Function at 0x41ccc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452ad5
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x46c664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x58], edx
mov edx, 0x80
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
call fcn.004181c0
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
mov eax, esi
sub eax, ecx
add eax, 0x80
je 0x41cd31
push eax
push edi
push ecx
call fcn.0043a080
add esp, 0xc
lea ebx, [esi + 0x80]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push esi
lea ecx, [ebp - 0x70]
mov edi, ebx
push ecx
sub edi, esi
push 0
mov dword [ebp - 0x5c], edi
call fcn.00401a80
mov edx, dword [ebp - 0x74]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x54], eax
cmp eax, 0xea
jne 0x41ce2f
lea ecx, [edi + edi]
mov dword [ebp - 0x54], ecx
cmp edi, ecx
jbe 0x41cd95
lea edi, [esi + ecx]
cmp edi, ebx
je 0x41cdfc
push 0
push ebx
push edi
call fcn.004328d0
add esp, 0xc
mov ebx, edi
jmp 0x41cdf9
jae 0x41cdfc
mov eax, esi
sub eax, ebx
add eax, ecx
or edx, 0xffffffff
sub edx, eax
cmp edx, edi
jb 0x41cec5
add edi, eax
mov eax, dword [ebp - 0x64]
sub eax, esi
cmp edi, eax
jbe 0x41cddf
mov ecx, eax
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
cmp edx, eax
jae 0x41cdc6
xor eax, eax
jmp 0x41cdc8
add eax, ecx
cmp eax, edi
cmovb eax, edi
push eax
lea ecx, [ebp - 0x6c]
call fcn.00418340
mov ebx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x54]
mov eax, esi
sub eax, ebx
add eax, ecx
je 0x41cdf6
push eax
push 0
push ebx
call fcn.0043a080
mov ecx, dword [ebp - 0x54]
add esp, 0xc
lea ebx, [esi + ecx]
mov dword [ebp - 0x68], ebx
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push esi
lea ecx, [ebp - 0x70]
mov edi, ebx
push ecx
sub edi, esi
push 0
mov dword [ebp - 0x5c], edi
call fcn.00401a80
mov edx, dword [ebp - 0x74]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x54], eax
cmp eax, 0xea
je 0x41cd74
xor ebx, ebx
cmp eax, ebx
jne 0x41cecf
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x6c]
call fcn.004180e0
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x70]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [esi + 0x1c]
push edx
call fcn.0041d040
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], edi
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
push ebx
push eax
or eax, 0xffffffff
mov ecx, esi
mov dword [ebp - 0x7c], 1
call fcn.00401a90
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
je 0x41ce9e
push eax
call fcn.0043266a
add esp, 4
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00432675
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.00430350
xor ecx, ecx
mov edi, 7
push 0x23
mov eax, str.WinAPI::regQueryValueEx_failed_for
lea esi, [ebp - 0x50]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x50], cx
call fcn.0040e990
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x58]
push 0xffffffffffffffff
push ebx
push edx
call fcn.004102e0
mov ecx, dword [ebp - 0x54]
push ebx
mov dword [ebp - 0x34], ecx
xor edx, edx
push eax
or eax, 0xffffffff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
call fcn.00401a90
mov byte [ebp - 4], 2
push 0x4630f4
lea eax, [ebp - 0x34]
push eax
call fcn.00436bf2
int3