Function at 0x414a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479adb
mov eax, dword fs:[0]
push eax
sub esp, 0xa74
mov eax, dword [0x499104]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa80], edi
mov dword [ebp - 0xa5c], edi
mov dword [ebp - 0xa60], 0
lea eax, [ebp - 0xa6c]
mov dword [ebp - 4], 1
push eax
call fcn.00414160
add esp, 4
push eax
lea ecx, [ebp - 0xa54]
mov byte [ebp - 4], 2
mov dword [ebp - 0xa58], str.pid
call fcn.00412eb0
mov dword [ebp - 0xa60], 2
mov edx, dword [ebp - 0xa6c]
or ebx, 0xffffffff
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414b05
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x49cec8], 0
jne 0x414c20
mov dword [ebp - 0xa7c], 0
mov dword [ebp - 0xa78], 0
mov dword [ebp - 0xa74], 0
push 0x20219
lea ecx, [ebp - 0xa61]
mov byte [ebp - 4], 5
call fcn.00413280
push eax
push 0x80000002
lea ecx, [ebp - 0xa7c]
call fcn.004144b0
mov edi, dword [ebp - 0xa7c]
test eax, eax
jne 0x414c0b
lea eax, [ebp - 0xa68]
mov dword [ebp - 0xa68], 0x800
push eax
lea eax, [ebp - 0xa20]
push eax
lea eax, [ebp - 0xa70]
push eax
push 0
push str.FROM
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x414c0b
mov eax, dword [ebp - 0xa70]
cmp eax, 1
je 0x414ba5
cmp eax, 2
jne 0x414c0b
mov eax, dword [ebp - 0xa68]
test eax, eax
je 0x414bc2
test al, 1
jne 0x414c0b
shr eax, 1
cmp word [ebp + eax*2 - 0xa22], 0
je 0x414bcb
jmp 0x414c0b
xor eax, eax
mov word [ebp - 0xa20], ax
mov ecx, 0x49cec8
lea esi, [ebp - 0xa20]
mov edx, 0x3ff
sub esi, ecx
nop dword [eax]
lea eax, [edx + 0x7ffffbff]
test eax, eax
je 0x414bfe
movzx eax, word [esi + ecx]
test ax, ax
je 0x414bfe
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x414be0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov byte [ebp - 4], 4
test edi, edi
je 0x414c1a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0xa5c]
call fcn.00403230
mov ecx, eax
test ecx, ecx
je 0x41508a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa5c], eax
push 0x49cec8
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 6
call fcn.00402cc0
test al, al
jne 0x414c80
mov ecx, 0x49cec8
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414c60
sub ecx, edx
sar ecx, 1
push ecx
push 0x49cec8
lea ecx, [ebp - 0xa5c]
call fcn.00403580
mov dword [ebp - 0xa60], 6
lea eax, [ebp - 0xa5c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xa4c]
mov dword [ebp - 0xa50], str.from
call fcn.00412eb0
mov dword [ebp - 0xa60], 0xe
mov edx, dword [ebp - 0xa5c]
mov eax, ebx
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414cd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x49d708], 0
jne 0x414cee
push 0x400
push 0x49d708
call fcn.004309a0
call fcn.00403230
mov ecx, eax
test ecx, ecx
je 0x415094
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa5c], eax
push 0x49d708
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 0xa
call fcn.00402cc0
test al, al
jne 0x414d50
mov ecx, 0x49d708
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414d30
sub ecx, edx
sar ecx, 1
push ecx
push 0x49d708
lea ecx, [ebp - 0xa5c]
call fcn.00403580
mov dword [ebp - 0xa60], 0x1e
lea eax, [ebp - 0xa5c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0xa44]
mov dword [ebp - 0xa48], str.mid
call fcn.00412eb0
mov dword [ebp - 0xa60], 0x3e
mov edx, dword [ebp - 0xa5c]
mov eax, ebx
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414da5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp word [0x49df08], 0
jne 0x414dbe
push 0x3ff
push 0x49df08
call fcn.004315e0
call fcn.00403230
mov ecx, eax
test ecx, ecx
je 0x41509e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa5c], eax
push 0x49df08
lea ecx, [ebp - 0xa5c]
mov byte [ebp - 4], 0xe
call fcn.00402cc0
test al, al
jne 0x414e20
mov ecx, 0x49df08
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414e00
sub ecx, edx
sar ecx, 1
push ecx
push 0x49df08
lea ecx, [ebp - 0xa5c]
call fcn.00403580
mov dword [ebp - 0xa60], 0x7e
lea eax, [ebp - 0xa5c]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0xa3c]
mov dword [ebp - 0xa40], str.mid2
call fcn.00412eb0
mov dword [ebp - 0xa60], 0xfe
mov edx, dword [ebp - 0xa5c]
mov eax, ebx
mov byte [ebp - 4], 0x11
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414e75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa61]
call fcn.004131a0
push eax
lea ecx, [ebp - 0xa34]
mov dword [ebp - 0xa38], str.app
call fcn.00402780
mov byte [ebp - 4], 0x12
call fcn.004138d0
push eax
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 0xa30], str.appver
call fcn.00402780
xor eax, eax
mov byte [ebp - 4], 0x13
cmp ax, word [0x49f000]
jne 0x414fde
push 0x210
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0044e2e0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x108
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 4], 0x14
call fcn.00403230
mov ecx, eax
test ecx, ecx
je 0x4150a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa68], eax
mov byte [ebp - 4], 0x15
call fcn.00403230
mov ecx, eax
test ecx, ecx
je 0x4150b2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa5c], eax
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xa5c]
call fcn.00402cc0
test al, al
jne 0x414f78
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414f56
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa5c]
call fcn.00403580
lea eax, [ebp - 0xa68]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0xa5c]
push eax
call fcn.00413b90
mov edx, dword [ebp - 0xa5c]
add esp, 8
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x414faf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xa68]
push 0x3f
push esi
push 0x49f000
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov byte [ebp - 4], 0x13
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414fde
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x49f000
lea ecx, [ebp - 0xa24]
mov dword [ebp - 0xa28], str.modver
call fcn.00402780
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 0x18
push eax
mov ecx, edi
call fcn.00412eb0
mov dword [ebp - 0xa60], 0xff
xor esi, esi
nop dword [eax]
nop word [eax + eax]
push dword [ebp + esi*8 - 0xa54]
mov ecx, edi
push dword [ebp + esi*8 - 0xa58]
call fcn.00414800
inc esi
cmp esi, 7
jb 0x415020
push 0x412fa0
push 7
push 8
lea eax, [ebp - 0xa58]
mov byte [ebp - 4], 1
push eax
call fcn.0042e0a0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41506c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042e446
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402ca0
push 0x80004005
call fcn.00402ca0
push 0x80004005
call fcn.00402ca0
push 0x80004005
call fcn.00402ca0
push 0x80004005
call fcn.00402ca0
int3