Function at 0x4141a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1602
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push esi
push edi
mov eax, dword [0x53ba20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
cmp ebx, 0xffffffff
jne 0x4143da
push 0x4fbd20
mov dword [ebp - 0x34], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x34], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x30], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x2c], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x2c], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x28], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x28], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x10], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x24], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x24], eax
call fcn.004c8c7f
test esi, esi
mov dword [ebp - 0x14], 0
mov edi, 0x4fbd20
cmovne edi, esi
push edi
call fcn.004c8c20
push 0
mov dword [ebp - 0x14], eax
call fcn.004c8c7f
mov eax, dword [ebp + 0x10]
mov esi, 0x4fbd20
test eax, eax
mov dword [ebp - 0x18], 0
cmovne esi, eax
push esi
call fcn.004c8c20
push 0
mov dword [ebp - 0x18], eax
call fcn.004c8c7f
add esp, 0x40
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call fcn.00409d10
mov ebx, eax
push edi
mov dword [ebp - 0x1c], 0
call fcn.004c8c20
mov dword [ebp - 0x1c], eax
push 0
call fcn.004c8c7f
push esi
mov dword [ebp - 0x20], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x20], eax
call fcn.004c8c7f
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
push eax
call fcn.00409d10
push 0xffffffffffffffff
push 0
push 0
lea ecx, [ebp - 0x34]
mov edi, dword [ebp + 8]
push ecx
push 1
push 0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xb
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push eax
push 0
push 0xffffffffffffffff
push 0
push edi
call fcn.00405510
add esp, 0x74
mov ebx, eax
mov dword [ebp + 0x18], ebx
push dword [ebp - 0x44]
call fcn.004c8c7f
push dword [ebp - 0x20]
call fcn.004c8c7f
push dword [ebp - 0x1c]
call fcn.004c8c7f
push dword [ebp - 0x3c]
call fcn.004c8c7f
push dword [ebp - 0x18]
call fcn.004c8c7f
push dword [ebp - 0x14]
call fcn.004c8c7f
push dword [ebp - 0x24]
call fcn.004c8c7f
push dword [ebp - 0x10]
call fcn.004c8c7f
push dword [ebp - 0x28]
call fcn.004c8c7f
push dword [ebp - 0x2c]
call fcn.004c8c7f
push dword [ebp - 0x30]
call fcn.004c8c7f
push dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
call fcn.004c8c7f
mov esi, dword [ebp + 0x14]
add esp, 0x30
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
push eax
push 0x20019
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00408690
mov eax, dword [ebp - 0x40]
add esp, 0x14
test eax, eax
jne 0x414415
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push ecx
push 0
push 0
push 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call esi
test eax, eax
jne 0x414b08
push 2
call fcn.004c8c9a
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov edx, 2
shr eax, 1
add eax, 2
mov dword [ebp - 4], 0xc
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c393e
add esp, 8
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
push eax
push ebx
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 0x40]
call esi
mov eax, dword [ebp - 0x38]
shr eax, 1
mov dword [ebp - 0x38], eax
cmp eax, 2
jbe 0x414afd
xor ecx, ecx
mov word [ebx + eax*2 - 2], cx
mov eax, dword [ebp - 0x38]
mov word [ebx + eax*2], cx
cmp word [ebx], cx
je 0x414afd
nop dword [eax + eax]
push 2
call fcn.004c8c9a
xor ecx, ecx
mov dword [ebp - 0x88], eax
mov word [eax], cx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x7c], ecx
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xd
push eax
push ebx
call fcn.00408a20
mov esi, dword [ebp - 0x20]
push ebx
