Function at 0x41c760
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4521f5
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x46b664]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x58], edx
mov edx, 0x80
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
call fcn.00418280
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
mov eax, esi
sub eax, ecx
add eax, 0x80
je 0x41c7d1
push eax
push edi
push ecx
call fcn.004397f0
add esp, 0xc
lea ebx, [esi + 0x80]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push esi
lea ecx, [ebp - 0x70]
mov edi, ebx
push ecx
sub edi, esi
push 0
mov dword [ebp - 0x5c], edi
call fcn.00401500
mov edx, dword [ebp - 0x74]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x54], eax
cmp eax, 0xea
jne 0x41c8cf
lea ecx, [edi + edi]
mov dword [ebp - 0x54], ecx
cmp edi, ecx
jbe 0x41c835
lea edi, [esi + ecx]
cmp edi, ebx
je 0x41c89c
push 0
push ebx
push edi
call fcn.00432040
add esp, 0xc
mov ebx, edi
jmp 0x41c899
jae 0x41c89c
mov eax, esi
sub eax, ebx
add eax, ecx
or edx, 0xffffffff
sub edx, eax
cmp edx, edi
jb 0x41c965
add edi, eax
mov eax, dword [ebp - 0x64]
sub eax, esi
cmp edi, eax
jbe 0x41c87f
mov ecx, eax
shr ecx, 1
or edx, 0xffffffff
sub edx, ecx
cmp edx, eax
jae 0x41c866
xor eax, eax
jmp 0x41c868
add eax, ecx
cmp eax, edi
cmovb eax, edi
push eax
lea ecx, [ebp - 0x6c]
call fcn.00418400
mov ebx, dword [ebp - 0x68]
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x54]
mov eax, esi
sub eax, ebx
add eax, ecx
je 0x41c896
push eax
push 0
push ebx
call fcn.004397f0
mov ecx, dword [ebp - 0x54]
add esp, 0xc
lea ebx, [esi + ecx]
mov dword [ebp - 0x68], ebx
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
push esi
lea ecx, [ebp - 0x70]
mov edi, ebx
push ecx
sub edi, esi
push 0
mov dword [ebp - 0x5c], edi
call fcn.00401500
mov edx, dword [ebp - 0x74]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x54], eax
cmp eax, 0xea
je 0x41c814
xor ebx, ebx
cmp eax, ebx
jne 0x41c96f
mov eax, dword [ebp - 0x5c]
lea esi, [ebp - 0x6c]
call fcn.004181a0
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0x70]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [esi + 0x1c]
push edx
call fcn.0041cae0
mov byte [ebp - 4], 5
mov dword [esi + 0x2c], edi
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
push ebx
push eax
or eax, 0xffffffff
mov ecx, esi
mov dword [ebp - 0x7c], 1
call fcn.00401a90
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x6c]
cmp eax, ebx
je 0x41c93e
push eax
call fcn.00431dda
add esp, 4
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00431de5
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.0042fac0
xor ecx, ecx
mov edi, 7
push 0x23
mov eax, str.WinAPI::regQueryValueEx_failed_for
lea esi, [ebp - 0x50]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], ebx
mov word [ebp - 0x50], cx
call fcn.0040eba0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x58]
push 0xffffffffffffffff
push ebx
push edx
call fcn.004104f0
mov ecx, dword [ebp - 0x54]
push ebx
mov dword [ebp - 0x34], ecx
xor edx, edx
push eax
or eax, 0xffffffff
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
call fcn.00401a90
mov byte [ebp - 4], 2
push 0x462084
lea eax, [ebp - 0x34]
push eax
call fcn.00436362
int3