebp - 0x488], 0x10
jb 0x419abe
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x4c0]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419ae1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419afe
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419b1b
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4e4]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4196d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41a366
lea eax, [ebp - 0x4e0]
push eax
push 0
lea eax, [ebp - 0x504]
push eax
push 0
push edi
push dword [ebp - 0x4e8]
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x4e0], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x419cc7
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.0043f5e0
add esp, 8
push eax
lea eax, [ebp - 0x4c0]
push str.readReg_RegQueryValueEx_gen_
push eax
mov byte [ebp - 4], 0x11
call fcn.0040b870
add esp, 0xc
mov edx, dword [ebp - 0x4d8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419bcf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x14
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x15
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x14
call fcn.00443ee0
cmp dword [ebp - 0x488], 0x10
jb 0x419c3d
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x4c0]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419c60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419c7d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419c9a
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4e4]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4196d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41a366
mov eax, dword [ebp - 0x504]
cmp eax, 4
jne 0x419faf
call fcn.004179f0
test al, al
jne 0x419d82
xor ecx, ecx
mov dword [ebp - 0x4cc], ecx
lea eax, [ebp - 0x484]
xor edx, edx
mov dword [ebp - 0x4c0], edx
mov dword [ebp - 0x4c4], eax
nop
mov esi, dword [0x521340]
lea eax, [edx + 1]
mov dword [ebp - 0x4d8], eax
inc ecx
mov eax, esi
cdq
idiv ecx
mov ecx, esi
sub ecx, dword [ebp - 0x4cc]
mov eax, esi
mov esi, dword [ebp - 0x4d8]
imul edx, ecx
mov dword [ebp - 0x4dc], edx
cdq
idiv esi
mov ecx, dword [ebp - 0x4dc]
add ecx, eax
sub ecx, dword [ebp - 0x4c0]
push ecx
push 0x4da4e0
call fcn.004a90ce
mov eax, dword [ebp - 0x4c4]
mov ecx, dword [ebp - 0x4cc]
mov edx, esi
add eax, 4
add esp, 8
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4c4], eax
cmp edx, 0xf
jl 0x419d00
inc ecx
mov dword [ebp - 0x4cc], ecx
cmp ecx, 6
jl 0x419cf1
or esi, 0xffffffff
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x504]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push edi
push dword [ebp - 0x4e8]
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4c8], 4
call eax
test eax, eax
je 0x419f07
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.0043f5e0
add esp, 8
push eax
lea eax, [ebp - 0x4c0]
push str.readReg_RegQueryValueEx_dword_
push eax
mov byte [ebp - 4], 0x16
call fcn.0040b870
add esp, 0xc
mov edx, dword [ebp - 0x4d8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x18
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419e0f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x19
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x1a
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x19
call fcn.00443ee0
cmp dword [ebp - 0x488], 0x10
jb 0x419e7d
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x4c0]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419ea0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419ebd
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419eda
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4e4]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4196d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41a366
push dword [ebp - 0x4d0]
lea ecx, [ebp - 0x4f8]
call fcn.00443c30
push 0x4daa4c
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x1b
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 5
call fcn.00443ee0
add edi, 0xfffffff0
mov dword [ebp - 4], 3
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419f69
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419f86
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4e4]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a366
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41a366
cmp eax, 1
jne 0x419f49
mov eax, dword [ebp - 0x4e0]
inc eax
xor ecx, ecx
mov dword [ebp - 0x4e0], eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
mov ecx, dword [ebp - 0x4e0]
add esp, 4
add ecx, ecx
push ecx
push 0
push eax
mov dword [ebp - 0x4c4], eax
call fcn.004a8550
mov eax, dword [ebp - 0x4e0]
add esp, 0xc
add eax, eax
mov dword [ebp - 0x4e0], eax
lea eax, [ebp - 0x4e0]
push eax
push dword [ebp - 0x4c4]
lea eax, [ebp - 0x504]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0
push edi
push dword [ebp - 0x4e8]
call eax
test eax, eax
jne 0x41a16f
mov eax, dword [ebp - 0x4e0]
mov ecx, dword [ebp - 0x4c4]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x4cc], eax
mov edx, dword [ebp - 0x4c4]
mov byte [ebp - 4], 0x1c
test edx, edx
je 0x41a0b8
test edx, 0xffff0000
jne 0x41a098
movzx eax, dx
push 0
push eax
mov dword [ebp - 0x4c8], eax
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x41a0c7
push dword [ebp - 0x4c8]
lea ecx, [ebp - 0x4cc]
push eax
call fcn.004075c0
jmp 0x41a0c7
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x4c8], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41a0a3
sub ecx, dword [ebp - 0x4c8]
sar ecx, 1
jmp 0x41a0ba
xor ecx, ecx
push ecx
push edx
lea ecx, [ebp - 0x4cc]
call fcn.004097a0
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x49c]
push eax
