Function at 0x41f5df
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1b4], 0x80
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a0], 0x114
xor edi, edi
inc esi
push eax
mov dword [ebp - 0x1b0], edi
mov dword [ebp - 0x1b8], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41f634
xor edx, edx
jmp 0x41f918
mov ebx, dword [ebp - 0x19c]
xor eax, eax
shld eax, ebx, 0x10
lea eax, [ebp - 0x1b0]
shl ebx, 0x10
or ebx, dword [ebp - 0x198]
cmp dword [ebp - 0x190], 2
push eax
push esi
push edi
jne 0x41f6d2
push 0x404420
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f914
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1b8]
push eax
push edi
push 0x40447c
push dword [ebp - 0x1b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f908
cmp dword [ebp - 0x1b8], esi
jne 0x41f908
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov ecx, 0x10000
mov dword [ebp - 0x1b4], eax
mul ecx
add edi, eax
adc ebx, edx
jmp 0x41f908
push 0x4044a8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f914
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], 0x80
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1b8]
push eax
push edi
push 0x4044fc
push dword [ebp - 0x1b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f908
cmp dword [ebp - 0x1b8], esi
jne 0x41f908
mov dword [ebp - 0x1a4], edi
lea eax, [ebp - 0x88]
mov dword [ebp - 0x1a8], edi
mov dword [ebp - 0x1ac], edi
mov dword [ebp - 0x1bc], edi
jmp 0x41f753
inc edi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x41f74f
mov eax, edi
sub eax, 1
je 0x41f88a
sub eax, 1
je 0x41f85e
sub eax, 1
je 0x41f82b
lea eax, [ebp - 0x88]
test edi, edi
je 0x41f7a0
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x1ac], eax
jmp 0x41f8ad
inc edi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x41f79c
sub edi, 1
je 0x41f816
sub edi, 1
je 0x41f7fa
sub edi, 1
je 0x41f7d7
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x1a4], eax
jmp 0x41f8ad
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404340
jmp 0x41f84c
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404360
jmp 0x41f878
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404378
jmp 0x41f89d
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x4042f8
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x41f8ad
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404318
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x41f8ad
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404330
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a8]
mov esi, dword [ebp - 0x1bc]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x1ac]
shl eax, 0x10
add esi, eax
mov eax, ecx
shr eax, 0x10
cdq
mov edi, eax
mov ebx, edx
shld ebx, edi, 0x10
movzx eax, cx
shl edi, 0x10
cdq
or edi, eax
or ebx, edx
shld ebx, edi, 0x10
mov eax, esi
shr eax, 0x10
shl edi, 0x10
cdq
or edi, eax
or ebx, edx
shld ebx, edi, 0x10
movzx eax, si
shl edi, 0x10
cdq
or edi, eax
or ebx, edx
push dword [ebp - 0x1b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov edx, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret