Function at 0x4145b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [0x46508c]
push 0
push 0
push 0
push ebx
push 1
push 4
push esi
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], ecx
call edi
xor ecx, ecx
cmp eax, ecx
je 0x41461c
push eax
push esi
push str.VNLTakeOwnershipOfKey:_failed_to_take_ownership_of__S___08x_
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], ecx
je 0x414750
mov edx, dword [ebp + 0x1c]
xor eax, eax
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], eax
mov dword [ebp - 0x294], eax
mov dword [ebp - 0x290], eax
lea eax, [ebp - 0x280]
push eax
push ecx
mov dword [ebp - 0x298], ecx
mov dword [ebp - 0x28c], ecx
lea ecx, [ebp - 0x2a0]
push ecx
push 1
mov dword [ebp - 0x2a0], edx
mov dword [ebp - 0x29c], 2
mov dword [ebp - 0x288], 1
mov dword [ebp - 0x284], ebx
call dword [0x4650d4]
test eax, eax
je 0x4146c5
push eax
push esi
push str.VNLTakeOwnershipOfKey:_failed_to_create_acl_for__S___08x_
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x280]
push edx
call dword [0x4650b8]
test eax, eax
jne 0x414705
push str.VNLTakeOwnershipOfKey:_SetEntriesInAcl___created_invalid_acl
push 1
call fcn.004343f0
mov eax, dword [ebp - 0x280]
add esp, 8
push eax
call dword [0x465254]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x280]
push 0
push ecx
push 0
push 0
push 4
push 4
push esi
call edi
mov edx, dword [ebp - 0x280]
push edx
mov edi, eax
call dword [0x465254]
test edi, edi
je 0x414750
push edi
push esi
push str.VNLTakeOwnershipOfKey:_failed_to_clobber_DACL_on__S___08x_
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x20], 0
je 0x414876
mov ecx, dword [ebp - 0x278]
mov edx, dword [ebp - 0x27c]
lea eax, [ebp - 0x278]
push eax
push 8
push 0
push ecx
push edx
call dword [0x4650cc]
test eax, eax
je 0x4147a1
push eax
push esi
push str.VNLTakeOwnershipOfKey:_could_not_open__S___08x_
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x278]
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x68]
push ecx
push edi
push edx
mov dword [ebp - 0x27c], 0x32
call dword [0x465090]
test eax, eax
jne 0x41484a
mov edi, edi
lea eax, [ebp - 0x68]
push eax
push esi
push 0x46c138
lea ecx, [ebp - 0x274]
push 0x105
push ecx
call fcn.00457d45
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push edx
push eax
push ecx
mov ecx, dword [ebp - 0x278]
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x68]
push eax
push ecx
push ebx
call fcn.004145b0
add esp, 0x30
test eax, eax
je 0x414609
mov ecx, dword [ebp - 0x278]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x27c]
push edx
lea eax, [ebp - 0x68]
push eax
inc edi
push edi
push ecx
mov dword [ebp - 0x27c], 0x32
call dword [0x465090]
test eax, eax
je 0x4147d0
cmp eax, 0x103
je 0x414876
push eax
push esi
push edi
push str.VNLTakeOwnershipOfKey:_failed_to_enumerate_subkey__u_for__S___08x_
push 1
call fcn.004343f0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040506e
mov esp, ebp
pop ebp
ret