Function at 0x41e510
Capabilities:
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4b63ef
mov eax, dword fs:[0]
push eax
sub esp, 0x348
mov eax, dword [0x4ff1a0]
xor eax, esp
mov dword [esp + 0x340], eax
push ebx
push esi
push edi
mov eax, dword [0x4ff1a0]
xor eax, esp
push eax
lea eax, [esp + 0x358]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x48], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x360], ebx
xor edi, edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x360], 1
cmp dword [esi + 0x14], 8
jb 0x41e59b
mov eax, dword [esi]
jmp 0x41e59d
mov eax, esi
push 0x20119
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00420780
test eax, eax
jne 0x41e6da
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1c]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x158]
push edx
push eax
push edi
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41e6c3
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x10]
push eax
call fcn.0040f1e0
push eax
lea ecx, [esp + 0x14c]
push ecx
call fcn.004931a1
add esp, 0xc
test eax, eax
jne 0x41e6ba
xor edx, edx
mov esi, 7
lea eax, [esp + 0x144]
mov word [esp + 0xf0], dx
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
lea edx, [eax + 2]
jmp 0x41e640
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41e640
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x148]
push eax
lea ecx, [esp + 0xf8]
call fcn.0040e680
mov byte [esp + 0x360], 2
lea ecx, [esp + 0xf0]
lea edi, [esp + 0x38]
call fcn.00419ee0
mov byte [esp + 0x360], 1
cmp dword [esp + 0x104], 8
jb 0x41e69e
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.00490458
add esp, 4
xor edx, edx
mov dword [esp + 0x104], esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], dx
inc dword [esp + 0x18]
jmp 0x41e5b9
cmp edi, ebx
je 0x41e6d2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
mov edi, dword [esp + 0x38]
mov dword [esp + 0x28], ebx
cmp dword [esi + 0x14], 8
jb 0x41e6e2
mov esi, dword [esi]
mov eax, dword [esp + 0x20]
push 0x20219
push esi
push eax
lea ecx, [esp + 0x30]
call fcn.00420780
test eax, eax
jne 0x41e818
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
push ebx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x158]
push eax
push ecx
push edi
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41e801
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx + 0x10]
push eax
call fcn.0040f1e0
push eax
lea edx, [esp + 0x14c]
push edx
call fcn.004931a1
add esp, 0xc
test eax, eax
jne 0x41e7f8
mov word [esp + 0xf0], ax
mov esi, 7
lea eax, [esp + 0x144]
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41e782
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x148]
push ecx
lea ecx, [esp + 0xf8]
call fcn.0040e680
mov byte [esp + 0x360], 3
lea ecx, [esp + 0xf0]
lea edi, [esp + 0x38]
call fcn.00419ee0
mov byte [esp + 0x360], 1
cmp dword [esp + 0x104], 8
jb 0x41e7e0
mov edx, dword [esp + 0xf0]
push edx
call fcn.00490458
add esp, 4
xor eax, eax
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov word [esp + 0xf0], ax
inc dword [esp + 0x18]
jmp 0x41e702
cmp edi, ebx
je 0x41e810
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
mov edi, dword [esp + 0x38]
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x3c]
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, 1
jne 0x41e83c
push 0xffffffffffffffff
push ebx
push edi
jmp 0x41e85e
jbe 0x41e867
mov ecx, dword [esp + 0x3c]
push esi
push ecx
push edi
call fcn.0041f240
add esp, 0xc
lea edx, [esi*8]
push 0xffffffffffffffff
sub edx, esi
lea eax, [edi + edx*4 - 0x1c]
push ebx
push eax
mov ecx, dword [esp + 0x40]
call fcn.0040f1f0
push 1
cmp esi, ebx
push 2
lea ecx, [esp + 0x5c]
seta byte [esp + 0x1f]
call fcn.00413cc0
mov byte [esp + 0x360], 4
mov eax, 0x4c5170
cmp byte [esp + 0x17], bl
jne 0x41e893
mov eax, str.FAILED.
push 1
push ecx
mov edx, dword [esp + 0x38]
push str.._b32_64Bit:
push ecx
mov ecx, dword [esp + 0x44]
push ecx
push ecx
push str.._strValue:
push ecx
push edx
push ecx
push str.._strFilter:
push ecx
mov ecx, dword [esp + 0x78]
push ecx
push ecx
push str._strSubKey:
push ecx
push eax
push ecx
lea edx, [esp + 0x9c]
push str.EnumLargestKey
push edx
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
push eax
call fcn.00416df0
add esp, 0xc
push eax
call fcn.00416b90
add esp, 0xc
mov ecx, eax
call fcn.0041edd0
push 0x1b
mov esi, 0xf
push str.CRegUtility::EnumLargestKey
lea ecx, [esp + 0x114]
mov dword [esp + 0x128], esi
mov dword [esp + 0x124], ebx
mov byte [esp + 0x114], bl
call fcn.0040ebe0
mov byte [esp + 0x360], 5
push 0xe
push str.RegUtility.cpp
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.0040ebe0
mov byte [esp + 0x360], 6
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x58]
call fcn.00413de0
mov byte [esp + 0x360], 7
push eax
lea ecx, [esp + 0x110]
push ecx
push 0x150
lea edx, [esp + 0xfc]
push edx
push 3
call fcn.004144e0
mov ecx, eax
call fcn.0042e360
mov byte [esp + 0x360], 6
cmp dword [esp + 0x13c], 8
jb 0x41e9ea
mov eax, dword [esp + 0x128]
push eax
call fcn.00490458
add esp, 4
xor ecx, ecx
mov dword [esp + 0x13c], 7
mov dword [esp + 0x138], ebx
mov word [esp + 0x128], cx
mov byte [esp + 0x360], 5
cmp dword [esp + 0x104], 0x10
jb 0x41ea28
mov edx, dword [esp + 0xf0]
push edx
call fcn.00490458
add esp, 4
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov byte [esp + 0xf0], bl
mov byte [esp + 0x360], 4
cmp dword [esp + 0x120], 0x10
jb 0x41ea5f
mov eax, dword [esp + 0x10c]
push eax
call fcn.00490458
add esp, 4
mov dword [esp + 0x120], esi
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], bl
mov byte [esp + 0x360], 1
mov edx, dword [esp + 0x54]
mov eax, dword [edx + 4]
lea ecx, [esp + 0xa4]
mov dword [esp + 0x20], ecx
mov dword [esp + eax + 0x54], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov byte [esp + 0x360], 8
lea ecx, [esp + 0x58]
call fcn.00413e40
mov byte [esp + 0x360], 1
mov ecx, dword [esp + 0x54]
mov edx, dword [ecx + 4]
lea eax, [esp + 0xa4]
mov dword [esp + edx + 0x54], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [esp + 0x20], eax
mov dword [esp + 0xa4], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [esp + 0x360], 1
mov ecx, eax
push ecx
mov dword [esp + 0xa8], vtable.std::ios_base.0
call fcn.0048fc10
add esp, 4
mov byte [esp + 0x360], bl
cmp edi, ebx
je 0x41eb1b
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x48]
push eax
push ecx
push edi
call fcn.0041ace0
push edi
call fcn.00490458
add esp, 0x14
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x360], 0xffffffff
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x41eb45
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
mov al, byte [esp + 0x17]
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x358]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x340]
xor ecx, esp
call fcn.004911d1
mov esp, ebp
pop ebp
ret