Function at 0x41e0dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x5b0]
sub esp, 0x630
mov eax, dword [0x498b28]
xor eax, ebp
mov dword [ebp + 0x5ac], eax
push ebx
push esi
mov esi, dword [ebp + 0x5b8]
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp + 0x3a6]
push ebx
push eax
mov word [ebp + 0x3a4], bx
call fcn.00436a20
mov al, byte [esi]
add esp, 0xc
push dword [esi + 1]
mov byte [ebp - 0x6d], al
push ebx
push 0x400
call dword [0x467158]
mov edi, eax
cmp edi, ebx
jne 0x41e151
call dword [0x467358]
push eax
push str.PrepareReport___couldnt_get_callers_process_handle_to_find_tmp_folder:__x_n
call fcn.0041b266
pop ecx
pop ecx
jmp 0x41e3b2
lea eax, [ebp - 0x78]
push eax
push 8
push edi
call dword [0x467094]
test eax, eax
je 0x41e398
push 0x104
lea eax, [ebp + 0x3a4]
push eax
push str._TMP_
push dword [ebp - 0x78]
call dword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserW]
push dword [ebp - 0x78]
mov esi, dword [0x467350]
call esi
push edi
call esi
lea eax, [ebp + 0x3a4]
push eax
call fcn.0043ada3
cmp word [ebp + eax*2 + 0x3a2], 0x5c
pop ecx
je 0x41e1b9
lea eax, [ebp + 0x3a4]
push 0x46feb0
push eax
call fcn.0043ad2b
pop ecx
pop ecx
lea eax, [ebp + 0x3a4]
push str.BtwReportFiles_
push eax
call fcn.0043ad2b
lea eax, [ebp + 0x3a4]
push eax
call fcn.0043ada3
push ebx
mov edi, eax
call fcn.0042f4e7
call fcn.0042f375
mov esi, eax
call fcn.0042f346
push eax
lea eax, [ebp + 0x3a4]
push eax
call fcn.0043ad2b
add esp, 0x18
push ebx
lea eax, [ebp + 0x3a4]
push eax
push esi
call dword [0x467190]
test eax, eax
jne 0x41e220
call dword [0x467358]
push eax
push str.RepareReport____.etl_log_file_copy_failed:__x_n
call fcn.0041b266
pop ecx
pop ecx
lea eax, [ebp + edi*2 + 0x3a4]
mov dword [ebp - 0x80], eax
mov word [eax], bx
lea eax, [ebp + 0x3a4]
push eax
push esi
call fcn.0043ad55
push esi
call fcn.0043ada3
mov edi, str.btwinlog.txt
push edi
push esi
mov word [esi + eax*2 - 0x1e], bx
call fcn.0043ad2b
push esi
call fcn.0041aad4
lea eax, [ebp + 0x3a4]
push edi
push eax
call fcn.0043ad2b
mov edi, dword [0x467190]
add esp, 0x20
push ebx
lea eax, [ebp + 0x3a4]
push eax
push esi
call edi
test eax, eax
jne 0x41e28f
call dword [0x467358]
push eax
push str.RepareReport____BTW_install_log_file_copy_failed:__x_n
call fcn.0041b266
pop ecx
pop ecx
cmp byte [ebp - 0x6d], bl
je 0x41e3b2
lea eax, [ebp - 0x74]
push eax
push 1
push ebx
push str.SYSTEMCurrentControlSetControlCrashControl
push reloc.WS2_32.dll_bind
mov word [esi], bx
call dword [0x46700c]
test eax, eax
jne 0x41e35a
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x19c]
push eax
push ebx
push ebx
push str.MinidumpDir
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x104
call dword [0x467040]
test eax, eax
jne 0x41e351
push 0x104
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x19c]
push eax
call dword [0x46718c]
push ebx
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x6c]
push eax
mov word [ebp + 0x19c], bx
call fcn.0041ab50
add esp, 0xc
cmp word [ebp + 0x19c], bx
je 0x41e351
lea eax, [ebp - 0x6c]
push eax
push esi
call fcn.0043ad55
push esi
call fcn.0043ada3
add esp, 0xc
cmp word [esi + eax*2 - 2], 0x5c
je 0x41e342
push 0x46feb0
push esi
call fcn.0043ad2b
pop ecx
pop ecx
lea eax, [ebp + 0x19c]
push eax
push esi
call fcn.0043ad2b
pop ecx
pop ecx
push dword [ebp - 0x74]
call dword [0x467004]
cmp word [esi], bx
je 0x41e3b2
mov eax, dword [ebp - 0x80]
mov word [eax], bx
lea eax, [ebp + 0x3a4]
push str.Minidump.dmp
push eax
call fcn.0043ad2b
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x3a4]
push eax
push esi
call edi
test eax, eax
jne 0x41e3b2
call dword [0x467358]
push eax
push str.RepareReport____mini_dump_file_copy_failed:__x_n
jmp 0x41e145
call dword [0x467358]
push eax
push str.PrepareReport___couldnt_get_callers_process_token_to_find_tmp_folder:__x_n
call fcn.0041b266
pop ecx
pop ecx
push edi
call dword [0x467350]
mov ecx, dword [ebp + 0x5ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
add ebp, 0x5b0
leave
ret