Function at 0x411770
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x46c
push str.revise_llaves
push 1
mov dword [esp + 0x10], 0
call fcn.0040c720
add esp, 8
call fcn.00411720
test eax, eax
je 0x4117a3
push 0x42f470
call fcn.004115e0
add esp, 4
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x2001f
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x411806
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x411806
mov eax, dword [0x43083c]
test eax, eax
jne 0x411faa
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x46c
ret
mov eax, dword [0x429908]
push 1
test eax, eax
je 0x411826
mov edx, dword [esp + 0x14]
push 0x42aac4
push 1
push 0
push str.TIMEAP
push edx
jmp 0x411839
mov eax, dword [esp + 0x14]
push 0x42aab8
push 1
push 0
push str.TIMEAP
push eax
call ebp
mov ecx, dword [esp + 0x10]
push 2
push 0x428b1c
push 1
push 0
push str.SoloDisc
push ecx
call ebp
mov edi, str.C:WINDOWSLEVTEMP
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.C:WINDOWSLEVTEMP
push 1
push eax
push str.TempDir
push edx
call ebp
mov edi, 0x42f470
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42f470
push 1
push eax
mov eax, dword [esp + 0x20]
push str.Path
push eax
call ebp
call fcn.00411720
test eax, eax
jne 0x4118c2
mov edi, 0x42f470
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esp + 0x14]
push 0x42f470
push 1
push eax
push str.PathPub
push ecx
call ebp
lea edx, [esp + 0x1c]
push edx
push str.SLEEP
call fcn.004114b0
add esp, 8
cmp eax, 1
jge 0x4118eb
lea eax, [esp + 0x1c]
push 0x42aaac
push eax
call fcn.00416129
add esp, 8
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Sleep
push edx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x148]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
mov esi, 0xbe
push str.Remcon
push eax
mov dword [esp + 0x2c], esi
call ebx
lea ecx, [esp + 0x1c]
push ecx
push str.GLOBAL
call fcn.004114b0
add esp, 8
cmp eax, 1
jge 0x411959
lea edx, [esp + 0x1c]
push 0x42aab8
push edx
jmp 0x411963
lea eax, [esp + 0x1c]
push 0x42aa90
push eax
call fcn.00416129
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Remcon
push edx
call ebp
lea eax, [esp + 0x148]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x4119b0
mov dword [0x43079c], 1
lea edx, [esp + 0x14]
lea eax, [esp + 0x148]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.Remot
push edx
mov dword [esp + 0x2c], esi
call ebx
lea eax, [esp + 0x1c]
push eax
push str.REMOT
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Remot
push edx
call ebp
lea eax, [esp + 0x148]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x411a2b
mov dword [0x43079c], 1
mov edx, dword [0x429434]
lea eax, [esp + 0x1c]
push edx
push 0x42a670
push eax
call fcn.00416129
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Version
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REMOTSERV
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.RemotServ
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DAYSDISCOV
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DAYSDISCOV
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DAYSDIRECT
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DAYSDIRECT
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPALLEXES
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPALLEXES
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.INFOEXE
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.INFOEXE
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPINFARCHS
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPINFARCHS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPTAMARCHS
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPTAMARCHS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPINFDIRS
call fcn.004114b0
add esp, 8
or ecx, 0xffffffff
lea edi, [esp + 0x1c]
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPINFDIRS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPINFEXTS
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPINFEXTS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.AUDITDAYS
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.AUDITDAYS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.AUDITDIRS
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.AUDITDIRS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.AUDITTAMDIR
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
mov edx, dword [esp + 0x18]
push 1
push eax
push str.AUDITTAMDIR
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.REPTAMDIRS
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.REPTAMDIRS
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.WAKEUP
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.WAKEUP
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.ASKCONFIRM
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.ASKCONFIRM
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DAYSCONFIRM
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DAYSCONFIRM
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.ServFiles
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.SERVFILES
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.DISPLAY
call fcn.004114b0
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.DISPLAY
push edx
call ebp
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push str.Start
push eax
mov dword [esp + 0x2c], esi
call ebx
test eax, eax
je 0x411e9a
lea ecx, [esp + 0x1c]
push ecx
push str.START
call fcn.004114b0
mov al, byte [esp + 0x24]
add esp, 8
test al, al
jne 0x411e78
mov edi, 0x42a980
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, 0xbe
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Start
push edx
call ebp
push 0x42f8d8
lea eax, [esp + 0x354]
push str._sconfig.txt
push eax
mov byte [esp + 0x28], 0
call fcn.00416129
lea ecx, [esp + 0x28]
push ecx
push str.SEND
call fcn.004114b0
add esp, 0x14
test eax, eax
jl 0x411eee
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.SERVER1
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
push str.IDIOM
call fcn.004114b0
add esp, 8
test eax, eax
jl 0x411f26
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.Idiom
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
push str.SENDDIR
call fcn.004112e0
add esp, 8
test eax, eax
jl 0x411f5e
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.SendDir
push eax
call ebp
lea ecx, [esp + 0x1c]
push 0x428b1c
push ecx
call fcn.00416129
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
lea edx, [esp + 0x1c]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.INSTOK
push eax
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x411faf
mov esi, 0xbe
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push str.SoftwareLeverITChat
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x412002
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareLeverITChat
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x412002
mov eax, dword [0x43083c]
test eax, eax
jne 0x4121cc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x46c
ret
push 0x42f470
lea edx, [esp + 0x20]
push str._sChat
push edx
call fcn.00416129
lea eax, [esp + 0x28]
push eax
call fcn.004103a0
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push 1
push eax
push str.Path
push edx
call ebp
lea eax, [esp + 0x1c]
push eax
push str.PORTCCLIENTS
call fcn.004112e0
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.PORTCCLIENTS
push ecx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.PORTCCLIENTS
push eax
call ebp
lea ecx, [esp + 0x148]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x4120c0
mov dword [0x43079c], 1
lea eax, [esp + 0x1c]
push eax
push str.PORTCCLIENTC
call fcn.004112e0
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.PORTCCLIENTC
push ecx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.PORTCCLIENTC
push eax
call ebp
lea ecx, [esp + 0x148]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x41213b
mov dword [0x43079c], 1
lea eax, [esp + 0x1c]
push eax
push str.PORTHUSR
call fcn.004112e0
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x148]
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push 0
push str.PORTHUSR
push ecx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push str.PORTHUSR
push eax
call ebp
lea ecx, [esp + 0x148]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0041f970
add esp, 8
test eax, eax
je 0x4121b6
mov dword [0x4307a0], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00414660
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x46c
ret