Function at 0x412fc1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
add ecx, 4
push ecx
mov esi, 0xff
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.00408ad1
push 0x404308
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040bc6a
mov edi, dword [ebp + 8]
lea ebx, [edi + 0x10c]
push ebx
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040bc6a
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413276
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x413276
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x464]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4042ec
push dword [ebp - 8]
mov dword [ebp - 4], 0x1c
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x480]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4042d4
push dword [ebp - 8]
mov dword [ebp - 4], 0x2c
call esi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x23c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4042c4
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x240]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4042a8
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x244]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404294
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x248]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404284
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + 0x24c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404268
push dword [ebp - 8]
mov dword [ebp - 4], 0x208
call esi
lea eax, [edi + 0x24c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
jne 0x413184
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x204], 0
jne 0x41316a
push 0x1048
call sub.MFC42u.DLL_operatornew
mov ecx, dword [ebp - 0x10]
mov dword [esp], 0x824
push eax
mov dword [ecx + 0x204], eax
call dword [sym.imp.MSO.DLL_Ordinal_1326]
mov eax, dword [ebp - 0x10]
push dword [eax + 0x204]
lea eax, [edi + 0x24c]
push 0x104
push eax
call fcn.00408ad1
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x454]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404260
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x458]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404250
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x45c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404240
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 4]
push eax
lea eax, [edi + 0x460]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x40422c
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + 0x4ac]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x404210
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
lea eax, [edi + 0x4ac]
cmp dword [eax], 2
jl 0x413228
and dword [eax], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x4041f8
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
mov esi, eax
mov eax, dword [ebp - 0x14]
and eax, 0x7fff
add edi, 0x4b0
mov dword [edi], eax
cmp eax, dword [0x4047f0]
jb 0x413264
mov eax, dword [0x4047f4]
mov dword [edi], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
jmp 0x413278
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4