Function at 0x41d4a8
Capabilities:
Get common file path
Get file size
Query or enumerate registry value
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x798
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x798]
push eax
mov edi, SysReAllocStringLen
mov esi, 0x104
push 0x44e220
mov ebx, ecx
push edi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x41d910
lea eax, [ebp - 0x798]
push 0x44e20c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x798]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x41d910
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
lea eax, [ebp - 0x180]
push 0x44e1fc
push eax
call fcn.00423000
pop ecx
test eax, eax
pop ecx
je 0x41d5ae
cmp byte [ebp - 0x180], 0x22
lea ecx, [ebp - 0x180]
jne 0x41d55f
lea ecx, [ebp - 0x17f]
sub eax, ecx
add eax, 0xd
push eax
lea eax, [ebp - 0x388]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x60]
call fcn.0040ea6d
lea eax, [ebp - 0x388]
lea ecx, [ebp - 0x60]
push eax
call fcn.0041f49d
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], 0x447174
mov ecx, eax
mov word [ebx + 0x16], ax
shr ecx, 0x10
mov word [ebx + 0x14], cx
lea ecx, [ebp - 0x60]
call fcn.0040eaca
jmp 0x41d866
lea eax, [ebp - 0x180]
push 0x44e1f0
push eax
call fcn.00423000
pop ecx
test eax, eax
pop ecx
je 0x41d86d
cmp byte [ebp - 0x180], 0x22
lea ecx, [ebp - 0x180]
jne 0x41d5de
lea ecx, [ebp - 0x17f]
sub eax, ecx
add eax, 0xc
push eax
lea eax, [ebp - 0x694]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
or dword [ebp - 8], 0xffffffff
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x388]
push esi
push eax
mov word [ebx + 0x14], 6
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x388]
push 0x44e1e4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 1
lea eax, [ebp - 0x388]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x41d647
mov dword [ebp - 8], eax
xor edi, edi
push edi
push edi
push edi
push 2
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
je 0x41d65f
mov dword [ebp - 0xc], eax
push edi
push edi
push edi
push 4
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
je 0x41d674
mov dword [ebp - 4], eax
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push 0x44e1d8
add edi, dword [ebp - 4]
push edi
mov dword [ebp - 0x10], edi
push dword [ebp - 4]
call fcn.0041d413
add esp, 0xc
test eax, eax
je 0x41d82e
push 0x44e1d0
push edi
push eax
call fcn.0041d413
add esp, 0xc
test eax, eax
je 0x41d82e
push 0x44cd94
push edi
push eax
call fcn.0041d413
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [ebp - 0x18], edx
je 0x41d82e
and byte [ebp - 0x7c], 0
push 0x18
pop ecx
xor eax, eax
lea edi, [ebp - 0x7b]
add edx, 8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x7c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x44e1c8
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.0041d413
mov edx, eax
add esp, 0xc
test edx, edx
je 0x41d82e
and byte [ebp - 0x284], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x283]
add edx, 5
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x284]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x284]
push 0x44e1f0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
and byte [ebp - 0x48c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x48b]
and byte [ebp - 0x590], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x58f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x48c]
push esi
push eax
lea eax, [ebp - 0x694]
push eax
call edi
lea eax, [ebp - 0x590]
push esi
push eax
lea eax, [ebp - 0x284]
push eax
call edi
lea eax, [ebp - 0x590]
push eax
lea eax, [ebp - 0x48c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41d82e
mov cl, byte [ebp - 0x7c]
xor edi, edi
push 1
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x10], edi
pop esi
mov dl, 0x2e
test cl, cl
je 0x41d7d4
cmp cl, dl
je 0x41d7d4
mov cl, byte [eax + 1]
inc eax
jmp 0x41d7c6
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x41d7e0
cmp cl, dl
jne 0x41d7d4
mov cl, byte [eax - 1]
dec eax
cmp cl, dl
je 0x41d7fa
movsx ecx, cl
sub ecx, 0x30
imul ecx, esi
lea esi, [esi + esi*4]
add edi, ecx
shl esi, 1
jmp 0x41d7e0
push 1
dec eax
pop esi
mov cl, byte [eax]
cmp cl, byte [ebp - 0x7c]
je 0x41d819
movsx ecx, cl
sub ecx, 0x30
imul ecx, esi
add dword [ebp - 0x10], ecx
lea esi, [esi + esi*4]
shl esi, 1
dec eax
jmp 0x41d7fe
movsx ax, byte [eax]
sub eax, 0x30
mov word [ebx + 0x16], di
imul eax, esi
add eax, dword [ebp - 0x10]
mov word [ebx + 0x14], ax
cmp dword [ebp - 4], 0
je 0x41d842
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x41d842
push dword [ebp - 4]
call eax
cmp dword [ebp - 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x41d857
test esi, esi
je 0x41d857
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 8], 0xffffffff
je 0x41d866
test esi, esi
je 0x41d866
push dword [ebp - 8]
call esi
xor eax, eax
jmp 0x41d913
lea eax, [ebp - 0x180]
push 0x44e1b8
push eax
call fcn.00423000
pop ecx
test eax, eax
pop ecx
je 0x41d910
cmp byte [ebp - 0x180], 0x22
lea ecx, [ebp - 0x180]
jne 0x41d89d
lea ecx, [ebp - 0x17f]
sub eax, ecx
add eax, 0xd
push eax
lea eax, [ebp - 0x694]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [ebp - 0x60]
call fcn.0040ea6d
lea eax, [ebp - 0x694]
lea ecx, [ebp - 0x60]
push eax
call fcn.0041f49d
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
movzx esi, ax
shr eax, 0x10
push esi
push eax
movzx eax, dx
mov ecx, edx
push eax
shr ecx, 0x10
movzx eax, cx
mov word [ebx + 0x14], cx
mov word [ebx + 0x16], dx
push eax
add ebx, 0x18
push 0x44ce90
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], 0x447174
call fcn.0040eaca
push 1
jmp 0x41d912
push 2
pop eax
pop edi
pop esi
pop ebx
leave
ret