Function at 0x41e330
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x551a5c
mov eax, dword fs:[0]
push eax
mov eax, 0x1498
call fcn.0051a260
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x1494], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x14ac]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14c0]
mov ecx, dword [esp + 0x14c4]
mov edx, dword [esp + 0x14d0]
mov esi, dword [esp + 0x14bc]
mov ebp, dword [esp + 0x14c8]
mov edi, dword [esp + 0x14cc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14d8]
push 0xffffffffffffffff
mov dword [esp + 0x20], ecx
push 0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edx
mov dword [esp + 0x5c], eax
mov byte [esp + 0x23], 1
call fcn.0049eff0
mov dword [esp + 0x44], vtable.cWCStr.0
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x14b4], 0
jne 0x41e42f
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.00457fd0
add esp, 0x10
test al, al
jne 0x41e423
lea ecx, [esp + 0x44]
mov dword [esp + 0x14b4], 0xffffffff
mov dword [esp + 0x44], vtable.cWCS.0
call fcn.0049ee80
xor eax, eax
jmp 0x41e54a
cmp dword [esp + 0x1c], 0
je 0x41e42f
mov byte [esp + 0x1b], 0
mov edx, dword [esp + 0x14]
push edx
call fcn.00428c50
mov ebx, dword [esp + 0x14d8]
add esp, 4
test al, al
je 0x41e4a7
test bl, bl
jne 0x41e4a7
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push eax
push edi
push ebp
push ecx
push esi
lea ecx, [esp + 0x94]
call fcn.0041c6b0
mov edx, dword [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x88]
call fcn.00428ef0
mov esi, eax
mov dword [esp + 0x14b4], 0xffffffff
mov dword [esp + 0x44], vtable.cWCS.0
lea ecx, [esp + 0x44]
test esi, esi
jl 0x41e49b
mov esi, dword [esp + 0x9c]
call fcn.0049ee80
mov eax, esi
jmp 0x41e54a
cmp byte [esp + 0x1b], 0
mov eax, 1
je 0x41e4b8
mov eax, 9
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x58]
push ecx
push eax
push 0
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e52b
mov eax, dword [esp + 0x58]
or ecx, 0xffffffff
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], ecx
lea ecx, [esp + 0x78]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
push 0
lea ecx, [esp + 0x8c]
push ecx
push 0
push 0
push 0
push eax
mov byte [esp + 0x14e4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x41e572
mov eax, dword [esp + 0x60]
test eax, eax
je 0x41e52b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], vtable.cWCS.0
lea ecx, [esp + 0x44]
mov dword [esp + 0x14b4], 0xffffffff
call fcn.0049ee80
or eax, 0xffffffff
mov ecx, dword [esp + 0x14ac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1494]
xor ecx, esp
call fcn.0051916c
add esp, 0x14a4
ret
cmp dword [esp + 0x1c], 0
jne 0x41e735
cmp dword [esp + 0x54], 0
jne 0x41e5b5
test ebp, ebp
jne 0x41e5b5
mov esi, dword [esp + 0x6c]
lea ecx, [esp + 0x60]
call fcn.0040ca90
lea ecx, [esp + 0x44]
mov dword [esp + 0x14b4], 0xffffffff
mov dword [esp + 0x44], vtable.cWCS.0
call fcn.0049ee80
mov eax, esi
jmp 0x41e54a
lea ecx, [esp + 0x60]
call fcn.0040ca60
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
push 0
push ebx
push edx
push edi
push ebp
push str.LastFile
push eax
push esi
call fcn.0041e330
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x34]
push 0
push ebx
push ecx
push edi
push ebp
push str.File
push edx
push esi
mov dword [esp + 0x60], eax
call fcn.0041e330
mov ecx, dword [esp + 0x54]
add esp, 0x40
push 0
push ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
push eax
push edi
push ebp
push str.Project
push ecx
push esi
call fcn.0041e330
mov edx, dword [esp + 0x48]
push 0
push ebx
push edx
push edi
push ebp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x48]
push 0x56f1d8
push eax
push esi
call fcn.0041e330
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x54]
add esp, 0x40
push 0
push ebx
push ecx
push edi
push ebp
push str.filemenu
push edx
push esi
mov dword [esp + 0x60], eax
call fcn.0041e330
mov ecx, dword [esp + 0x34]
push 0
push ebx
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x50]
