Function at 0x41aa32
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push 0x55c
mov eax, 0x423f40
call fcn.0042193f
mov edi, edx
mov esi, ecx
lea ecx, [ebp - 0x528]
call dword [0x42e21c]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x540]
call dword [0x42e21c]
xor ebx, ebx
lea ecx, [ebp - 0x538]
inc ebx
mov byte [ebp - 4], bl
call dword [0x42e21c]
mov ecx, edi
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::Empty]
push esi
lea ecx, [ebp - 0x538]
call dword [0x42e224]
push 0x402f9c
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MFC42u.dll_CString::CString_1]
mov esi, eax
push ebx
lea eax, [ebp - 0x530]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x538]
call dword [sym.imp.MFC42u.dll_CString::Right]
push dword [esi]
mov ecx, eax
call fcn.0040cc91
lea ecx, [ebp - 0x530]
mov esi, eax
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::CString]
test esi, esi
je 0x41ab14
push 0x402f9c
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MFC42u.dll_CString::CString_1]
push eax
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 4
call dword [sym.imp.MFC42u.dll_CString::operator_1]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x66
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::LoadStringW]
push 0x408200
lea ecx, [ebp - 0x530]
call dword [sym.imp.MFC42u.dll_CString::CString_3]
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 5
push ecx
push eax
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.MFC42u.dll_operator]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 6
call dword [0x42e224]
lea ecx, [ebp - 0x52c]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x4b5
lea ecx, [ebp - 0x540]
call dword [sym.imp.MFC42u.dll_CString::LoadStringW]
lea eax, [ebp - 0x54c]
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp - 0x540]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ac0a
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x52c], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x530]
push eax
push esi
push 0x4081e0
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41abfe
cmp dword [ebp - 0x530], ebx
jne 0x41abfe
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::operator_2]
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x534]
call dword [0x42e21c]
push 0xa
lea ecx, [ebp - 0x568]
mov byte [ebp - 4], 7
call dword [sym.imp.MFC42u.dll_CStringList::CStringList]
mov byte [ebp - 4], 8
jmp 0x41ad6c
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
cmp eax, 0xffffffff
jne 0x41ac59
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call dword [0x42e224]
jmp 0x41ac9c
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Left]
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 9
call dword [0x42e224]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x568]
call dword [sym.imp.MFC42u.dll_CStringList::RemoveAll]
lea eax, [ebp - 0x568]
push eax
lea edx, [ebp - 0x538]
lea ecx, [ebp - 0x534]
call fcn.0041b096
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x530], eax
test eax, eax
jne 0x41ad91
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax - 8]
mov eax, dword [ebp - 0x534]
sub ecx, dword [eax - 8]
lea eax, [ebp - 0x544]
push ecx
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xa
call dword [0x42e224]
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
test eax, eax
jne 0x41ad6c
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x548]
push eax
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xb
call dword [0x42e224]
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
jne 0x41ac31
push 0x408204
lea ecx, [ebp - 0x528]
call dword [0x42e228]
jmp 0x41b02d
lea eax, [ebp - 0x530]
push eax
call fcn.00411019
push eax
mov ecx, edi
call dword [0x42e224]
jmp 0x41b03e
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
cmp eax, 0xffffffff
jne 0x41add3
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call dword [0x42e224]
jmp 0x41ae16
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
push eax
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Left]
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0xc
call dword [0x42e224]
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x568]
call dword [sym.imp.MFC42u.dll_CStringList::RemoveAll]
lea eax, [ebp - 0x568]
push eax
lea edx, [ebp - 0x538]
lea ecx, [ebp - 0x534]
call fcn.0041b096
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x530], eax
test eax, eax
je 0x41af95
lea eax, [ebp - 0x530]
push eax
call fcn.00411019
push eax
mov ecx, edi
call dword [0x42e224]
push esi
push 0x80
push 3
push esi
push ebx
push SysReAllocStringLen
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41af85
push 0
lea eax, [ebp - 0x53c]
push eax
push ebx
lea eax, [ebp - 0x31c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b08b
cmp word [ebp - 0x31c], 0x3c
jne 0x41af03
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x31c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b08b
lea eax, [ebp - 0x31c]
push 0x408210
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41b082
push ebx
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x41aeaf
jmp 0x41af7e
push 0
lea eax, [ebp - 0x53c]
push eax
push ebx
lea eax, [ebp - 0x524]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b08b
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x524]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b08b
xor eax, eax
mov word [ebp - 0x500], ax
lea eax, [ebp - 0x524]
push 0x408210
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x41b082
push ebx
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x41af23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x530], 0
push 0
pop esi
jne 0x41ae4e
mov eax, dword [ebp - 0x528]
mov ecx, dword [eax - 8]
mov eax, dword [ebp - 0x534]
sub ecx, dword [eax - 8]
lea eax, [ebp - 0x544]
push ecx
push eax
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xd
call dword [0x42e224]
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
push 0x7c
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::Find]
test eax, eax
jne 0x41b02d
mov eax, dword [ebp - 0x528]
lea ecx, [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x52c]
push eax
call dword [sym.imp.MFC42u.dll_CString::Right]
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xe
call dword [0x42e224]
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
jne 0x41adab
mov ebx, esi
lea ecx, [ebp - 0x568]
call dword [0x42e1c8]
lea ecx, [ebp - 0x534]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x538]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x540]
call dword [sym.imp.MFC42u.dll_CString::CString]
lea ecx, [ebp - 0x528]
call dword [sym.imp.MFC42u.dll_CString::CString]
mov eax, ebx
call fcn.004218ee
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41b03e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
jmp 0x41b03e