Function at 0x4117b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415662
mov eax, dword fs:[0]
push eax
sub esp, 0x104
mov eax, dword [0x41e010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
push dword [ebp - 0xd4]
mov edx, dword [ebx + 4]
push ecx
mov ecx, dword [ebx]
call fcn.00402da0
mov eax, dword [ebx]
add esp, 8
mov ecx, dword [ebx + 8]
sub ecx, eax
mov dword [ebx + 4], eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x10
jae 0x411821
push 0x10
mov ecx, ebx
call fcn.004022a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xe0]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlClass
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xe0], 0
call edi
cmp dword [esi + 0x14], 8
mov dword [ebp - 0xd0], 0
jb 0x41185d
mov esi, dword [esi]
lea eax, [ebp - 0xd0]
push eax
push 0x20019
push 0
push esi
push dword [ebp - 0xe0]
call edi
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], 0
push eax
push 0x20019
push 0
push str.Events
push dword [ebp - 0xd0]
call edi
mov dword [ebp - 0xdc], 0
xor eax, eax
lea ecx, [ebp - 0xf8]
push pe_nt_image_headers32
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
call fcn.004019d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0xf4]
mov esi, dword [ebp - 0xf8]
sub eax, esi
sar eax, 1
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xfc]
push eax
push esi
push dword [ebp - 0xdc]
push dword [ebp - 0xcc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x411eb8
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc8]
push eax
push 0x20019
push 0
push esi
push dword [ebp - 0xcc]
call edi
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], ax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
xor edx, edx
lea ecx, [ebp - 0xc8]
call fcn.00412370
xor eax, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 2
push eax
mov edx, str.GUID
lea ecx, [ebp - 0xc8]
call fcn.00412370
mov eax, dword [ebp - 0x60]
add esp, 8
cmp dword [ebp - 0x4c], 8
jae 0x411997
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
xor edi, edi
jmp 0x4119b0
xor eax, eax
lea ecx, [ebp - 0xec]
push pe_nt_image_headers32
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
call fcn.004019d0
mov eax, dword [ebp - 0xe8]
mov esi, dword [ebp - 0xec]
sub eax, esi
sar eax, 1
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x100]
push eax
push esi
push edi
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x411b63
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xc4]
push eax
push 0x20019
push 0
push esi
push dword [ebp - 0xc8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0xc4], 0
je 0x411b28
xor eax, eax
mov dword [ebp - 0xac], 7
mov dword [ebp - 0xb0], 0
mov word [ebp - 0xc0], ax
mov dword [ebp - 0x94], 7
mov dword [ebp - 0x98], eax
mov word [ebp - 0xa8], ax
mov dword [ebp - 0x7c], 7
mov dword [ebp - 0x80], eax
mov word [ebp - 0x90], ax
mov dword [ebp - 0x64], 7
mov dword [ebp - 0x68], eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0xa8]
mov byte [ebp - 4], 4
push eax
mov edx, str.CmdLine
lea ecx, [ebp - 0xc4]
call fcn.00412370
lea eax, [ebp - 0xc0]
mov edx, str.Name
push eax
lea ecx, [ebp - 0xc4]
call fcn.00412370
lea eax, [ebp - 0x90]
mov edx, str.Desc
push eax
lea ecx, [ebp - 0xc4]
call fcn.00412370
lea eax, [ebp - 0x78]
mov edx, str.Icon
push eax
lea ecx, [ebp - 0xc4]
call fcn.00412370
add esp, 0x10
cmp dword [ebp - 0x98], 0
je 0x411b07
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401710
push dword [ebp - 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xc4], 0
call fcn.00401440
mov byte [ebp - 4], 2
test esi, esi
je 0x411b57
push esi
call fcn.00403e5a
add esp, 4
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
inc edi
cmp edi, 0x20
jl 0x4119b0
jmp 0x411b92
mov byte [ebp - 4], 2
test esi, esi
je 0x411b92
push esi
call fcn.00403e5a
add esp, 4
