Function at 0x41c1e0
Capabilities:
Authenticate hmac
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x38]
call fcn.004438e0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x34], 0x10000
je 0x41c248
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorW
sub esp, 8
mov esi, eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x41c380
cmp dword [esp + 0x30], 0x12
ja case.0x41c23c.0
mov eax, dword [esp + 0x30]
jmp dword [eax*4 + 0x4461e0]
mov dword [esp + 4], 0
mov dword [esp], 0x15
call fcn.0042fd99
sub esp, 8
mov dword [esp + 4], 0x45a954
mov dword [esp], 0x16
call fcn.0043000b
sub esp, 8
mov dword [esp + 4], 0x45a954
mov dword [esp], 0x17
call fcn.0043000b
sub esp, 8
mov dword [esp + 4], 0x45a954
mov dword [esp], 0x18
call fcn.0043000b
sub esp, 8
mov eax, dword [0x45a7dc]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004046e0
sub esp, 8
mov dword [esp + 4], 0x7f8a
mov dword [esp], 0
call sub.USER32.dll_LoadCursorW
sub esp, 8
mov ebx, eax
cmp dword [esp + 0x30], 9
je 0x41c2f0
cmp dword [esp + 0x30], 0x12
ja case.0x41c2e7.0
mov eax, dword [esp + 0x30]
jmp dword [eax*4 + 0x44622c]
mov dword [esp], 0x19
jmp 0x41c300
mov dword [esp], 0x4c
call fcn.0042fd7d
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xfffffff4
mov dword [esp], eax
call sub.USER32.dll_SetClassLongW
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004394c8
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xfffffff4
mov dword [esp], eax
call sub.USER32.dll_SetClassLongW
sub esp, 0xc
jmp 0x41c44c
mov dword [esp], 0x59
jmp 0x41c300
mov dword [esp], 0xae
jmp 0x41c300
mov dword [esp], 0x2e
jmp 0x41c300
mov dword [esp], 0x6d
jmp 0x41c300
mov dword [esp], 0x77
jmp 0x41c300
test bl, bl
je case.0x41c23c.0
mov dword [esp], 8
call fcn.004300f6
sub esp, 4
mov dword [esp], 1
call fcn.00402e10
sub esp, 4
jmp case.0x41c23c.0
mov dword [esp + 4], 0x452300
mov dword [esp], 0x19
call fcn.0043000b
sub esp, 8
mov dword [esp], 0x19
call fcn.0042fd7d
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0xfffffff4
mov dword [esp], eax
call sub.USER32.dll_SetClassLongW
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.004394c8
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0xfffffff4
mov dword [esp], eax
call sub.USER32.dll_SetClassLongW
sub esp, 0xc
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.USER32.dll_GetCursorPos
sub esp, 4
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.USER32.dll_SetCursorPos
sub esp, 8
mov byte [0x45a915], 0
mov eax, dword [0x45a7dc]
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004046e0
sub esp, 8
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret 0xc
mov dword [esp + 4], 0
mov dword [esp], 0x2f
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0x452300
mov dword [esp], 0x4c
call fcn.0043000b
sub esp, 8
mov dword [esp], 0x4c
call fcn.0042fd7d
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0xfffffff4
mov dword [esp], eax
call sub.USER32.dll_SetClassLongW
sub esp, 0xc
test bl, bl
jne case.0x41c23c.0
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0x36
call fcn.0042ffa3
sub esp, 8
call fcn.00443b50
call fcn.00443ad0
mov dword [esp + 4], eax
mov dword [esp], 0x36
call fcn.0040e4f0
sub esp, 8
call fcn.00443a30
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0x36
call fcn.0042ffa3
sub esp, 8
call fcn.00443ad0
mov dword [esp + 8], str.WIM_files__.wim__.esd__.iso_.wim__.esd__.iso
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0041a1f0
sub esp, 0xc
call fcn.00443a30
jmp case.0x41c23c.0
mov dword [esp + 4], 0
mov dword [esp], 0x4d
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0x452300
mov dword [esp], 0x59
call fcn.0043000b
sub esp, 8
mov dword [esp], 0x59
jmp 0x41c3c2
mov dword [esp + 4], 0
mov dword [esp], 0x8a
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], 0xab
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0x452300
mov dword [esp], 0xae
call fcn.0043000b
sub esp, 8
mov dword [esp], 0xae
jmp 0x41c3c2
mov dword [esp + 4], 0
mov dword [esp], 0x26
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0x452300
mov dword [esp], 0x2e
call fcn.0043000b
sub esp, 8
mov dword [esp], 0x2e
call fcn.0042fd7d
sub esp, 4
mov dword [esp + 8], esi
mov dword [esp + 4], 0xfffffff4
mov dword [esp], eax
call sub.USER32.dll_SetClassLongW
sub esp, 0xc
test bl, bl
jne case.0x41c23c.0
call fcn.00443980
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0x28
call fcn.0042ffa3
sub esp, 8
call fcn.00443b50
call fcn.00443ad0
mov dword [esp + 4], eax
mov dword [esp], 0x28
call fcn.0040e4f0
sub esp, 8
call fcn.00443a30
jmp case.0x41c23c.0
mov dword [esp + 4], 0
mov dword [esp], 0x5a
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0x452300
mov dword [esp], 0x6d
call fcn.0043000b
sub esp, 8
mov dword [esp], 0x6d
jmp 0x41c3c2
mov dword [esp + 4], 0
mov dword [esp], 0x6e
call fcn.004302ef
sub esp, 8
mov dword [esp + 4], 0x452300
mov dword [esp], 0x77
call fcn.0043000b
sub esp, 8
mov dword [esp], 0x77
jmp 0x41c3c2