call fcn.004c8c20
push esi
mov dword [ebp - 0x20], eax
call fcn.004c8c7f
push 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.004069a0
add esp, 0x24
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4145b5
push 0x10
push 0x4fc4b4
push eax
call fcn.004c94d0
add esp, 0xc
test eax, eax
jne 0x4145b2
push 0xa
push 0x5017cc
push ebx
call fcn.004c94d0
add esp, 0xc
test eax, eax
jne 0x4145b2
push ebx
call fcn.004c8c20
mov esi, eax
push 0
mov dword [ebp - 0x8c], esi
call fcn.004c8c7f
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebx + 0x14]
push eax
call fcn.00408a20
push 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xa8]
push edi
push eax
call fcn.004069a0
mov edi, dword [ebp - 0x14]
mov ecx, 0x4fbd20
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call fcn.004c8c20
push edi
mov dword [ebp - 0x14], eax
call fcn.004c8c7f
push dword [ebp - 0xa8]
call fcn.004c8c7f
push esi
call fcn.004c8c7f
mov edi, dword [ebp + 8]
add esp, 0x30
mov eax, dword [ebp - 0x14]
cmp word [eax], 0
je 0x414a56
push 2
call fcn.004c8c9a
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov word [eax], cx
push 2
call fcn.004c8c9a
xor ecx, ecx
mov dword [ebp - 0x70], eax
mov word [eax], cx
push 2
call fcn.004c8c9a
xor ecx, ecx
mov dword [ebp - 0x6c], eax
mov word [eax], cx
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push edi
call fcn.00406990
push ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x10], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8c7f
mov eax, dword [ebp + 0x14]
mov ebx, 0x4fbd20
test eax, eax
mov dword [ebp - 0x28], 0
cmovne ebx, eax
push ebx
mov dword [ebp - 0x44], ebx
call fcn.004c8c20
push 0
mov dword [ebp - 0x28], eax
call fcn.004c8c7f
mov ecx, dword [ebp + 0x10]
mov eax, 0x4fbd20
test ecx, ecx
mov dword [ebp - 0x2c], 0
cmovne eax, ecx
push eax
mov dword [ebp - 0x18], eax
call fcn.004c8c20
push 0
mov dword [ebp - 0x2c], eax
call fcn.004c8c7f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x94]
push eax
call fcn.00409d10
add esp, 0x44
mov esi, eax
push ebx
mov dword [ebp - 0x30], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x30], eax
call fcn.004c8c7f
push dword [ebp - 0x18]
mov dword [ebp - 0x34], 0
call fcn.004c8c20
mov dword [ebp - 0x34], eax
push 0
call fcn.004c8c7f
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x90]
push eax
call fcn.00409d10
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 0x19
push ecx
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push eax
push edi
call fcn.00405200
add esp, 0x40
mov bl, al
push dword [ebp - 0x90]
call fcn.004c8c7f
push dword [ebp - 0x34]
call fcn.004c8c7f
push dword [ebp - 0x30]
call fcn.004c8c7f
push dword [ebp - 0x94]
call fcn.004c8c7f
push dword [ebp - 0x2c]
call fcn.004c8c7f
push dword [ebp - 0x28]
call fcn.004c8c7f
push dword [ebp - 0x10]
call fcn.004c8c7f
add esp, 0x1c
test bl, bl
je 0x414a35
cmp dword [ebp + 0x18], 0xffffffff
jne 0x414937
push 0x4fbd20
mov dword [ebp - 0x10], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x5c], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x5c], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x58], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x58], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x54], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x54], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x50], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x50], eax
call fcn.004c8c7f
push 0x4fbd20
mov dword [ebp - 0x4c], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x4c], eax
call fcn.004c8c7f
mov ebx, dword [ebp - 0x44]
push ebx
mov dword [ebp - 0x48], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x48], eax
call fcn.004c8c7f
push dword [ebp - 0x18]
mov dword [ebp - 0x78], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x78], eax
call fcn.004c8c7f
add esp, 0x40
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x9c]
push eax
call fcn.00409d10
mov esi, eax
push ebx
mov dword [ebp - 0x74], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x74], eax
call fcn.004c8c7f
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0
call fcn.004c8c20
mov dword [ebp - 0x24], eax
push 0
call fcn.004c8c7f
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x24
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x98]
push eax
call fcn.00409d10
push 0xffffffffffffffff
push 0
push 0
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x25
push ecx
push 1
push 0
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x4c]
push ecx
push esi
push eax
push 0
push 0xffffffffffffffff
push 0
push edi
call fcn.00405510
add esp, 0x74
mov dword [ebp + 0x18], eax
push dword [ebp - 0x98]
call fcn.004c8c7f
push dword [ebp - 0x24]
call fcn.004c8c7f
push dword [ebp - 0x74]
call fcn.004c8c7f
push dword [ebp - 0x9c]
call fcn.004c8c7f
push dword [ebp - 0x78]
call fcn.004c8c7f
push dword [ebp - 0x48]
call fcn.004c8c7f
push dword [ebp - 0x4c]
call fcn.004c8c7f
push dword [ebp - 0x50]
call fcn.004c8c7f
push dword [ebp - 0x54]
call fcn.004c8c7f
push dword [ebp - 0x58]
call fcn.004c8c7f
push dword [ebp - 0x5c]
call fcn.004c8c7f
push dword [ebp - 0x10]
call fcn.004c8c7f
add esp, 0x30
jmp 0x41493a
mov ebx, dword [ebp - 0x44]
push 0x4fbd20
mov dword [ebp - 0x10], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x10], eax
call fcn.004c8c7f
mov edi, dword [ebp - 0xa0]
push ebx
mov dword [ebp - 0x68], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x68], eax
call fcn.004c8c7f
push dword [ebp - 0x18]
mov dword [ebp - 0x64], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x64], eax
call fcn.004c8c7f
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 0x28
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xa4]
push eax
call fcn.00409d10
mov esi, eax
mov ebx, dword [ebp - 0x3c]
push ebx
mov dword [ebp - 0x60], 0
call fcn.004c8c20
push 0
mov dword [ebp - 0x60], eax
call fcn.004c8c7f
push 0xffffffffffffffff
push 0
push 0
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x2a
push eax
movzx eax, byte [ebp + 0x1c]
push eax
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x60]
push eax
push 5
push dword [ebp + 0x18]
push dword [ebp - 0x8c]
push dword [ebp + 8]
call fcn.00405510
add esp, 0x74
push dword [ebp - 0x60]
call fcn.004c8c7f
push dword [ebp - 0xa4]
call fcn.004c8c7f
push dword [ebp - 0x64]
call fcn.004c8c7f
push dword [ebp - 0x68]
call fcn.004c8c7f
push dword [ebp - 0x10]
call fcn.004c8c7f
add esp, 0x14
jmp 0x414a38
mov ebx, dword [ebp - 0x3c]
push dword [ebp - 0x6c]
call fcn.004c8c7f
push dword [ebp - 0x70]
call fcn.004c8c7f
push dword [ebp - 0x1c]
call fcn.004c8c7f
mov eax, dword [ebp - 0x14]
add esp, 0xc
push eax
call fcn.004c8c7f
mov esi, dword [ebp - 0x84]
add esp, 4
mov byte [ebp - 4], 0xc
test esi, esi
je 0x414acf
mov edi, dword [ebp - 0x80]
cmp esi, edi
je 0x414a8b
push dword [esi]
call fcn.004c8c7f
add esi, 4
add esp, 4
cmp esi, edi
jne 0x414a74
mov esi, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x7c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x414aad
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x414b26
push ecx
push esi
call fcn.004c3279
add esp, 8
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
push dword [ebp - 0x88]
call fcn.004c8c7f
lea eax, [ebx + 2]
push 0
push eax
call fcn.004c55d8
add esp, 0xc
cmp word [eax + 2], 0
lea ebx, [eax + 2]
mov dword [ebp - 0x3c], ebx
je 0x414afd
mov edi, dword [ebp + 8]
jmp 0x4144b0
push dword [ebp - 0x20]
call fcn.004c8c7f
add esp, 4
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004c8bcf
int3