Function at 0x415ae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov eax, dword [0x492afc]
xor eax, esp
mov dword [esp + 0x47c], eax
push esi
push edi
mov eax, 0x53
mov word [esp + 0x30], ax
mov ecx, 0x6f
mov word [esp + 0x32], cx
mov edx, 0x66
mov word [esp + 0x34], dx
mov eax, 0x74
mov word [esp + 0x36], ax
mov ecx, 0x77
mov word [esp + 0x38], cx
mov edx, 0x61
mov word [esp + 0x3a], dx
mov eax, 0x72
mov word [esp + 0x3c], ax
mov ecx, 0x65
mov word [esp + 0x3e], cx
mov edx, 0x5c
mov word [esp + 0x40], dx
mov eax, 0x49
mov word [esp + 0x42], ax
mov ecx, 0x43
mov eax, ecx
mov word [esp + 0x44], cx
mov word [esp + 0x48], ax
mov edx, 0x42
mov word [esp + 0x46], dx
mov ecx, 0x45
mov word [esp + 0x4a], cx
mov edx, 0x62
mov word [esp + 0x4c], dx
mov ecx, 0x6e
mov word [esp + 0x50], cx
mov eax, 0x61
mov word [esp + 0x4e], ax
mov edx, 0x6b
mov word [esp + 0x52], dx
mov ecx, 0x6f
mov edx, ecx
mov word [esp + 0x56], cx
mov word [esp + 0x58], dx
mov eax, 0x54
mov word [esp + 0x54], ax
mov eax, 0x6c
mov word [esp + 0x5a], ax
mov ecx, 0x73
mov word [esp + 0x5c], cx
mov edx, 0x5c
mov word [esp + 0x5e], dx
mov eax, 0x53
mov word [esp + 0x60], ax
mov ecx, 0x65
mov word [esp + 0x62], cx
mov edx, 0x74
mov eax, edx
mov word [esp + 0x64], dx
mov ecx, 0x69
mov esi, dword [esp + 0x48c]
mov word [esp + 0x66], ax
mov word [esp + 0x68], cx
mov edx, 0x6e
mov word [esp + 0x6a], dx
mov eax, 0x67
mov ecx, 0x73
xor edi, edi
xor edx, edx
mov word [esp + 0x6c], ax
mov word [esp + 0x6e], cx
mov eax, 0x49
mov ecx, 0x6e
mov word [esp + 0x70], dx
mov edx, 0x73
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
mov eax, 0x74
mov ecx, 0x61
mov word [esp + 0x1c], dx
mov word [esp + 0x1e], ax
mov word [esp + 0x20], cx
mov edx, 0x6c
mov eax, edx
mov word [esp + 0x24], ax
mov eax, 0x74
mov word [esp + 0x22], dx
mov word [esp + 0x2a], ax
mov ecx, 0x50
lea eax, [esp + 8]
push eax
mov word [esp + 0x2a], cx
mov edx, 0x61
push 1
mov word [esp + 0x30], dx
xor edx, edx
mov ecx, 0x68
mov word [esp + 0x34], cx
push edx
lea ecx, [esp + 0x3c]
push ecx
push SysReAllocStringLen
mov word [esp + 0x42], dx
mov dword [esp + 0x1c], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x415ce8
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.004424e7
add esp, 0x480
ret
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x7e]
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x104
mov word [esp + 0x80], dx
call fcn.00443d20
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x78]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x415d55
lea edi, [eax + 1]
push 0x104
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x284]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [esp + 8]
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x280]
push eax
lea ecx, [esp + 0x14]
call fcn.004027e0
mov ebx, eax
cmp esi, ebx
je 0x415d91
mov ecx, esi
call fcn.00402910
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x415d91
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x10]
call fcn.00402910
mov ecx, dword [esp + 0x488]
pop ebx
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.004424e7
add esp, 0x480
ret