Function at 0x41ec2c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6ac
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x6ac]
xor ebx, ebx
push eax
push 0x20019
push ebx
xor esi, esi
mov dword [ebp - 0x6ac], ebx
push ecx
inc esi
mov dword [ebp - 0x6a4], ebx
push SysReAllocString
mov edi, ebx
mov dword [ebp - 0x6a0], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f196
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0x244
push eax
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x6a0]
push eax
push ebx
push ebx
push dword [ebp - 0x6ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f18a
cmp dword [ebp - 0x6a0], esi
jne 0x41f18a
lea ecx, [ebp - 0x694]
call fcn.0041e3a4
test eax, eax
je 0x41f18a
mov eax, ecx
mov dword [ebp - 0x69c], ebx
push eax
push 0x4030ec
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x69c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41edb2
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0x244
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x6a0]
push eax
push ebx
push ebx
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41eda6
cmp dword [ebp - 0x6a0], esi
je 0x41ed5d
cmp dword [ebp - 0x6a0], 2
jne 0x41eda6
lea ecx, [ebp - 0x450]
call fcn.0041e3a4
test eax, eax
je 0x41eda6
mov eax, ecx
mov edi, esi
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea ecx, [ebp - 0x450]
call fcn.0041e3eb
test eax, eax
jne 0x41eda6
push dword [ebp - 0x6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41f198
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x694]
push eax
push 0x403f44
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x69c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ee9f
lea eax, [ebp - 0x694]
mov dword [ebp - 0x698], ebx
push eax
push 0x403f70
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x698]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ee63
mov edx, dword [ebp - 0x698]
mov ecx, dword [ebp - 0x69c]
call fcn.00425c9a
push dword [ebp - 0x698]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x694]
push eax
push 0x403f44
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00418481
add esp, 0x10
lea edx, [ebp - 0x20c]
mov ecx, SysReAllocString
call fcn.00426285
lea eax, [ebp - 0x694]
push eax
push 0x403fa4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x69c]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f18a
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0x244
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x6a0]
push eax
push ebx
push ebx
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f17e
cmp dword [ebp - 0x6a0], esi
jne 0x41f17e
lea ecx, [ebp - 0x450]
call fcn.0041e3a4
test eax, eax
je 0x41f17e
push ecx
lea eax, [ebp - 0x6a8]
mov dword [ebp - 0x698], ebx
mov esi, 0x104
lea ecx, [ebp - 0x20c]
push eax
mov edx, esi
call fcn.00418514
test eax, eax
js 0x41ef7d
mov eax, dword [ebp - 0x6a8]
mov edx, esi
push ecx
push 0x40376c
push ecx
lea ecx, [ebp - 0x20c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.00418577
push ecx
lea eax, [ebp - 0x6a8]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.00418514
test eax, eax
js 0x41efb7
push ecx
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp - 0x6a8]
sub esi, eax
push ecx
lea ecx, [ebp - 0x20c]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.00418577
lea eax, [ebp - 0x20c]
push eax
push 0x403fb8
lea eax, [ebp - 0x450]
push 0x121
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x698]
mov esi, SysReAllocString
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f09c
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0x244
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x6a0]
push eax
push ebx
push ebx
push dword [ebp - 0x698]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f090
cmp dword [ebp - 0x6a0], 1
je 0x41f042
cmp dword [ebp - 0x6a0], 2
jne 0x41f090
lea ecx, [ebp - 0x450]
call fcn.0041e3a4
test eax, eax
je 0x41f090
mov eax, ecx
xor edi, edi
push eax
inc edi
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea ecx, [ebp - 0x450]
call fcn.0041e3eb
test eax, eax
jne 0x41f090
push dword [ebp - 0x6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x698]
jmp 0x41ed99
push dword [ebp - 0x698]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
push 0x403fd0
lea eax, [ebp - 0x450]
push 0x121
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x698]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f17e
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x6a8], ebx
push eax
push 0x403fe8
lea eax, [ebp - 0x450]
push 0x121
push eax
call fcn.00418481
add esp, 0x10
lea eax, [ebp - 0x6a8]
push ebx
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41f145
mov edx, dword [ebp - 0x6a8]
mov ecx, dword [ebp - 0x698]
call fcn.00425c9a
push dword [ebp - 0x6a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x698]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
push 0x403fd0
lea eax, [ebp - 0x450]
push 0x121
push eax
call fcn.00418481
add esp, 0x10
lea edx, [ebp - 0x450]
mov ecx, esi
call fcn.00426285
push dword [ebp - 0x69c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret