Function at 0x41e0f0
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
sub esp, 0x578
push ebp
mov ebp, dword [esp + 0x580]
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
push edi
cmp eax, 1
mov dword [esp + 0x14], esi
jne 0x41e11f
pop edi
pop esi
mov eax, 0x4ee7e4
pop ebp
add esp, 0x578
ret 4
mov eax, dword [ebp + 0x68]
push 0x2e
push eax
call fcn.004c82b0
add esp, 8
mov dword [esp + 0x10], 0
test eax, eax
jne 0x41e13e
mov eax, 0x4ee814
inc eax
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.kernel32.dll_lstrcpy]
lea ecx, [esp + 0x1c]
push ecx
call fcn.004c85b7
add esp, 4
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.0041e0c0
mov ecx, dword [esi]
mov dword [esp + 0x18], eax
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x41e1b9
mov eax, dword [edi]
mov dword [esp + 0x10], edi
lea esi, [esp + 0x1c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41e19f
test cl, cl
je 0x41e19b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41e19f
add eax, 2
add esi, 2
test cl, cl
jne 0x41e17b
xor eax, eax
jmp 0x41e1a4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41e1b1
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x41e171
jmp 0x41e1b9
test edi, edi
jne 0x41e34b
push 0x14
call fcn.004c7e90
xor esi, esi
add esp, 4
cmp eax, esi
je 0x41e1e3
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], 0xffffffff
mov dword [eax + 0x10], esi
mov edi, eax
jmp 0x41e1e5
xor edi, edi
lea eax, [esp + 0x1c]
push eax
call fcn.00442c90
add esp, 4
lea ecx, [esp + 0x324]
mov dword [edi], eax
mov eax, dword [ebp + 0x68]
push 0x400
push 0x160
push ecx
push esi
mov esi, dword [sym.imp.shell32.dll_SHGetFileInfo]
push eax
call esi
test eax, eax
je 0x41e224
lea edx, [esp + 0x434]
push edx
jmp 0x41e319
mov eax, dword [ebp + 0x68]
push 0x410
lea ecx, [esp + 0x328]
push 0x160
push ecx
push 0x80
push eax
call esi
test eax, eax
je 0x41e252
lea edx, [esp + 0x434]
push edx
jmp 0x41e319
cmp dword [ebp + 8], 1
jne 0x41e262
push 0x4ee7e4
jmp 0x41e319
mov eax, dword [ebp + 0x68]
push 0x2e
push eax
call fcn.004c82b0
mov esi, eax
add esp, 8
test esi, esi
je 0x41e317
mov ebp, dword [sym.imp.advapi32.dll_RegQueryValueA]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x484]
push eax
push ecx
push esi
push 0x80000000
mov dword [esp + 0x1c], 0x100
call ebp
test eax, eax
jne 0x41e2cf
lea edx, [esp + 0xc]
lea eax, [esp + 0x224]
push edx
lea ecx, [esp + 0x488]
push eax
push ecx
push 0x80000000
mov dword [esp + 0x1c], 0x100
call ebp
lea eax, [esp + 0x224]
push eax
jmp 0x41e319
inc esi
lea edx, [esp + 0x124]
push esi
push edx
call dword [sym.imp.kernel32.dll_lstrcpy]
lea eax, [esp + 0x124]
push eax
call fcn.004c85b7
add esp, 4
lea ecx, [esp + 0x124]
lea edx, [esp + 0x224]
push ecx
push 0x4ee7dc
push edx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x224]
push eax
jmp 0x41e319
push 0
call fcn.00442c90
mov dword [edi + 4], eax
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
je 0x41e33e
mov dword [eax + 0x10], edi
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
add esp, 0x578
ret 4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov edx, dword [ecx]
mov dword [edx + eax*4], edi
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebp
add esp, 0x578
ret 4