Function at 0x41f368
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1bc
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1bc], 0x80
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a0], 0x114
xor ebx, ebx
inc edi
push eax
mov dword [ebp - 0x1b4], ebx
mov dword [ebp - 0x1b8], edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x41f3bd
xor edx, edx
jmp 0x41f6a5
mov esi, dword [ebp - 0x19c]
xor eax, eax
shld eax, esi, 0x10
lea eax, [ebp - 0x1b4]
shl esi, 0x10
or esi, dword [ebp - 0x198]
cmp dword [ebp - 0x190], 2
push eax
push edi
push ebx
jne 0x41f45b
push 0x404430
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f6a1
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1b8]
push eax
push ebx
push 0x40448c
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f695
cmp dword [ebp - 0x1b8], edi
jne 0x41f695
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
mov ecx, 0x10000
mov dword [ebp - 0x1bc], eax
mul ecx
add ebx, eax
adc esi, edx
jmp 0x41f695
push 0x4044b8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41f6a1
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x1b8]
push eax
push ebx
push 0x40450c
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f695
cmp dword [ebp - 0x1b8], edi
jne 0x41f695
mov dword [ebp - 0x1a4], ebx
lea eax, [ebp - 0x88]
mov dword [ebp - 0x1a8], ebx
mov esi, ebx
mov dword [ebp - 0x1b0], ebx
mov dword [ebp - 0x1ac], ebx
jmp 0x41f4d4
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x41f4d0
mov eax, esi
sub eax, 1
je 0x41f60b
sub eax, 1
je 0x41f5df
sub eax, 1
je 0x41f5ac
lea eax, [ebp - 0x88]
test esi, esi
je 0x41f521
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x1b0], eax
jmp 0x41f62e
inc esi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x41f51d
sub esi, 1
je 0x41f597
sub esi, 1
je 0x41f57b
sub esi, 1
je 0x41f558
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x1a4], eax
jmp 0x41f62e
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404350
jmp 0x41f5cd
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404370
jmp 0x41f5f9
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404388
jmp 0x41f61e
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404308
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x41f62e
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404328
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x41f62e
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x404340
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [ebp - 0x1a8]
mov edi, dword [ebp - 0x1ac]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x1b0]
shl eax, 0x10
mov esi, ecx
add edi, eax
shr esi, 0x10
xor eax, eax
shld eax, esi, 0x10
mov dword [ebp - 0x1ac], eax
shl esi, 0x10
movzx eax, cx
mov ecx, dword [ebp - 0x1ac]
cdq
or esi, eax
or ecx, edx
shld ecx, esi, 0x10
mov eax, edi
shl esi, 0x10
or ecx, ebx
shr eax, 0x10
or esi, eax
movzx eax, di
mov ebx, esi
cdq
mov esi, ecx
shld esi, ebx, 0x10
shl ebx, 0x10
or ebx, eax
or esi, edx
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov edx, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret