Function at 0x41c7d0
Capabilities:
Get thread local storage value
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45db60
mov eax, dword fs:[0]
push eax
sub esp, 0x300
mov eax, dword [0x473354]
xor eax, esp
mov dword [esp + 0x2fc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x314]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x324]
mov edi, dword [esp + 0x328]
mov ebp, dword [esp + 0x32c]
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], edi
mov dword [esp + 0x60], ebp
cmp dword [0x474d7c], esi
je 0x41ca03
cmp dword [esp + 0x330], 0xffffffff
jne 0x41ca03
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x48], eax
push 0x46043c
mov dword [esp + 0x324], esi
call fcn.0042f484
mov dword [esp + 0x40], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x40], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x40], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x50], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x30], eax
push 0x46043c
call fcn.0042f484
add esp, 0x1c
mov dword [esp + 0x1c], eax
mov eax, ebp
cmp ebp, esi
jne 0x41c8c3
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x24], eax
push 0x46043c
call fcn.0042f484
add esp, 8
mov dword [esp + 0x2c], eax
mov eax, ebp
cmp ebp, esi
jne 0x41c8e9
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x60]
push edi
push edx
mov byte [esp + 0x330], 9
call fcn.00407af0
mov esi, eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x68]
push edi
push edx
mov byte [esp + 0x340], 0xa
call fcn.00407af0
push 0xffffffffffffffff
push 0
push 0
lea ecx, [esp + 0x74]
push ecx
push 1
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x80]
push ecx
lea edx, [esp + 0x60]
push edx
push esi
push eax
push 0
push 0xffffffffffffffff
push 0
push ebx
mov byte [esp + 0x380], 0xb
call fcn.0040c0f0
mov dword [esp + 0x394], eax
mov eax, dword [esp + 0xb0]
add esp, 0x64
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x38]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x30]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x30]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x58]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x50]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x58]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x70]
push edx
mov dword [esp + 0x34c], 0xffffffff
call fcn.0042f4d9
add esp, 0x30
xor esi, esi
mov ecx, dword [0x4746a8]
lea eax, [esp + 0x28]
push eax
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
push esi
push ebp
push edi
call fcn.00409f10
add esp, 0x14
cmp eax, esi
jne 0x41d47e
mov eax, dword [esp + 0x28]
push 0x104
lea edx, [esp + 0x10c]
push edx
push esi
push eax
mov dword [esp + 0x5c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x41d473
jmp 0x41ca62
xor esi, esi
cmp byte [esp + 0x334], 0
mov dword [esp + 0x18], esi
je 0x41ca77
mov edi, 0x46043c
jmp 0x41caae
push str.AutorunsDisabled
call fcn.0042f484
mov dword [esp + 0x48], eax
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x48]
push ecx
mov eax, 0x460cb4
lea ecx, [esp + 0xe0]
or esi, 1
call fcn.0041b9c0
add esp, 8
mov edi, dword [eax]
or esi, 2
mov dword [esp + 0x14], esi
lea edx, [esp + 0x108]
push edx
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x44], esi
lea eax, [esp + 0x44]
push eax
mov eax, edi
lea ecx, [esp + 0xbc]
mov dword [esp + 0x324], 0xe
call fcn.0041b980
add esp, 8
mov edx, dword [0x4746a8]
mov edi, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push edx
mov byte [esp + 0x324], 0xf
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
mov eax, dword [esp + 0x30]
push 0
push edi
push eax
call fcn.00409f10
mov ecx, dword [esp + 0xc8]
test eax, eax
push ecx
sete bl
call fcn.0042f4d9
push esi
call fcn.0042f4d9
add esp, 0x1c
test byte [esp + 0x14], 2
je 0x41cb48
mov edx, dword [esp + 0xd8]
and dword [esp + 0x14], 0xfffffffd
push edx
call fcn.0042f4d9
add esp, 4
test byte [esp + 0x14], 1
mov dword [esp + 0x31c], 0xffffffff
je 0x41cb6c
mov eax, dword [esp + 0x44]
and dword [esp + 0x14], 0xfffffffe
push eax
call fcn.0042f4d9
add esp, 4
test bl, bl
je 0x41d041
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x210]
push edx
push 0
push 0
push str.Debugger
push eax
mov dword [esp + 0x70], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d036
push 1
call fcn.0042f396
mov dword [esp + 0x24], eax
mov byte [eax], 0
push 1
mov dword [esp + 0x324], 0x10
call fcn.0042f396
mov dword [esp + 0x2c], eax
mov byte [eax], 0
push 1
call fcn.0042f396
mov dword [esp + 0x38], eax
add esp, 0xc
mov byte [eax], 0
lea ecx, [esp + 0xec]
mov byte [esp + 0x31c], 0x12
call fcn.00402320
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x210]
push edx
mov byte [esp + 0x324], 0x13
call fcn.0040ef90
push 0
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.0040b350
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x5c]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x38]
push eax
push ecx
push esi
mov byte [esp + 0x340], 0x14
call fcn.0040b950
lea edx, [esp + 0x12c]
push edx
mov edi, eax
call fcn.0042f484
mov dword [esp + 0x60], eax
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x6c]
push eax
push esi
mov byte [esp + 0x358], 0x15
call fcn.0040bd70
mov ecx, dword [esp + 0x74]
push ecx
mov bl, al
call fcn.0042f4d9
add esp, 0x40
test bl, bl
je 0x41cfd7
cmp dword [esp + 0x330], 0xffffffff
jne 0x41ce87
push 0x46043c
call fcn.0042f484
mov dword [esp + 0xac], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x70], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0xac], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x7c], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x78], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0xb0], eax
push 0x46043c
call fcn.0042f484
add esp, 0x1c
mov dword [esp + 0x9c], eax
mov eax, ebp
test ebp, ebp
jne 0x41cd19
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x40], eax
push 0x46043c
call fcn.0042f484
add esp, 8
mov dword [esp + 0x30], eax
mov eax, ebp
test ebp, ebp
jne 0x41cd3f
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x38], eax
mov ebx, dword [esp + 0x54]
lea edx, [esp + 0xa0]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0xf0]
push ebx
push ecx
mov byte [esp + 0x330], 0x1f
call fcn.00407af0
mov esi, eax
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0xdc]
push ebx
push ecx
mov byte [esp + 0x340], 0x20
call fcn.00407af0
push 0xffffffffffffffff
push 0
push 0
lea edx, [esp + 0xd8]
push edx
push 1
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0xdc]
push edx
lea ecx, [esp + 0xac]
push ecx
lea edx, [esp + 0xa8]
push edx
mov edx, dword [esp + 0x90]
lea ecx, [esp + 0xe0]
push ecx
push esi
push eax
push 0
push 0xffffffffffffffff
push 0
push edx
mov byte [esp + 0x380], 0x21
call fcn.0040c0f0
mov dword [esp + 0x394], eax
mov eax, dword [esp + 0x124]
add esp, 0x64
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0xe8]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x3c]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0xb0]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xb0]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x8c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xc4]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x90]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0xd4]
push edx
call fcn.0042f4d9
add esp, 0x30
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x80], eax
lea eax, [esp + 0x210]
push eax
call fcn.0042f484
add esp, 8
mov dword [esp + 0x94], eax
mov eax, ebp
test ebp, ebp
jne 0x41ceba
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0xb4], eax
lea ecx, [esp + 0x10c]
push ecx
call fcn.0042f484
mov dword [esp + 0x78], eax
lea edx, [esp + 0x110]
push edx
call fcn.0042f484
mov esi, eax
mov dword [esp + 0x4c], esi
lea eax, [esp + 0x4c]
push eax
mov eax, 0x465910
lea ecx, [esp + 0xf0]
call fcn.0041b980
mov edx, dword [esp + 0x60]
push eax
lea ecx, [esp + 0xc4]
push ecx
push edx
lea eax, [esp + 0xe4]
push eax
mov byte [esp + 0x33c], 0x27
call fcn.00407af0
movzx edx, byte [esp + 0x354]
push 0xffffffffffffffff
push 0
push 0
lea ecx, [esp + 0xa8]
push ecx
push edx
lea ecx, [esp + 0xc8]
push ecx
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x60]
push ecx
mov ecx, dword [esp + 0x90]
push eax
mov eax, dword [esp + 0x37c]
lea edx, [esp + 0xbc]
push edx
push 1
push eax
push edi
push ecx
mov byte [esp + 0x37c], 0x28
call fcn.0040c0f0
mov edx, dword [esp + 0x128]
add esp, 0x60
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xe4]
push eax
call fcn.0042f4d9
push esi
call fcn.0042f4d9
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0xc0]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xa8]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x94]
push ecx
call fcn.0042f4d9
add esp, 0x1c
mov edx, dword [esp + 0x1c]
push edx
call fcn.0042f4d9
add esp, 4
lea ecx, [esp + 0xf0]
call fcn.00402070
mov eax, dword [esp + 0xf0]
push eax
call fcn.0042f2c2
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x34]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x30]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x30]
push ecx
mov dword [esp + 0x330], 0xffffffff
call fcn.0042f4d9
add esp, 0x14
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x4746a8]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
or eax, 0x20019
push eax
mov eax, dword [esp + 0x30]
push 0
lea edx, [esp + 0x114]
push edx
push eax
call fcn.00409f10
add esp, 0x14
test eax, eax
jne 0x41d449
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0xd4]
push edx
push eax
push eax
mov eax, dword [esp + 0x28]
push str.GlobalFlag
push eax
mov dword [esp + 0x70], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41d43e
test dword [esp + 0xd0], 0x100
je 0x41d43e
cmp dword [esp + 0x330], 0xffffffff
jne 0x41d2d6
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x94], eax
push 0x46043c
mov dword [esp + 0x324], 0x29
call fcn.0042f484
mov dword [esp + 0x90], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x8c], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x88], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x88], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0xc4], eax
push 0x46043c
call fcn.0042f484
add esp, 0x1c
mov dword [esp + 0x8c], eax
mov eax, ebp
test ebp, ebp
jne 0x41d156
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x60], eax
push 0x46043c
call fcn.0042f484
add esp, 8
mov dword [esp + 0x84], eax
mov eax, ebp
test ebp, ebp
jne 0x41d17f
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0xa8], eax
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x90]
push ecx
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0xc4]
push edi
push eax
mov byte [esp + 0x330], 0x32
call fcn.00407af0
mov esi, eax
lea ecx, [esp + 0x98]
push ecx
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x104]
push edi
push eax
mov byte [esp + 0x340], 0x33
call fcn.00407af0
push 0xffffffffffffffff
push 0
push 0
lea ecx, [esp + 0xc0]
push ecx
push 1
lea edx, [esp + 0xc0]
push edx
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0xb8]
push edx
lea ecx, [esp + 0xb8]
push ecx
lea edx, [esp + 0xf4]
push edx
push esi
push eax
mov eax, dword [esp + 0x9c]
push 0
push 0xffffffffffffffff
push 0
push eax
mov byte [esp + 0x380], 0x34
call fcn.0040c0f0
mov ecx, dword [esp + 0x14c]
add esp, 0x64
push ecx
mov dword [esp + 0x334], eax
call fcn.0042f4d9
mov edx, dword [esp + 0xbc]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xac]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x90]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x6c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xa0]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x90]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x98]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0xa4]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0xb0]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0xbc]
push eax
call fcn.0042f4d9
add esp, 0x30
cmp byte [esp + 0x334], 0
je 0x41d2e7
mov ebx, 0x46043c
jmp 0x41d315
push str.AutorunsDisabled
call fcn.0042f484
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], eax
push ecx
mov eax, 0x460cb4
lea ecx, [esp + 0xdc]
call fcn.0041b9c0
mov ebx, dword [eax]
add esp, 8
or dword [esp + 0x14], 0xc
lea edx, [esp + 0x108]
push edx
call fcn.0042f484
mov ebp, eax
mov eax, dword [esp + 0x64]
add esp, 4
mov dword [esp + 0xbc], ebp
test eax, eax
jne 0x41d33b
mov eax, 0x46043c
push eax
call fcn.0042f484
mov edi, eax
lea eax, [esp + 0x44]
push eax
mov eax, 0x460cb4
lea ecx, [esp + 0xd4]
mov dword [esp + 0x48], edi
call fcn.0041b980
lea ecx, [esp + 0xc4]
push ecx
lea esi, [esp + 0xd0]
call fcn.0041b950
push eax
mov eax, ebx
lea ecx, [esp + 0xec]
call fcn.0041b980
mov edx, dword [esp + 0xd4]
push edx
mov dword [esp + 0x330], 0x35
call fcn.0042f4d9
mov eax, dword [esp + 0xe0]
push eax
call fcn.0042f4d9
push edi
call fcn.0042f4d9
push ebp
call fcn.0042f4d9
mov ebx, dword [esp + 0x34]
add esp, 0x20
test bl, 8
je 0x41d3d4
mov ecx, dword [esp + 0xd4]
and ebx, 0xfffffff7
push ecx
mov dword [esp + 0x18], ebx
call fcn.0042f4d9
add esp, 4
test bl, 4
je 0x41d3ed
mov edx, dword [esp + 0x54]
and ebx, 0xfffffffb
push edx
mov dword [esp + 0x18], ebx
call fcn.0042f4d9
add esp, 4
mov eax, dword [esp + 0x334]
mov ecx, dword [esp + 0x330]
mov esi, dword [esp + 0xdc]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x50]
push 0x20
lea edx, [esp + 0x114]
push edx
push str.VerifierDlls
push esi
push eax
push ecx
call fcn.0041c420
push esi
mov dword [esp + 0x340], 0xffffffff
call fcn.0042f4d9
mov ebp, dword [esp + 0x84]
add esp, 0x24
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x28]
push 0x104
lea ecx, [esp + 0x10c]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x5c], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x41ca60
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x330]
mov ecx, dword [esp + 0x314]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2fc]
xor ecx, esp
call fcn.00430430
add esp, 0x30c
ret