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov esi, dword [ebx + 4]
lea eax, [ebp - 0x48]
cmp eax, esi
jae 0x411ccf
mov eax, dword [ebx]
lea ecx, [ebp - 0x48]
cmp eax, ecx
ja 0x411ccf
sub ecx, eax
mov eax, 0x92492493
imul ecx
mov eax, dword [ebx + 8]
add edx, ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
cmp esi, eax
jne 0x411c58
mov ecx, eax
mov eax, 0x92492493
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jae 0x411c58
mov ecx, dword [ebx]
mov eax, 0x92492493
sub esi, ecx
imul esi
mov eax, 0x4924924
add edx, esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
sub eax, esi
cmp eax, 1
jb 0x411eae
inc esi
mov eax, 0x92492493
mov dword [ebp - 0xd4], esi
mov esi, dword [ebx + 8]
sub esi, ecx
imul esi
mov eax, 0x4924924
add edx, esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x411c42
xor ecx, ecx
jmp 0x411c44
add ecx, edx
mov eax, dword [ebp - 0xd4]
cmp ecx, eax
jae 0x411c50
mov ecx, eax
push ecx
mov ecx, ebx
call fcn.004022a0
mov eax, dword [ebx]
lea ecx, [edi*8]
mov esi, dword [ebx + 4]
sub ecx, edi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd8], esi
lea edi, [eax + ecx*8]
mov byte [ebp - 4], 5
test esi, esi
je 0x411db8
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.00401bc0
mov byte [ebp - 4], 6
lea ecx, [esi + 0x28]
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
lea eax, [edi + 0x28]
push eax
call fcn.00402f10
mov eax, dword [edi + 0x34]
jmp 0x411db5
mov edi, dword [ebx + 8]
cmp esi, edi
jne 0x411d52
mov ecx, edi
mov eax, 0x92492493
sub ecx, esi
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jae 0x411d52
sub esi, dword [ebx]
mov eax, 0x92492493
imul esi
mov eax, 0x4924924
add edx, esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
sub eax, ecx
cmp eax, 1
jb 0x411eae
sub edi, dword [ebx]
lea esi, [ecx + 1]
mov eax, 0x92492493
imul edi
mov eax, 0x4924924
add edx, edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x411d42
xor ecx, ecx
jmp 0x411d44
add ecx, edx
cmp ecx, esi
jae 0x411d4a
mov ecx, esi
push ecx
mov ecx, ebx
call fcn.004022a0
mov esi, dword [ebx + 4]
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd8], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x411db8
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
mov dword [esi + 0x10], 0
mov ecx, esi
push eax
mov word [esi], ax
lea eax, [ebp - 0x48]
push eax
call fcn.00401bc0
mov byte [ebp - 4], 8
lea ecx, [esi + 0x28]
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x24], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00402f10
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x34], eax
push dword [ebp - 0xc8]
add dword [ebx + 4], 0x38
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x4c], 8
mov dword [ebp - 0xc8], 0
jb 0x411de3
push dword [ebp - 0x60]
call fcn.00403e5a
add esp, 4
mov esi, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
test esi, esi
je 0x411e34
mov edi, dword [ebp - 0x1c]
cmp esi, edi
je 0x411e16
mov ecx, esi
call fcn.00401440
add esi, 0x60
cmp esi, edi
jne 0x411e05
mov esi, dword [ebp - 0x20]
push esi
call fcn.00403e5a
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x34], 8
jb 0x411e45
push dword [ebp - 0x48]
call fcn.00403e5a
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x48], ax
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
test eax, eax
je 0x411e91
push eax
call fcn.00403e5a
add esp, 4
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp eax, 0x10
jge 0x411ec5
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x4118a3
push str.vector_T__too_long
call fcn.00403604
test esi, esi
je 0x411ec5
push esi
call fcn.00403e5a
add esp, 4
push dword [ebp - 0xcc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xd0]
mov dword [ebp - 0xcc], 0
call esi
push dword [ebp - 0xe0]
mov dword [ebp - 0xd0], 0
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403660
mov esp, ebp
pop ebp
ret