Function at 0x41564c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8f
push 0
push 0
dec ecx
jne 0x415654
push ebx
push esi
push edi
mov ebx, eax
lea edi, [ebp - 0x3ed]
xor eax, eax
push ebp
push 0x415b6e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004034e4
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x3f4]
mov eax, 0x415b88
call fcn.004069a8
mov eax, dword [ebp - 0x3f4]
call fcn.00403990
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
jmp 0x415826
lea eax, [ebp - 0x3fc]
mov edx, dword [ebx]
call fcn.00403d88
push dword [ebp - 0x3fc]
push 0
lea eax, [ebp - 0x400]
push eax
lea edx, [ebp - 0x408]
mov eax, 0x415bd8
call fcn.004069a8
mov eax, dword [ebp - 0x408]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x404]
call fcn.00403cf4
mov eax, dword [ebp - 0x404]
push eax
lea edx, [ebp - 0x410]
mov eax, 0x415bf4
call fcn.004069a8
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x414]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x414]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x410]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x40c]
call fcn.00403cf4
mov edx, dword [ebp - 0x40c]
mov eax, 0x80000002
pop ecx
call fcn.004075c0
push dword [ebp - 0x400]
push 0x415c44
push 0
lea eax, [ebp - 0x418]
push eax
lea edx, [ebp - 0x420]
mov eax, 0x415c50
call fcn.004069a8
mov eax, dword [ebp - 0x420]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x41c]
call fcn.00403cf4
mov eax, dword [ebp - 0x41c]
push eax
lea edx, [ebp - 0x428]
mov eax, 0x415bf4
call fcn.004069a8
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x42c]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x42c]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x428]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x424]
call fcn.00403cf4
mov edx, dword [ebp - 0x424]
mov eax, 0x80000002
pop ecx
call fcn.004075c0
push dword [ebp - 0x418]
push 0x415c6c
lea eax, [ebp - 0x3f8]
mov edx, 5
call fcn.00403e78
mov edx, dword [ebp - 0x3f8]
mov eax, ebx
call fcn.0040377c
inc esi
push 0x3e9
push edi
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x4156b3
xor esi, esi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x430]
mov eax, 0x415b88
call fcn.004069a8
mov eax, dword [ebp - 0x430]
call fcn.00403990
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
jmp 0x4159e9
lea eax, [ebp - 0x438]
mov edx, dword [ebx]
call fcn.00403d88
push dword [ebp - 0x438]
push 0
lea eax, [ebp - 0x43c]
push eax
lea edx, [ebp - 0x444]
mov eax, 0x415bd8
call fcn.004069a8
mov eax, dword [ebp - 0x444]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x440]
call fcn.00403cf4
mov eax, dword [ebp - 0x440]
push eax
lea edx, [ebp - 0x44c]
mov eax, 0x415bf4
call fcn.004069a8
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x450]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x450]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x44c]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x448]
call fcn.00403cf4
mov edx, dword [ebp - 0x448]
mov eax, 0x80000001
pop ecx
call fcn.004075c0
push dword [ebp - 0x43c]
push 0x415c44
push 0
lea eax, [ebp - 0x454]
push eax
lea edx, [ebp - 0x45c]
mov eax, 0x415c50
call fcn.004069a8
mov eax, dword [ebp - 0x45c]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x458]
call fcn.00403cf4
mov eax, dword [ebp - 0x458]
push eax
lea edx, [ebp - 0x464]
mov eax, 0x415bf4
call fcn.004069a8
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x468]
mov edx, edi
mov ecx, 0x3e9
call fcn.00403748
mov edx, dword [ebp - 0x468]
pop eax
call fcn.00403798
mov eax, dword [ebp - 0x464]
call fcn.00403990
mov edx, eax
lea eax, [ebp - 0x460]
call fcn.00403cf4
mov edx, dword [ebp - 0x460]
mov eax, 0x80000001
pop ecx
call fcn.004075c0
push dword [ebp - 0x454]
push 0x415c6c
lea eax, [ebp - 0x434]
mov edx, 5
call fcn.00403e78
mov edx, dword [ebp - 0x434]
mov eax, ebx
call fcn.0040377c
inc esi
push 0x3e9
push edi
push esi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x415876
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x470]
mov edx, dword [ebx]
call fcn.00403d88
mov eax, dword [ebp - 0x470]
mov ecx, 0x415c78
mov edx, 0x415c84
call fcn.0040717c
mov edx, dword [ebp - 0x46c]
mov eax, ebx
call fcn.0040377c
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x478]
mov edx, dword [ebx]
call fcn.00403d88
mov eax, dword [ebp - 0x478]
mov ecx, 0x415c78
mov edx, 0x415c94
call fcn.0040717c
mov edx, dword [ebp - 0x474]
mov eax, ebx
call fcn.0040377c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415b78
lea eax, [ebp - 0x478]
mov edx, 4
call fcn.00403bf4
lea eax, [ebp - 0x468]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x460]
call fcn.00403bdc
lea eax, [ebp - 0x45c]
call fcn.004034e4
lea eax, [ebp - 0x458]
mov edx, 2
call fcn.00403bf4
lea eax, [ebp - 0x450]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x448]
call fcn.00403bdc
lea eax, [ebp - 0x444]
call fcn.004034e4
lea eax, [ebp - 0x440]
mov edx, 4
call fcn.00403bf4
lea eax, [ebp - 0x430]
mov edx, 3
call fcn.00403508
lea eax, [ebp - 0x424]
call fcn.00403bdc
lea eax, [ebp - 0x420]
call fcn.004034e4
lea eax, [ebp - 0x41c]
mov edx, 2
call fcn.00403bf4
lea eax, [ebp - 0x414]
mov edx, 2
call fcn.00403508
lea eax, [ebp - 0x40c]
call fcn.00403bdc
lea eax, [ebp - 0x408]
call fcn.004034e4
lea eax, [ebp - 0x404]
mov edx, 4
call fcn.00403bf4
lea eax, [ebp - 0x3f4]
call fcn.004034e4
ret