Function at 0x41642d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420c0d
mov eax, dword fs:[0]
push eax
sub esp, 0x6f0
mov eax, dword [0x4231e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x684], ecx
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 0x6f4], 0xffff0003
and dword [ebp - 0x6e4], 0
mov dword [ebp - 0x6f0], 0x67
mov dword [ebp - 0x6d0], 1
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x684]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x6ac], eax
lea eax, [ebp - 0x674]
push eax
push 0x4036f4
push 1
push 0
push 0x4036e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0
jl 0x416738
and dword [ebp - 0x670], 0
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
mov eax, dword [ebp - 0x674]
mov eax, dword [eax]
push dword [ebp - 0x674]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x688]
call dword [0x42486c]
call dword [ebp - 0x688]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0
jl 0x41670a
push 2
pop eax
imul eax, eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x650], cx
push 0
lea eax, [ebp - 0x664]
push eax
push 1
mov eax, dword [ebp - 0x670]
mov eax, dword [eax]
push dword [ebp - 0x670]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x68c], eax
mov ecx, dword [ebp - 0x68c]
call dword [0x42486c]
call dword [ebp - 0x68c]
test eax, eax
jne 0x4166e1
push 0x50
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x650]
test eax, eax
je 0x4165b5
lea eax, [ebp - 0x650]
push eax
call fcn.0040b696
mov dword [ebp - 0x6e0], eax
jmp 0x4165dd
lea eax, [ebp - 0x150]
push eax
push 0x40559c
lea eax, [ebp - 0x550]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x550]
mov dword [ebp - 0x6e0], eax
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6e0]
movzx eax, word [ecx + eax]
cmp eax, 0x5f
jne 0x416603
mov eax, dword [ebp - 0x6ac]
cmp dword [eax + 0x74], 0
jne 0x416603
jmp 0x41653d
push 0x484
call fcn.0040b3d0
mov dword [ebp - 0x690], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x690], 0
je 0x416633
mov ecx, dword [ebp - 0x690]
call fcn.00413e89
mov dword [ebp - 0x694], eax
jmp 0x41663a
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x6b0], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x66c], eax
lea eax, [ebp - 0x150]
push eax
call fcn.0040b696
push eax
mov ecx, dword [ebp - 0x66c]
call fcn.00417a11
test eax, eax
jne 0x41667f
mov eax, dword [ebp - 0x66c]
mov dword [eax + 0x6c], 0xd
mov eax, dword [ebp - 0x66c]
mov dword [eax + 4], 7
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x66c]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
lea eax, [ebp - 0x6f8]
push eax
mov ecx, dword [ebp - 0x684]
call fcn.004179ae
mov ecx, eax
call fcn.00417f0b
push 2
pop eax
imul eax, eax, 0
xor ecx, ecx
mov word [ebp + eax - 0x650], cx
jmp 0x41653d
mov eax, dword [ebp - 0x670]
mov eax, dword [eax]
push dword [ebp - 0x670]
mov eax, dword [eax + 8]
mov dword [ebp - 0x698], eax
mov ecx, dword [ebp - 0x698]
call dword [0x42486c]
call dword [ebp - 0x698]
mov eax, dword [ebp - 0x674]
mov eax, dword [eax]
push dword [ebp - 0x674]
mov eax, dword [eax + 8]
mov dword [ebp - 0x69c], eax
mov ecx, dword [ebp - 0x69c]
call dword [0x42486c]
call dword [ebp - 0x69c]
jmp 0x416923
and dword [ebp - 0x678], 0
lea eax, [ebp - 0x678]
push eax
push 0x402e88
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x416923
and dword [ebp - 0x680], 0
jmp 0x416774
mov eax, dword [ebp - 0x680]
inc eax
mov dword [ebp - 0x680], eax
push 0x50
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0x680]
push dword [ebp - 0x678]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x416917
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0xb0]
push eax
push dword [ebp - 0x678]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x416912
mov dword [ebp - 0x6b4], 0x200
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x350]
push eax
push 0
push 0
push 0x4055b8
push dword [ebp - 0x6a8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416906
push 2
pop eax
imul eax, eax, 0
movzx eax, word [ebp + eax - 0x350]
test eax, eax
jne 0x41681c
lea eax, [ebp - 0xb0]
push eax
push 0x405498
lea eax, [ebp - 0x350]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x484
call fcn.0040b3d0
mov dword [ebp - 0x6a0], eax
mov dword [ebp - 4], 1
cmp dword [ebp - 0x6a0], 0
je 0x41684f
mov ecx, dword [ebp - 0x6a0]
call fcn.00413e89
mov dword [ebp - 0x6a4], eax
jmp 0x416856
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x6b8], eax
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov dword [eax + 4], 7
lea eax, [ebp - 0xb0]
push eax
mov ecx, dword [ebp - 0x668]
call fcn.00417a11
test eax, eax
jne 0x4168a2
mov eax, dword [ebp - 0x668]
mov dword [eax + 0x6c], 0xd
xor eax, eax
mov ecx, dword [ebp - 0x668]
mov word [ecx + 0x68], ax
xor eax, eax
mov ecx, dword [ebp - 0x668]
mov word [ecx + 0x68], ax
mov eax, dword [ebp - 0x668]
mov eax, dword [eax + 0x6c]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x6cc], eax
lea eax, [ebp - 0x350]
mov dword [ebp - 0x6e0], eax
lea eax, [ebp - 0x6f8]
push eax
mov ecx, dword [ebp - 0x684]
call fcn.004179ae
mov ecx, eax
call fcn.00417f0b
push dword [ebp - 0x6a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x416767
push dword [ebp - 0x678]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041f3a0
leave
ret 4