push eax
push edi
push ebp
push 0x56ba1c
push ecx
push esi
call fcn.0041e330
or ebx, 0xffffffff
add esp, 0x40
cmp dword [esp + 0x20], ebx
jne 0x41e6ea
cmp dword [esp + 0x24], ebx
jne 0x41e6e2
cmp dword [esp + 0x2c], ebx
jne 0x41e6e2
cmp dword [esp + 0x54], ebx
jne 0x41e6e2
cmp dword [esp + 0x40], ebx
jne 0x41e6e2
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
push 0
push 0
push edx
push edi
push ebp
push 0x56ba1c
push eax
push esi
call fcn.0041e330
add esp, 0x20
cmp eax, ebx
jne 0x41e6e2
lea ecx, [esp + 0x60]
call fcn.0040ca90
lea ecx, [esp + 0x44]
mov dword [esp + 0x14b4], ebx
mov dword [esp + 0x44], vtable.cWCS.0
call fcn.0049ee80
mov eax, ebx
jmp 0x41e54a
mov dword [esp + 0x20], 0
cmp dword [esp + 0x24], ebx
jne 0x41e6f8
mov dword [esp + 0x24], 0
cmp dword [esp + 0x2c], ebx
jne 0x41e706
mov dword [esp + 0x2c], 0
mov ecx, dword [esp + 0x40]
cmp ecx, ebx
jne 0x41e710
xor ecx, ecx
mov esi, dword [esp + 0x54]
cmp esi, ebx
jne 0x41e71a
xor esi, esi
cmp eax, ebx
jne 0x41e720
xor eax, eax
add esi, ecx
add esi, dword [esp + 0x2c]
add esi, dword [esp + 0x24]
add esi, dword [esp + 0x20]
add esi, eax
jmp 0x41e58c
cmp byte [esp + 0x1b], 0
mov dword [esp + 0x24], 0
je 0x41e86a
cmp dword [esp + 0x70], 0
je 0x41e86a
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0xb2]
push edx
xor esi, esi
mov word [esp + 0xb4], cx
call fcn.00519500
mov edx, dword [esp + 0x64]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xbc]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x400
call ebx
test eax, eax
jne 0x41e86a
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x38]
call fcn.0049eff0
mov dword [esp + 0x30], vtable.cWCStr.0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xa8]
push eax
push ecx
lea edx, [esp + 0x38]
push 0x56be54
push edx
mov byte [esp + 0x14c4], 2
call fcn.00401080
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x44]
push 0
push 1
push eax
mov eax, dword [esp + 0x78]
push edi
push ebp
push ecx
push edx
push eax
call fcn.0041e330
add dword [esp + 0x54], eax
add esp, 0x30
lea ecx, [esp + 0x30]
mov byte [esp + 0x14b4], 1
mov dword [esp + 0x30], vtable.cWCS.0
call fcn.0049ee80
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0xb2]
push edx
inc esi
mov word [esp + 0xb4], cx
call fcn.00519500
mov edx, dword [esp + 0x64]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xbc]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x400
call ebx
test eax, eax
je 0x41e7a4
mov dword [esp + 0x40], 0
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0xb2]
push ecx
mov esi, 0x400
mov word [esp + 0xb4], ax
call fcn.00519500
add esp, 0xc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x8ac]
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x4c]
push 0
lea edx, [esp + 0x84]
push edx
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0xbc]
push eax
push ecx
push edx
mov dword [esp + 0x94], esi
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test ebx, ebx
je 0x41e8f8
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x5b07f4]
jne 0x41eb44
cmp ebx, 0xea
jne 0x41eb44
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x38]
call fcn.0049eff0
mov dword [esp + 0x30], vtable.cWCStr.0
mov esi, dword [esp + 0x1c]
mov byte [esp + 0x14b4], 3
cmp esi, dword [0x5b07f4]
jne 0x41e95c
cmp dword [esp + 0x2c], 3
lea ecx, [esp + 0x30]
jne 0x41ebaa
push 0x200
call fcn.0049f100
test eax, eax
je 0x41ebc8
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0xa8]
push ecx
push edx
call fcn.0041c660
add esp, 8
jmp 0x41ea85
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41e961
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [esp + 0x2c]
cmp eax, 3
jne 0x41e989
push 0xffffffffffffffff
lea eax, [esp + 0xac]
jmp 0x41ea20
cmp eax, 4
jne 0x41e9b6
test ecx, ecx
jne 0x41e9b6
mov ecx, dword [esp + 0x8a8]
push ecx
lea edx, [esp + 0xac]
push edx
lea eax, [esp + 0x38]
push str._s__X
push eax
call fcn.00401080
add esp, 0x10
jmp 0x41ea2a
call fcn.0041c710
mov dl, al
test dl, dl
je 0x41eba6
test ecx, ecx
jne 0x41e9f0
mov eax, dword [esp + 0x20]
shr eax, 1
push eax
lea eax, [esp + 0x8ac]
push eax
call fcn.0041c720
add esp, 8
test al, al
je 0x41e9f0
push 0xffffffffffffffff
lea ecx, [esp + 0xac]
push ecx
jmp 0x41ea21
test dl, dl
je 0x41eba6
push ecx
lea edx, [esp + 0xac]
push edx
push esi
call fcn.0051a35a
add esp, 0xc
test eax, eax
jne 0x41eba6
mov eax, dword [esp + 0x20]
shr eax, 1
push eax
lea eax, [esp + 0x8ac]
push eax
lea ecx, [esp + 0x38]
call fcn.00406a80
push 5
lea ecx, [esp + 0xac]
push 0x56d9ec
push ecx
call fcn.0051a4ff
add esp, 0xc
test eax, eax
jne 0x41ea85
push eax
lea ecx, [esp + 0x34]
call fcn.0049ead0
cmp ax, 0x5b
jne 0x41ea85
mov edx, dword [esp + 0x34]
movzx eax, word [edx]
mov ecx, edx
test ax, ax
je 0x41ea89
movzx eax, ax
add ecx, 2
cmp ax, 0x2a
je 0x41ea79
movzx eax, word [ecx]
test ax, ax
jne 0x41ea66
jmp 0x41ea89
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x38]
call fcn.00406a80
mov edx, dword [esp + 0x34]
cmp ebp, 1
jne 0x41eaef
push 0xffffffffffffffff
push edi
push edx
call fcn.0049ea40
add esp, 0xc
test eax, eax
jne 0x41eba2
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x5b07f4]
je 0x41ebfa
push eax
push 0x56f1b0
lea ecx, [esp + 0xcb0]
push 0x400
push ecx
call fcn.004a3180
mov ecx, dword [esp + 0x68]
push 0
push 0
lea edx, [esp + 0x44]
push edx
push 0
lea eax, [esp + 0xcc8]
push eax
push ecx
call fcn.004b42b0
add esp, 0x28
jmp 0x41ebff
mov eax, dword [esp + 0x54]
test eax, eax
je 0x41eb84
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x8ac]
push ecx
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0xb8]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
push edx
push edi
call eax
add esp, 0x20
cmp eax, 0xffffffff
jne 0x41eba2
lea ecx, [esp + 0x30]
mov byte [esp + 0x14b4], 1
mov dword [esp + 0x30], vtable.cWCS.0
call fcn.0049ee80
mov eax, dword [esp + 0x60]
test eax, eax
je 0x41eb53
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0x103
jne 0x41e52b
lea ecx, [esp + 0x44]
mov dword [esp + 0x14b4], 0xffffffff
mov dword [esp + 0x44], vtable.cWCS.0
call fcn.0049ee80
mov eax, dword [esp + 0x24]
jmp 0x41e54a
test ebp, ebp
je 0x41eba2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push eax
mov eax, dword [esp + 0x20]
push ecx
push eax
push edx
push edi
call ebp
add esp, 0x1c
inc dword [esp + 0x24]
lea ecx, [esp + 0x30]
mov byte [esp + 0x14b4], 1
mov dword [esp + 0x30], vtable.cWCS.0
call fcn.0049ee80
inc dword [esp + 0x40]
jmp 0x41e872
mov esi, vtable.cWCS.0
lea ecx, [esp + 0x30]
mov byte [esp + 0x14b4], 1
mov dword [esp + 0x30], esi
call fcn.0049ee80
mov eax, dword [esp + 0x60]
test eax, eax
je 0x41ebf1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x44], esi
jmp 0x41e533
mov eax, 2
test eax, eax
mov eax, dword [esp + 0x60]
sete bl
mov dword [esp + 0x64], 0
test eax, eax
je 0x41ec1f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x64], eax
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x5c]
push esi
lea edx, [esp + 0xac]
push edx
push eax
push ebp
mov dword [esp + 0x70], 0
call fcn.0041dc90
add esp, 0x10
mov byte [esp + 0x5c], al
test esi, esi
je 0x41ec75
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004b21b0
push eax
mov eax, dword [esp + 0x1c]
push edi
lea edx, [esp + 0xb4]
push edx
push eax
push str.Path:__s:_s_tText:__s_tStatus:__s
push esi
call fcn.0042f3c0
add esp, 0x1c
mov eax, dword [esp + 0x1c]
cmp eax, dword [0x5b07f4]
je 0x41ecb9
mov edx, dword [esp + 0x14]
xor ecx, ecx
test bl, bl
sete cl
push ecx
push eax
push edx
push ebp
call fcn.0041e0f0
add esp, 0x10
test esi, esi
je 0x41ecb9
cmp eax, 0xffffffff
jne 0x41ecb9
mov eax, dword [esp + 0x14]
push eax
push str.CompactRegistryValues
push 0xdf
push esi
call fcn.0042f2c0
add esp, 0x10
mov esi, vtable.cWCS.0
lea ecx, [esp + 0x30]
mov byte [esp + 0x14b4], 1
mov dword [esp + 0x30], esi
call fcn.0049ee80
lea ecx, [esp + 0x44]
mov dword [esp + 0x14b4], 0xffffffff
mov dword [esp + 0x44], esi
call fcn.0049ee80
mov eax, dword [esp + 0x24]
jmp 0x41e54a