Function at 0x417c70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48ff65
mov eax, dword fs:[0]
push eax
sub esp, 0x918
mov eax, dword [0x4b0650]
xor eax, esp
mov dword [esp + 0x914], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b0650]
xor eax, esp
push eax
lea eax, [esp + 0x92c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x95c]
mov dword [esp + 0x20], eax
xor ebx, ebx
cmp dword [esp + 0x958], ebx
mov dword [esp + 0x934], ebx
mov dword [esp + 0x2c], 0x20019
je 0x417cd8
mov dword [esp + 0x2c], 0x20119
mov eax, dword [esp + 0x940]
mov ebp, 0x10
cmp dword [esp + 0x954], ebp
mov dword [esp + 0x1c], ebx
jae 0x417cf8
lea eax, [esp + 0x940]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x417d36
cmp dword [esp + 0x954], ebp
jb 0x417d2c
mov eax, dword [esp + 0x940]
push eax
call fcn.00477a90
add esp, 4
mov eax, 1
jmp 0x418331
push 0x3ff
lea ecx, [esp + 0x52d]
push ebx
push ecx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x534], bl
call fcn.00477c40
mov eax, dword [esp + 0x28]
add esp, 0xc
push 0x400
lea edx, [esp + 0x52c]
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x41830b
mov edi, 0xf
add dword [esp + 0x24], 1
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x944]
push ecx
lea ecx, [esp + 0xf8]
mov dword [esp + 0x110], edi
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
call fcn.00403fb0
push 1
push 0x4983bc
lea ecx, [esp + 0xf4]
mov byte [esp + 0x93c], 1
call fcn.00415820
lea eax, [esp + 0x528]
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x417dd3
sub eax, esi
push eax
lea edx, [esp + 0x52c]
push edx
lea ecx, [esp + 0xf4]
call fcn.00415820
push 3
push 0x498474
lea ecx, [esp + 0xd8]
mov dword [esp + 0xf0], edi
mov dword [esp + 0xec], ebx
mov byte [esp + 0xdc], bl
call fcn.00404100
cmp dword [esp + 0x104], ebp
mov eax, dword [esp + 0xf0]
mov byte [esp + 0x934], 2
mov dword [esp + 0x18], ebx
jae 0x417e3e
lea eax, [esp + 0xf0]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x18]
push ecx
push edx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x418298
push 0x3ff
lea edx, [esp + 0x12a]
push ebx
push edx
mov word [esp + 0x130], bx
call fcn.00477c40
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x128]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push str.DisplayName
push eax
mov dword [esp + 0x2c], 0x400
mov dword [esp + 0x40], 1
call esi
cmp eax, ebx
jne 0x41828d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x124]
push 0x49845c
push edx
mov byte [esp + ecx + 0x12c], bl
call fcn.004795b0
add esp, 8
test eax, eax
jne 0x41828d
lea eax, [esp + 0x124]
push str.Microsoft
push eax
call fcn.004795b0
add esp, 8
test eax, eax
jne 0x41828d
lea eax, [esp + 0x124]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x417f07
sub eax, edx
push eax
lea ecx, [esp + 0x128]
push ecx
lea ecx, [esp + 0xd8]
call fcn.00415820
push 1
push 0x4983e4
lea ecx, [esp + 0xd8]
call fcn.00415820
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push str.DisplayVersion
push edx
mov dword [esp + 0x2c], 0x400
call esi
test eax, eax
jne 0x417f96
mov eax, dword [esp + 0x14]
mov byte [esp + eax + 0x124], bl
lea eax, [esp + 0x124]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x417f80
sub eax, edx
push eax
lea ecx, [esp + 0x128]
push ecx
jmp 0x417f9d
push 3
push 0x49843c
lea ecx, [esp + 0xd8]
call fcn.00415820
push 1
push 0x4983e4
lea ecx, [esp + 0xd8]
call fcn.00415820
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push str.Publisher
push edx
mov dword [esp + 0x2c], 0x400
call esi
cmp eax, ebx
jne 0x41804c
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x124]
