Function at 0x411269
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x4117f8
xor esi, esi
push 8
mov ebx, ecx
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xdc], esi
call fcn.004015a0
mov eax, dword [ebx + 0xc4]
pop ecx
pop ecx
cmp eax, esi
je 0x42d304
cmp dword [ebx + 0xd4], esi
je 0x42d31c
cmp dword [ebx + 0xd0], esi
je 0x42d323
cmp dword [ebx + 0xc8], esi
je 0x42d32a
cmp dword [ebx + 0xcc], esi
je 0x42d331
cmp dword [ebx + 0xdc], esi
je 0x42d338
push esi
push esi
call eax
mov dword [ebp - 0xcc], eax
cmp eax, 0xffffffff
je 0x42d33f
push edi
push 0x1c
pop edi
lea ecx, [ebp - 0xc8]
push ecx
mov ecx, dword [ebp - 0xd4]
push esi
push dword [ecx + 0x54]
mov dword [ebp - 0xc8], edi
push eax
call dword [ebx + 0xd4]
test eax, eax
je 0x42d348
lea eax, [ebp - 0xac]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xcc]
mov dword [ebp - 0xac], edi
call dword [ebx + 0xc8]
test eax, eax
jne 0x41135e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42d34f
lea eax, [ebp - 0xdc]
push eax
push esi
push esi
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xcc]
test eax, eax
jne 0x41138d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x42d36b
mov edi, dword [ebp - 0xdc]
inc edi
lea eax, [edi + edi]
push eax
mov dword [ebp - 0xd8], eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push dword [ebp - 0xd8]
mov dword [ebp - 0xd0], eax
cmp eax, esi
je 0x42d38f
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xdc]
push eax
push edi
push dword [ebp - 0xd0]
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xcc]
test eax, eax
je 0x42d3a5
push 0x13
pop ecx
mov esi, 0x4104a8
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xdc]
push eax
push 0x4e
lea eax, [ebp - 0x90]
push eax
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push 0x24
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xdc]
test eax, eax
je 0x42d438
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x42d438
push 0xe
lea eax, [ebp - 0x90]
push 0x4117d8
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x42d3e4
push 0x30
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
push 0x20019
mov word [ebp - 0x1e], ax
push esi
lea eax, [ebp - 0xc8]
push eax
push dword [ebp - 0xcc]
call dword [ebx + 0xd8]
mov dword [ebp - 0xe4], eax
cmp eax, 0xffffffff
je 0x42d4a0
push 4
pop eax
push 8
pop ecx
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x10
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0xe8], esi
push 0
push dword [ebp - 0xe4]
mov esi, 0x411854
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x42d44b
push dword [ebp - 0xd8]
push dword [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0xd4]
push dword [eax]
push 0x4116f8
push 8
call fcn.004015a0
mov esi, dword [ebp - 0xd4]
add esp, 0x18
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd0]
push dword [esi]
push 0x411660
push 8
call fcn.004015a0
add esp, 0x10
push dword [ebp - 0xd0]
lea ecx, [esi + 0x5c]
call fcn.00411243
push dword [ebp - 0xd0]
mov edi, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jl 0x42d4c9
lea eax, [ebp - 0x20]
push eax
push dword [esi]
push 0x4115a0
push 8
call fcn.004015a0
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x60]
call fcn.00411243
push dword [ebp - 0xcc]
mov esi, eax
call dword [ebx + 0xd0]
test esi, esi
jl 0x42d4de
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00401580
leave
ret 4
push 0x42e060
push 4
call fcn.004015a0
pop ecx
pop ecx
mov eax, 0x80004005
jmp 0x41158e
push 0x42dfb0
jmp 0x42d309
push 0x42df00
jmp 0x42d309
push 0x42de48
jmp 0x42d309
push 0x42dd98
jmp 0x42d309
push 0x42dce0
jmp 0x42d309
push 0x42dc08
push 1
jmp 0x42d30b
push 0x42db50
jmp 0x42d354
push 0x42da88
push 1
call fcn.004015a0
pop ecx
pop ecx
push dword [ebp - 0xcc]
call dword [ebx + 0xd0]
jmp 0x42d3da
push 0x42d9d0
push 1
call fcn.004015a0
pop ecx
pop ecx
mov esi, 0x80004005
push dword [ebp - 0xcc]
call dword [ebx + 0xd0]
jmp 0x42d4ec
push 0x42d930
push 1
call fcn.004015a0
add esp, 0xc
mov esi, 0x8007000e
jmp 0x42d37e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4113eb
push 0x42d878
push 1
call fcn.004015a0
pop ecx
pop ecx
push dword [ebp - 0xcc]
call dword [ebx + 0xd0]
push dword [ebp - 0xd0]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 0x80004005
jmp 0x41158d
mov eax, dword [ebp - 0xd0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x42d3ed
sub eax, edx
sar eax, 1
add eax, eax
cmp eax, 0x50
jae 0x42d41c
push dword [ebp - 0xd0]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push 0x50
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0x90]
push eax
push 0x28
push dword [ebp - 0xd0]
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
jmp 0x41145b
push 0x42d7b0
push 1
call fcn.004015a0
pop ecx
pop ecx
jmp 0x41145b
cmp dword [ebp - 0xd8], 4
jne 0x4114e3
push 0xa
push 0xc
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xe8]
call sub.msvcrt.dll__itow_s
mov esi, dword [ebp - 0xd4]
add esp, 0x10
test eax, eax
je 0x41150d
push eax
push dword [esi]
push 0x42d720
push 8
call fcn.004015a0
add esp, 0x10
push 0x30
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x1e], ax
jmp 0x41150d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0xd4]
push dword [eax]
push 0x42d648
push 8
call fcn.004015a0
mov esi, dword [ebp - 0xd4]
add esp, 0x10
jmp 0x411519
push 0x42d5a8
push 1
call fcn.004015a0
pop ecx
pop ecx
mov eax, edi
jmp 0x41158d
push 0x42d4f8
push 1
call fcn.004015a0
pop ecx
pop ecx
mov eax, esi
jmp 0x41158d