Function at 0x41a550
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x47d45b
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x4a67d0]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
mov eax, dword [0x4a67d0]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov eax, dword [esp + 0x144]
mov ecx, dword [esp + 0x150]
mov edi, dword [esp + 0x14c]
xor ebx, ebx
push 0x103
lea edx, [esp + 0x31]
push ebx
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x30], 0x104
mov byte [esp + 0x38], bl
call fcn.00461680
mov esi, dword [esp + 0x154]
add esp, 0xc
mov ecx, str.HKEY_CLASSES_ROOT
mov eax, esi
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41a606
cmp dx, bx
je 0x41a602
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41a606
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x41a5e0
xor eax, eax
jmp 0x41a60b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41a619
mov eax, SysReAllocStringLen
jmp 0x41a698
mov ecx, str.HKEY_LOCAL_MACHINE
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41a646
cmp dx, bx
je 0x41a642
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41a646
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x41a620
xor eax, eax
jmp 0x41a64b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x41a656
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x41a698
mov ecx, str.HKEY_CURRENT_USER
mov eax, esi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41a686
cmp dx, bx
je 0x41a682
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41a686
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x41a660
xor eax, eax
jmp 0x41a68b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
mov eax, SysReAllocStringLen
je 0x41a698
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x154]
sub ecx, ebx
je 0x41a7b2
sub ecx, 1
jne 0x41a7d8
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a6f3
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x41a6fd
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x41a7da
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.00403a00
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x140], ebx
call fcn.00403a00
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41a75b
cmp dx, bx
je 0x41a757
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41a75b
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x41a735
xor eax, eax
jmp 0x41a760
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
setl dl
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
mov ebx, edx
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a785
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x13c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41a7d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41a7d8
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41a7cd
mov ebx, 1
jmp 0x41a7d8
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.004611fb
add esp, 0x130
ret 0x14