Function at 0x401908
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x40d01c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 8]
push edi
push 0x14
pop ecx
mov esi, str.SOFTWARETencent_bugReportQQLiveBrowser
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
push 7
pop ecx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x4b0], eax
lea eax, [ebp - 0x48c]
push eax
mov esi, str.QQLiveBrowser
lea edi, [ebp - 0x20]
push 0x20019
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x74]
push eax
push closesocket
mov dword [ebp - 0x48c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401b75
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 4
pop ebx
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x488]
push eax
push esi
push str.auto
push dword [ebp - 0x48c]
mov dword [ebp - 0x4a8], esi
mov dword [ebp - 0x498], ebx
mov dword [ebp - 0x488], esi
call edi
test eax, eax
jne 0x401b68
cmp dword [ebp - 0x488], ebx
jne 0x401b68
cmp dword [ebp - 0x4a8], 1
jne 0x401b68
mov ebx, 0x206
push ebx
lea eax, [ebp - 0x27a]
push esi
push eax
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x490], esi
mov dword [ebp - 0x49c], esi
mov dword [ebp - 0x4ac], esi
mov dword [ebp - 0x4a0], 0x104
mov word [ebp - 0x27c], si
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x488]
push eax
push esi
push str.version
push dword [ebp - 0x48c]
mov dword [ebp - 0x488], esi
call edi
test eax, eax
jne 0x401a8e
cmp dword [ebp - 0x488], 1
jne 0x401a8e
cmp dword [ebp - 0x4a0], esi
jbe 0x401a8e
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
test eax, eax
pop ecx
je 0x401a8e
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x27c]
push str._d._d._d._d
push eax
call dword [sym.imp.MSVCR80.dll_swscanf]
add esp, 0x18
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x488]
push eax
push esi
push 0x40881c
push dword [ebp - 0x48c]
mov dword [ebp - 0x4a4], esi
mov dword [ebp - 0x498], 4
mov dword [ebp - 0x488], esi
call edi
push ebx
lea eax, [ebp - 0x482]
push esi
push eax
mov word [ebp - 0x484], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x484]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_TXLog::GetSession_void_]
push eax
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_NLS::GetLCID_void_]
push eax
push 1
push 1
push dword [ebp - 0x49c]
lea eax, [ebp - 0x484]
push dword [ebp - 0x490]
push dword [ebp - 0x494]
push dword [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x20]
push eax
push eax
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::InitBugReport_wchar_t_const___wchar_t_const___wchar_t_const___wchar_t_const___unsigned_short_int__unsigned_short_int__unsigned_long_int__int__int__unsigned_long_int__unsigned_long_int__int____stdcall___struct_TXBugReport::tagBugReportInfo___char_const___char_const___wchar_t_const___wchar_t_const___void____unsigned_long_int___void___]
push 3
call dword [sym.imp.Common.dll_int___cdecl_TXBugReport::SetBugReportFlag_unsigned_long_int_]
push dword [ebp - 0x4a4]
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::SetBugReportUin_unsigned_long_int_]
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::ValidateBugReport_void_]
push dword [ebp - 0x49c]
lea eax, [ebp - 0x20]
push dword [ebp - 0x490]
push dword [ebp - 0x494]
push eax
call fcn.00403e69
add esp, 0x48
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.004069a4
leave
ret