Function at 0x416f22
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x238
push ebx
push ebp
push esi
push edi
push 0x100
call fcn.00418628
mov edi, eax
mov dword [esp], 0x200
mov dword [esp + 0x20], edi
call fcn.00418628
mov esi, 0xff
mov ebp, eax
push esi
mov dword [esp + 0x2c], ebp
call fcn.00418628
pop ecx
mov dword [esp + 0x14], eax
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp + 0x20], eax
mov eax, dword [0x42f1d8]
push dword [eax]
push edi
call fcn.00418030
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x158]
push eax
lea eax, [esp + 0x48]
push eax
push edi
call fcn.00418641
push dword [0x4259b0]
push ebp
call fcn.00418030
lea eax, [esp + 0x6c]
push eax
push ebp
call fcn.00418040
push 4
call fcn.00418628
add esp, 0x30
mov edi, eax
lea eax, [esp + 0x14]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [edi], esi
push closesocket
mov dword [0x42ded8], ebx
call ebp
test eax, eax
jne 0x417018
push edi
push dword [esp + 0x14]
push ebx
push ebx
push dword [0x4259b4]
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x42ded8], 1
push dword [esp + 0x10]
push 0x42dedc
call fcn.00418030
pop ecx
pop ecx
lea eax, [esp + 0x18]
mov dword [edi], esi
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push closesocket
call ebp
push esi
mov ebp, eax
call fcn.004179b4
cmp ebp, ebx
pop ecx
mov esi, eax
jne 0x41705d
push edi
push esi
push ebx
push ebx
push str.ProgramFilesDir
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00418120
add eax, 0xf
push eax
call fcn.00418628
push esi
mov dword [0x42de30], eax
call fcn.00418120
inc eax
push eax
call fcn.00418628
push esi
push eax
mov dword [0x42e75c], eax
call fcn.00418030
push dword [0x42e75c]
xor edi, edi
xor ebp, ebp
call fcn.00418120
add esp, 0x1c
inc eax
je 0x4170d2
mov eax, dword [0x42e75c]
mov al, byte [eax + ebp]
cmp al, 0x5c
jne 0x4170b6
mov eax, dword [0x42de30]
mov byte [eax + edi], 0x5c
jmp 0x4170bf
mov ecx, dword [0x42de30]
mov byte [ecx + edi], al
push dword [0x42e75c]
inc edi
inc ebp
call fcn.00418120
inc eax
pop ecx
cmp ebp, eax
jb 0x41709f
push dword [0x42de30]
call fcn.00418120
add eax, 0xb
push eax
call fcn.00418628
push dword [0x42de30]
mov dword [0x42de58], eax
push eax
call fcn.00418030
push str.Global.sw
push dword [0x42de58]
call fcn.00418040
push esi
call fcn.0041857e
mov edi, dword [esp + 0x3c]
push edi
call fcn.00418120
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00418628
add esp, 0x24
mov ebp, eax
push 1
pop eax
cmp esi, eax
jle 0x41714a
mov edx, ebp
mov cl, byte [eax + edi]
cmp cl, 0x22
je 0x417141
cmp cl, bl
je 0x417141
mov byte [edx], cl
inc edx
jmp 0x417145
mov byte [edx], bl
mov eax, esi
inc eax
cmp eax, esi
jl 0x417130
push ebp
call fcn.00418120
mov esi, eax
push esi
call fcn.00418628
mov edi, eax
lea eax, [esi - 5]
pop ecx
cmp eax, ebx
pop ecx
jle 0x41717f
mov edx, edi
mov cl, byte [eax + ebp]
cmp cl, 0x5c
je 0x417176
cmp cl, bl
je 0x417176
mov byte [edx], cl
inc edx
jmp 0x41717a
mov byte [edx], bl
xor eax, eax
dec eax
cmp eax, ebx
jg 0x417165
push edi
call fcn.00418120
mov esi, eax
lea eax, [esi + 1]
push eax
call fcn.00418628
mov dword [0x42daac], eax
pop ecx
xor eax, eax
cmp esi, ebx
pop ecx
jle 0x4171b2
lea edi, [edi + esi - 1]