mov byte [ebp - 4], 0x1d
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x1e
call fcn.00443bf0
push 0x4daa4c
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x1f
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x1e
call fcn.00443ee0
cmp dword [ebp - 0x488], 0x10
jb 0x41a139
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x4cc]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a15c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x4c4]
call fcn.004a8200
add esp, 4
jmp 0x419f49
push eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.0043f5e0
add esp, 8
push eax
lea eax, [ebp - 0x4c0]
push str.readReg_RegQueryValueEx_str_
push eax
mov byte [ebp - 4], 0x20
call fcn.0040b870
add esp, 0xc
mov edx, dword [ebp - 0x4c8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x22
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a1bb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.00450030
add esp, 8
push eax
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x23
call fcn.00443bf0
push 0x4da4ec
lea ecx, [ebp - 0x514]
mov byte [ebp - 4], 0x24
call fcn.00444170
lea ecx, [ebp - 0x4f8]
push ecx
mov ecx, eax
call fcn.00443f80
lea ecx, [ebp - 0x4f8]
mov byte [ebp - 4], 0x23
call fcn.00443ee0
cmp dword [ebp - 0x488], 0x10
jb 0x41a229
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edx, dword [ebp - 0x4c0]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a24c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edi + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a269
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 2
lea eax, [ebx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a286
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4e4]
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4196d8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41a366
mov eax, dword [ebp - 0x4e8]
or ebx, 0xffffffff
test eax, eax
je 0x41a384
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4e8], 0
lea ecx, [ebp - 0x4bc]
call fcn.00445f40
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov byte [ebp - 4], 0x29
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d4], esi
mov byte [ebp - 4], 0x2a
call fcn.00417870
test al, al
jne 0x41a437
mov edi, dword [0x521340]
mov eax, 0x2c0b02c1
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x5d
mov eax, edi
sub eax, ecx
mov dword [ebp - 0x4c0], 0
cmp eax, 0xd2
je 0x41a42c
xor esi, esi
jmp 0x41a3f0
mov eax, edi
or eax, 0xffffffa1
add edi, eax
mov eax, edi
imul eax, edi
inc esi
cmp esi, eax
jg 0x41a420
mov eax, 0x2c0b02c1
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x5d
mov eax, edi
sub eax, ecx
cmp eax, 0xd2
jne 0x41a3f0
mov dword [ebp - 0x4c0], esi
mov esi, dword [ebp - 0x4d4]
mov eax, dword [ebp - 0x4c0]
mov dword [0x521340], eax
lea eax, [ebp - 0x514]
push eax
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x4bc]
call fcn.00448e50
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x2b
jb 0x41a45e
mov edx, dword [edx]
sub esp, 0x18
mov edi, esp
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
mov byte [edi], 0
cmp byte [edx], 0
jne 0x41a47d
xor ecx, ecx
jmp 0x41a495
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x4c8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a488
sub ecx, dword [ebp - 0x4c8]
push ecx
push edx
mov ecx, edi
call fcn.00401460
lea eax, [ebp - 0x4dc]
push eax
call fcn.0044ff60
add esp, 0x1c
mov edx, dword [eax]
lea eax, [esi - 0x10]
lea edi, [edx - 0x10]
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x4d8], eax
cmp edi, eax
je 0x41a581
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
mov dword [ebp - 0x4c8], ecx
jl 0x41a56c
mov ecx, dword [edi]
cmp ecx, dword [eax]
jne 0x41a56c
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x41a505
cmp ecx, dword [edi]
jne 0x41a505
mov esi, edi
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x41a542
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov esi, eax
test esi, esi
jne 0x41a519
call fcn.0040c350
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov ecx, dword [edi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.004a8205
add esp, 0x10
mov ecx, dword [ebp - 0x4c8]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41a561
mov edx, dword [ebp - 0x4d8]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0x10
mov dword [ebp - 0x4d4], esi
jmp 0x41a581
push dword [edx - 0xc]
lea ecx, [ebp - 0x4d4]
push edx
call fcn.004097a0
mov esi, dword [ebp - 0x4d4]
mov edx, dword [ebp - 0x4dc]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x2b
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41a5a4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x488], 0x10
mov byte [ebp - 4], 0x2a
jb 0x41a5bf
push dword [ebp - 0x49c]
call fcn.004a6c2e
add esp, 4
mov edi, dword [ebp - 0x518]
mov eax, 8
mov word [edi], ax
mov ecx, dword [0x521340]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 0xf
jne 0x41a5f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x521340], eax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41a604
call fcn.0040c350
add esi, 0xfffffff0
mov dword [edi + 8], eax
mov byte [ebp - 4], 0x29
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x41a622
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x4a4], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x4bc], 0x4da4e4
jb 0x41a647
push dword [ebp - 0x4b8]
call fcn.004a6c2e
add esp, 4
lea ecx, [ebp - 0x4bc]
mov dword [ebp - 0x4a4], 0xf
mov dword [ebp - 0x4a8], 0
mov byte [ebp - 0x4b8], 0
call fcn.00446040
lea ecx, [ebp - 0x514]
mov dword [ebp - 4], 0xffffffff
call fcn.00443ee0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret