Function at 0x417a40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5671e1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x24bc
call fcn.0054e690
mov eax, dword [0x5d51c0]
xor eax, esp
mov dword [esp + 0x24b8], eax
push ebx
push esi
push edi
mov eax, dword [0x5d51c0]
xor eax, esp
push eax
lea eax, [esp + 0x24d0]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x28], ebx
push 0x5adca8
lea ecx, [esp + 0x24]
call fcn.004058d0
xor eax, eax
mov dword [esp + 0x24d8], 0
push 0x206
push eax
mov word [esp + 0x148c], ax
lea eax, [esp + 0x148e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x444], ax
push 0x206
push eax
lea eax, [esp + 0x44e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x34], ax
push 0x206
push eax
lea eax, [esp + 0x3e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x1a9c], ax
push 0x206
push eax
lea eax, [esp + 0x1aa6]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x854], ax
push 0x206
push eax
lea eax, [esp + 0x85e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0xc64], ax
push 0x206
push eax
lea eax, [esp + 0xc6e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x1894], ax
push 0x206
push eax
lea eax, [esp + 0x189e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x1074], ax
push 0x206
push eax
lea eax, [esp + 0x107e]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x20b4], ax
push 0x206
push eax
lea eax, [esp + 0x20be]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x23c], ax
push 0x206
push eax
lea eax, [esp + 0x246]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x64c], ax
push 0x206
push eax
lea eax, [esp + 0x656]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0xa5c], ax
push 0x206
push eax
lea eax, [esp + 0xa66]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0xe6c], ax
push 0x206
push eax
lea eax, [esp + 0xe76]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x22bc], ax
push 0x206
push eax
lea eax, [esp + 0x22c6]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x1eac], ax
push 0x206
push eax
lea eax, [esp + 0x1eb6]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x127c], ax
push 0x206
push eax
lea eax, [esp + 0x1286]
push eax
call fcn.0054cbf0
add esp, 0xc
xor eax, eax
mov word [esp + 0x168c], ax
push 0x206
push eax
lea eax, [esp + 0x1696]
push eax
call fcn.0054cbf0
add esp, 0xc
call fcn.0041e600
cmp eax, 0x804
ja 0x417d6d
je 0x417d65
sub eax, 0x401
cmp eax, 0x28
ja case.0x417ce5.1026
movzx eax, byte [eax + 0x4185ec]
jmp dword [eax*4 + 0x4185b0]
push dword [0x5e1570]
jmp 0x417d91
push dword [0x5e1574]
jmp 0x417d91
push dword [0x5e157c]
jmp 0x417d91
push dword [0x5e1580]
jmp 0x417d91
push dword [0x5e1584]
jmp 0x417d91
push dword [0x5e1588]
jmp 0x417d91
push dword [0x5e158c]
jmp 0x417d91
push dword [0x5e1590]
jmp 0x417d91
push dword [0x5e1594]
jmp 0x417d91
push dword [0x5e1598]
jmp 0x417d91
push dword [0x5e159c]
jmp 0x417d91
push dword [0x5e15a0]
jmp 0x417d91
push dword [0x5e15ac]
jmp 0x417d91
push dword [0x5e15b0]
jmp 0x417d91
push dword [0x5e1578]
jmp 0x417d91
cmp eax, 0x809
je 0x417d8b
cmp eax, 0xc0a
je 0x417d83
push dword [0x5e1570]
jmp 0x417d91
push dword [0x5e15a8]
jmp 0x417d91
push dword [0x5e15a4]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
call esi
mov edi, eax
test edi, edi
jne 0x417db1
push dword [0x5e1570]
call esi
mov edi, eax
test edi, edi
je 0x41855e
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [esp + 0x1484]
push 0x104
push eax
push 0x6a
push edi
call esi
push 0x104
lea eax, [esp + 0x448]
push eax
push 0x6b
push edi
call esi
push 0x104
lea eax, [esp + 0x38]
push eax
push 0x6c
push edi
call esi
push 0x104
lea eax, [esp + 0x1aa0]
push eax
push 0x2765
push edi
call esi
push 0x104
lea eax, [esp + 0x858]
push eax
push 0x2766
push edi
call esi
push 0x104
lea eax, [esp + 0xc68]
push eax
push 0x6f
push edi
call esi
push 0x104
lea eax, [esp + 0x1898]
push eax
push 0x70
push edi
call esi
push 0x104
lea eax, [esp + 0x1078]
push eax
push 0x71
push edi
call esi
push 0x104
lea eax, [esp + 0x20b8]
push eax
push 0x72
push edi
call esi
push 0x104
lea eax, [esp + 0x240]
push eax
push 0x73
push edi
call esi
push 0x104
lea eax, [esp + 0x650]
push eax
push 0x74
push edi
call esi
push 0x104
lea eax, [esp + 0xa60]
push eax
push 0x75
push edi
call esi
push 0x104
lea eax, [esp + 0xe70]
push eax
push 0x76
push edi
call esi
push 0x104
lea eax, [esp + 0x22c0]
push eax
push 0x77
push edi
call esi
push 0x104
lea eax, [esp + 0x1eb0]
push eax
push 0x416
push edi
call esi
push 0x104
lea eax, [esp + 0x1280]
push eax
push 0x417
push edi
call esi
push 0x104
lea eax, [esp + 0x1690]
push eax
push 0x418
push edi
call esi
xor eax, eax
mov dword [esp + 0x14], 0x104
push 0x206
push eax
mov word [esp + 0x1cac], ax
lea eax, [esp + 0x1cae]
push eax
mov dword [esp + 0x30], 1
call fcn.0054cbf0
add esp, 0xc
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.SOFTWAREHNCSharedExecuteOption96
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417fd3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0
push str.LightSizeProductName
push dword [esp + 0x30]
call esi
test eax, eax
jne 0x417fd3
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1ca8]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push str.LightSizeProductName
push dword [esp + 0x30]
call esi
lea eax, [ebx + 0x260]
push eax
lea ecx, [esp + 0x24]
call fcn.00409360
lea ecx, [esp + 0x1ca4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417fa2
sub ecx, edx
lea eax, [esp + 0x1ca4]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x28]
call fcn.00408fb0
push 0xe
push str._Language_Pack
lea ecx, [esp + 0x28]
call fcn.00408fb0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebx + 0x244]
xor ecx, ecx
sub eax, dword [ebx + 0x240]
sar eax, 3
mov dword [esp + 0x24], ecx
test eax, eax
je 0x41855e
lea ebx, [ebx]
mov eax, dword [ebx + 0x240]
mov esi, dword [eax + ecx*8]
mov ecx, dword [esi - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x41802f
cmp ecx, dword [esi - 0x10]
jne 0x41802f
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x418068
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4185ab
mov ecx, dword [esi - 0xc]
mov dword [edi + 4], ecx
mov ecx, dword [esi - 0xc]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ecx*2 + 2]
push esi
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0054b0a9
add esp, 0x10
lea esi, [edi + 0x10]
mov dword [esp + 0x30], esi
mov byte [esp + 0x24d8], 1
lea ebx, [esi - 0x10]
push ecx
mov ecx, dword [ebx]
mov dword [esp + 0x30], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [ebx + 0xc], 0
lea edx, [ebx + 0xc]
mov ecx, eax
jl 0x4180a2
cmp ecx, dword [ebx]
jne 0x4180a2
mov edi, ebx
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4180de
mov eax, dword [ecx]
push 2
push dword [ebx + 4]
call dword [eax]
mov edi, eax
test edi, edi
je 0x4185ab
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebx + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0054b0a9
add esp, 0x10
mov ecx, dword [esp + 0x30]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov ecx, dword [esp + 0x2c]
call fcn.00419920
cmp al, 1
jne 0x41851b
push 0x5adca8
lea ecx, [esp + 0x20]
call fcn.004058d0
mov byte [esp + 0x24d8], 2
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x20]
push dword [eax - 0xc]
push eax
call fcn.00408fb0
push 1
push 0x5ada90
lea ecx, [esp + 0x24]
call fcn.00408fb0
push dword [esi - 0xc]
lea ecx, [esp + 0x20]
push esi
call fcn.00408fb0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
mov ecx, eax
call fcn.0041ea00
mov esi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4184eb
push str.Name
lea ecx, [esp + 0x18]
call fcn.004058d0
cmp esi, 0x804
ja 0x41845c
je 0x41842f
add esi, 0xfffffbff
cmp esi, 0x28
ja case.0x4181a0.1026
movzx eax, byte [esi + 0x418654]
jmp dword [eax*4 + 0x418618]
lea ecx, [esp + 0x444]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4181b1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x448]
jmp 0x4184ba
lea ecx, [esp + 0x1484]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4181e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1488]
jmp 0x4184ba
lea ecx, [esp + 0x854]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418210
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x858]
jmp 0x4184ba
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418236
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x38]
jmp 0x4184ba
lea ecx, [esp + 0xc64]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418260
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0xc68]
jmp 0x4184ba
lea ecx, [esp + 0x1894]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418290
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1898]
jmp 0x4184ba
lea ecx, [esp + 0x1074]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4182c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1078]
jmp 0x4184ba
lea ecx, [esp + 0x20b4]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4182f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x20b8]
jmp 0x4184ba
lea ecx, [esp + 0x23c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418320
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x240]
jmp 0x4184ba
lea ecx, [esp + 0x64c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418350
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x650]
jmp 0x4184ba
lea ecx, [esp + 0xa5c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418380
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0xa60]
jmp 0x4184ba
lea ecx, [esp + 0xe6c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4183b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0xe70]
jmp 0x4184ba
lea ecx, [esp + 0x127c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4183e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1280]
jmp 0x4184ba
lea ecx, [esp + 0x168c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418410
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1690]
jmp 0x4184ba
lea ecx, [esp + 0x1a9c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418440
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1aa0]
jmp 0x4184ba
cmp esi, 0x809
je 0x418492
cmp esi, 0xc0a
jne case.0x4181a0.1026
lea ecx, [esp + 0x1eac]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418476
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x1eb0]
jmp 0x4184ba
lea ecx, [esp + 0x22bc]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4184a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x22c0]
push eax
push 1
push 0
push dword [esp + 0x24]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4184eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x24d8], 1
or ecx, 0xffffffff
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41851b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x24d8], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41853a
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
inc ecx
mov dword [esp + 0x24], ecx
mov eax, dword [ebx + 0x244]
sub eax, dword [ebx + 0x240]
sar eax, 3
cmp ecx, eax
jb 0x418000
mov dword [esp + 0x24d8], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x418587
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x24d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24b8]
xor ecx, esp
call fcn.0054a22c
mov esp, ebp
pop ebp
ret
call fcn.00405610
or eax, 0x200417d
jge 4294136
add byte [0xec00417d], dl
jl 0x418600
add byte [0x4d00417d], dh
jge 0x418608
add byte [ebp + 0x7d], dl
inc ecx
add byte [0xf700417d], bl
jl 0x418614
add byte [ebp + 0x7d], al
inc ecx
add byte [ebp + 0x7d], bl
inc ecx
add byte [0x2d00417d], ah
jge 0x418624
add byte [0xec00417d], bh
jl 0x41862c
add byte [eax], al
push cs
push cs
add dword [esi], ecx
push cs
add cl, byte [esi]
add eax, dword [esi + ecx]
add eax, 101584398
push cs
push cs
push cs
push es
pop es
or byte [ecx], cl
push cs
or cl, byte [ebx]
push cs
push cs
or al, 14
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
or eax, 0x2f00498d
add byte [ecx], 255
add dword [ecx], case.0x4181a0.1031
cmpsd dword [esi], dword es:[edi]
add dword [ecx], case.0x4181a0.1034
lahf
add dword [ecx], -49
add dword [ecx], 0x7f
add byte [ecx], 0xd0
add dword [ecx], case.0x4181a0.1043
inc dword [ebx - 0x7d50ffbf]
inc ecx
add bh, bl
add byte [ecx], 0x3f
add dword [ecx], 0xffffffcd
test byte [ecx], al
add byte [esi], cl
push cs
add dword [esi], ecx
push cs
add cl, byte [esi]
add eax, dword [esi + ecx]
add eax, 101584398
pop es
or byte [ecx], cl
push cs
or cl, byte [ebx]
push cs
push cs
or al, 14
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
push cs
or eax, 1456262348
mov esi, ecx
call fcn.0041e980
cmp al, 1
jne 0x4186ce
push 0
push 0
push 0x147
push dword [esi + 0x178]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
test eax, eax
jne 0x4186bb
push eax
push 0x275d
call fcn.0042e5d4
mov ecx, eax
call fcn.0042e4a6
pop esi
ret
push 1
push 0x275d
call fcn.0042e5d4
mov ecx, eax
call fcn.0042e4a6
pop esi
ret