Function at 0x413180
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x499100]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, byte [ebp + 8]
mov edx, 0x100
test cl, cl
mov byte [ebp - 0x20d], cl
mov eax, 0x200
cmovne eax, edx
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, 0x104
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x4131df
add eax, 2
sub ecx, 1
jne 0x4131d1
push ebx
push esi
push edi
mov esi, 0x104
mov edi, ecx
mov eax, esi
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x413238
mov edx, esi
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x41322b
mov ebx, 0x487afc
mov eax, 0x7ffffffe
sub ebx, ecx
test eax, eax
je 0x41322b
movzx edi, word [ebx + ecx]
test di, di
je 0x41322b
mov word [ecx], di
dec eax
add ecx, 2
sub edx, 1
jne 0x413212
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x41324e
add eax, 2
sub ecx, 1
jne 0x413240
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x4132a6
mov edx, esi
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x413299
mov ebx, str.obs_studio_hook_
mov eax, 0x7ffffffe
sub ebx, ecx
nop dword [eax]
test eax, eax
je 0x413299
movzx edi, word [ecx + ebx]
test di, di
je 0x413299
mov word [ecx], di
dec eax
add ecx, 2
sub edx, 1
jne 0x413280
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
lea eax, [ebp - 0x20c]
nop
cmp word [eax], 0
je 0x4132be
add eax, 2
sub ecx, 1
jne 0x4132b0
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x413316
mov edx, esi
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edi*2]
sub edx, edi
je 0x413309
mov ebx, str.obs_vulkan
mov eax, 0x7ffffffe
sub ebx, ecx
nop dword [eax]
test eax, eax
je 0x413309
movzx edi, word [ebx + ecx]
test di, di
je 0x413309
mov word [ecx], di
dec eax
add ecx, 2
sub edx, 1
jne 0x4132f0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
lea eax, [ebp - 0x20c]
nop
cmp word [eax], 0
je 0x41332e
add eax, 2
sub ecx, 1
jne 0x413320
mov eax, esi
mov edi, ecx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x41338e
cmp byte [ebp - 0x20d], 0
lea ecx, [ebp - 0x20c]
mov ebx, 0x48916c
lea ecx, [ecx + edi*2]
mov eax, 0x489174
mov edx, esi
cmove ebx, eax
sub edx, edi
je 0x413381
mov eax, 0x7ffffffe
sub ebx, ecx
test eax, eax
je 0x413381
movzx edi, word [ebx + ecx]
test di, di
je 0x413381
mov word [ecx], di
dec eax
add ecx, 2
sub edx, 1
jne 0x413368
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
lea eax, [ebp - 0x20c]
cmp word [eax], 0
je 0x4133a4
add eax, 2
sub ecx, 1
jne 0x413396
mov eax, esi
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x4133f6
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + edx*2]
sub esi, edx
je 0x4133e9
mov edi, str..json
mov eax, 0x7ffffffe
sub edi, ecx
nop dword [eax]
test eax, eax
je 0x4133e9
movzx edx, word [edi + ecx]
test dx, dx
je 0x4133e9
mov word [ecx], dx
dec eax
add ecx, 2
sub esi, 1
jne 0x4133d0
test esi, esi
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
push eax
or ebx, 0x20019
mov dword [ebp - 0x220], 4
push ebx
push 0
push str.SOFTWAREKhronosVulkanImplicitLayers
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4134ab
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
mov esi, eax
call edi
test esi, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jne 0x4134b1
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x21c]
or eax, 0x20006
push eax
push 0
push str.SOFTWAREKhronosVulkanImplicitLayers
push 0x80000001
call esi
test eax, eax
jne 0x4134b1
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x214]
call edi
jmp 0x4134b1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x220], 4
push eax
push ebx
push 0
push str.SOFTWAREKhronosVulkanImplicitLayers
push 0x80000002
call esi
test eax, eax
jne 0x413508
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
mov esi, eax
call edi
test esi, esi
je 0x413571
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x214]
push eax
mov eax, dword [ebp - 0x21c]
push 0
or eax, 0x20006
push eax
push 0
push 0
push 0
push str.SOFTWAREKhronosVulkanImplicitLayers
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x413564
push 4
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x413571
push eax
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ae1f
mov esp, ebp
pop ebp
ret