mov edx, dword [0x42daac]
mov cl, byte [edi]
mov byte [eax + edx], cl
inc eax
dec edi
cmp eax, esi
jl 0x4171a1
mov eax, dword [0x42daac]
mov byte [eax + esi], bl
call fcn.0040a04b
cmp byte [0x42dbac], 1
mov eax, str..NTICE
je 0x4171d2
mov eax, str..SICE
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, 0x80
push ebx
push ebp
push 3
push ebx
mov edi, 0xc0000000
push 3
push edi
push eax
call esi
cmp eax, 0xffffffff
mov dword [0x42e038], eax
jne 0x417202
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x417219
push dword [0x42e038]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_SoftIce_loaded
call fcn.004099b6
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.ZZ_ZLRGAC
push 0x42f130
call fcn.00409a00
push ebx
push ebx
push ebx
push ebx
push str.ZZ_ZQGAC
push 0x42f134
call fcn.00409a00
push ebx
push ebx
push ebx
push ebx
push str.ZZ_ZPCEKML
push 0x42f138
call fcn.00409a00
add esp, 0x48
push ebx
push ebx
push ebx
push ebx
push str.ZZ_ZPCEQWQ
push 0x42f13c
call fcn.00409a00
push ebx
push ebx
push ebx
push ebx
push str.ZZ_ZDGJCKML
push 0x42f140
call fcn.00409a00
mov eax, dword [0x42f130]
add esp, 0x30
cmp byte [0x42dbac], 1
je 0x417291
mov eax, dword [0x42f134]
push ebx
push ebp
push 3
push ebx
push 3
push edi
push eax
call esi
cmp eax, 0xffffffff
mov dword [0x42e038], eax
jne 0x4172b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4172c8
push dword [0x42e038]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_SoftIce_loaded
call fcn.004099b6
pop ecx
push ebx
push ebx
push ebx
push ebx
push str.Error_in
push 0x42f10c
call fcn.00409a00
add esp, 0x18
push ebx
push ebp
push 3
push ebx
push 3
push edi
push str..REGMON
call esi
cmp eax, 0xffffffff
mov dword [0x42e760], eax
jne 0x417302
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x417319
push dword [0x42e760]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_RegMon_loaded
call fcn.004099b6
pop ecx
push ebx
push ebp
push 3
push ebx
push 3
push edi
push dword [0x42f13c]
call esi
cmp eax, 0xffffffff
mov dword [0x42e760], eax
jne 0x41733e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x417355
push dword [0x42e760]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_RegMon_loaded
call fcn.004099b6
pop ecx
push ebx
push ebp
push 3
push ebx
push 3
push edi
push dword [0x42f140]
call esi
cmp eax, 0xffffffff
mov dword [0x42de5c], eax
jne 0x41737a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x417391
push dword [0x42de5c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Softwrap_cannot_be_run_with_FileMon_loaded
call fcn.004099b6
pop ecx
push dword [esp + 0x24c]
call fcn.00416e2f
call fcn.00411b28
call fcn.00411ce2
push dword [esp + 0x20]
call fcn.0041857e
push dword [esp + 0x2c]
call fcn.0041857e
push dword [esp + 0x1c]
call fcn.0041857e
mov eax, dword [0x42f150]
add esp, 0x10
cmp eax, ebx
je 0x4173d5
push eax
call fcn.0041857e
pop ecx
mov eax, dword [0x42f154]
pop edi
pop esi
pop ebp
cmp eax, ebx
pop ebx
je 0x4173e9
push eax
call fcn.0041857e
pop ecx
push dword [0x42daac]
call fcn.0041857e
push dword [0x42e75c]
call fcn.0041857e
push dword [0x42de30]
call fcn.0041857e
push dword [0x42de58]
call fcn.0041857e
xor eax, eax
add esp, 0x248
ret 0x10