push 0x49845c
push ecx
mov byte [esp + eax + 0x12c], bl
call fcn.004795b0
add esp, 8
test eax, eax
jne 0x41828d
lea edx, [esp + 0x124]
push str.Microsoft
push edx
call fcn.004795b0
add esp, 8
test eax, eax
jne 0x41828d
lea eax, [esp + 0x124]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x418036
sub eax, edx
push eax
lea eax, [esp + 0x128]
push eax
jmp 0x418053
push 0xc
push str.No_Publisher
lea ecx, [esp + 0xd8]
call fcn.00415820
lea eax, [esp + 0x528]
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x418075
sub eax, edx
push eax
lea ecx, [esp + 0x52c]
push ecx
lea ecx, [esp + 0x38]
call fcn.00404100
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x50]
push eax
mov ecx, esi
mov byte [esp + 0x93c], 3
call fcn.00416020
cmp dword [esp + 0x48], ebp
mov byte [esp + 0x934], 2
jb 0x4180ca
mov ecx, dword [esp + 0x34]
push ecx
call fcn.00477a90
add esp, 4
mov eax, dword [esp + 0x4c]
cmp eax, ebx
mov esi, dword [esi + 4]
je 0x4180db
cmp eax, dword [esp + 0x20]
je 0x4180e0
call fcn.004789ce
cmp dword [esp + 0x50], esi
jne 0x41828d
lea eax, [esp + 0x528]
mov dword [esp + 0x120], edi
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x418110
sub eax, edx
push eax
lea edx, [esp + 0x52c]
push edx
lea ecx, [esp + 0x110]
call fcn.00404100
lea eax, [esp + 0x528]
mov byte [esp + 0x934], 4
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x418150
sub eax, esi
push eax
lea eax, [esp + 0x52c]
push eax
lea ecx, [esp + 0x38]
call fcn.00404100
lea ecx, [esp + 0xd0]
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x94]
mov byte [esp + 0x93c], 5
call fcn.00416750
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x938], 6
call fcn.004167d0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0xc8]
push ecx
mov ecx, dword [esp + 0x28]
mov byte [esp + 0x93c], 7
call fcn.00417b40
cmp dword [esp + 0x88], ebp
jb 0x4181d4
mov edx, dword [esp + 0x74]
push edx
call fcn.00477a90
add esp, 4
cmp dword [esp + 0x6c], ebp
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
jb 0x4181f9
mov eax, dword [esp + 0x58]
push eax
call fcn.00477a90
add esp, 4
cmp dword [esp + 0xc0], ebp
mov dword [esp + 0x6c], edi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
jb 0x41821e
mov ecx, dword [esp + 0xac]
push ecx
call fcn.00477a90
add esp, 4
cmp dword [esp + 0xa4], ebp
mov dword [esp + 0xc0], edi
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
jb 0x41824c
mov edx, dword [esp + 0x90]
push edx
call fcn.00477a90
add esp, 4
cmp dword [esp + 0x48], ebp
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
jb 0x418274
mov eax, dword [esp + 0x34]
push eax
call fcn.00477a90
add esp, 4
cmp dword [esp + 0x120], ebp
jb 0x41828d
mov ecx, dword [esp + 0x10c]
push ecx
call fcn.00477a90
add esp, 4
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xe8], ebp
jb 0x4182b1
mov eax, dword [esp + 0xd4]
push eax
call fcn.00477a90
add esp, 4
cmp dword [esp + 0x104], ebp
mov byte [esp + 0x934], bl
mov byte [esp + 0xd4], bl
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], edi
jb 0x4182e6
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00477a90
add esp, 4
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push 0x400
lea edx, [esp + 0x52c]
push edx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x417d7d
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x954], ebp
jb 0x41832f
mov eax, dword [esp + 0x940]
push eax
call fcn.00477a90
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x92c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x914]
xor ecx, esp
call fcn.00477bf8
add esp, 0x924
ret 0x24