Function at 0xa41a30
Capabilities:
Query or enumerate registry value
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 8], 0
mov eax, ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 4], eax
mov edi, 0xffff00ff
jne 0xa41aa9
cmp dword [ebp + 0xc], 1
jne 0xb18c7c
xor eax, eax
mov dword [0xc958d4], 2
push eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
push 0xc
push 0x42
mov dword [ebp - 0x34], 0xc
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_SystemParametersInfoW]
test eax, eax
je 0xa41a99
test byte [ebp - 0x30], 1
jne 0xb18c8e
mov eax, 2
mov ecx, 0xc958d4
xchg dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [0xc958d4], 1
je 0xb18c98
cmp esi, 0xd1
ja 0xa41ad1
lea eax, [esi + esi*2]
mov cl, 1
lea edx, [eax*4 + 0xc94398]
xor ebx, ebx
nop
test cl, cl
je 0xa41ace
mov eax, dword [edx]
test al, 0x40
jne 0xb18cc8
mov eax, dword [ebp - 4]
cmp esi, 2
jne 0xa41b96
mov edi, 0xc960e4
cmp dword [0xc96f7c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
jne 0xb18d85
mov eax, dword [0xc95888]
mov dword [ebp - 0x18], eax
mov eax, dword [0xc9588c]
mov dword [ebp - 0x14], eax
cmp byte [0xc958cd], 0
je 0xb18db0
cmp dword [0xc97ae0], 0
mov ecx, dword [0xc958d0]
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x14], eax
jne 0xb18f07
cmp eax, dword [0xc940d8]
jne 0xa41c34
mov cl, 1
mov dword [0xc940d8], eax
lea eax, [ebp - 0x28]
push eax
push 1
mov byte [0xc958d8], cl
mov dword [ebp - 0x28], 0
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenCurrentUser]
cmp byte [0xc958d8], 0
mov dword [ebp - 0x24], 1
je 0xa41c3b
mov eax, dword [ebp - 0x28]
mov edi, dword [edi]
test eax, eax
je 0xa41b85
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or edi, 0xff000000
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, 3
je 0xa41c06
cmp esi, 4
je 0xa41c06
cmp esi, 1
je 0xa41c06
cmp esi, 5
je 0xa41c06
cmp esi, 6
je 0xa41c06
cmp esi, 7
je 0xa41c06
cmp esi, 0xd7
je 0xb18d0f
cmp esi, 8
je 0xb18d0f
cmp esi, 0xd2
je 0xb18d1f
test esi, esi
je 0xb18d0f
cmp esi, 0xd1
jbe 0xb18cff
lea eax, [esi - 0xd2]
cmp eax, 0x3f8
ja 0xa41b8b
mov eax, dword [eax*4 + 0xa01540]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp esi, 2
je 0xa41ada
dec esi
cmp esi, 6
ja case.0xa41c19.2
jmp dword [esi*4 + 0xa41c90]
mov edi, 0xc960ec
jmp 0xa41adf
mov edi, 0xc960e8
jmp 0xa41adf
xor cl, cl
jmp 0xa41b43
mov eax, dword [0xc97ae0]
mov dword [ebp - 0xc], 0x20
test eax, eax
jne 0xa41c4e
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xc]
push ecx
push 0xc960e0
push 0
push 8
push 0x9ee950
push 0x9ee878
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jg 0xb18f57
js 0xb18f66
cmp dword [ebp - 0xc], 0x20
jne 0xb18f66
mov byte [0xc958d8], 1
jmp 0xa41b75
cmp dword [0xc958d4], 0
je 0xa41a57
jmp 0xa41a9c
mov eax, 1
jmp 0xa41a92
cmp esi, 0x4ca
ja 0xa41aa9
mov eax, dword [esi*4 + 0xa2bf88]
cmp eax, 0x1f
jne 0xb18cb7
xor eax, eax
jmp 0xa41b8d
push eax
call dword [sym.imp.USER32.dll_GetSysColor]
or eax, 0xff000000
jmp 0xa41b8d
mov esi, eax
shr esi, 0x10
cmp esi, 0x4ca
jae 0xb18ce9
cmp esi, 0xd2
jae 0xb18cee
lea eax, [esi + esi*2]
lea edx, [eax*4 + 0xc94398]
jmp 0xb18cf0
mov esi, 0x4ca
xor cl, cl
inc ebx
cmp ebx, 0xa
jb 0xa41ac0
jmp 0xa41ace
mov edx, dword [eax + 4]
mov ecx, dword [eax]
push esi
call fcn.00c0197d
jmp 0xa41b8d
cmp esi, 0xd2
je 0xb18d1f
test esi, esi
je 0xb18d1f
xor cl, cl
jmp 0xb18d21
mov cl, 1
cmp esi, 8
je 0xb18d2e
test esi, esi
je 0xb18d2e
xor dl, dl
jmp 0xb18d30
mov dl, 1
call fcn.00c01931
mov ecx, eax
call fcn.00a79f17
jmp 0xa41b8d
mov edi, 0xc960e0
jmp 0xa41adf
mov edi, 0xc960f0
jmp 0xa41adf
mov edi, 0xc960f4
jmp 0xa41adf
mov edi, 0xc960f8
jmp 0xa41adf
mov ecx, dword [ebp + 4]
mov edx, 0x222
push 0x80070057
push 0x9fdf00
call fcn.00aa4c55
jmp 0xa41b85
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00c01732
cmp dword [0xc96f7c], 0
je 0xa41b0a
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
call fcn.00c01732
mov eax, dword [ebp - 0x14]
jmp 0xa41b35
call fcn.00ab20ff
mov esi, eax
test esi, esi
js 0xb18eff
cmp byte [0xc958cd], 0
jne 0xb18ee2
push 0x9ee3c0
push 1
push 0xf001f
mov bl, 1
xor bh, bh
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
test eax, eax
jne 0xb18e1a
push 0x9ee3c0
push 1
push 4
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_OpenFileMappingW]
xor bl, bl
test eax, eax
jne 0xb18e1a
push 0x9ee3c0
push 8
push eax
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_CreateFileMappingW]
mov bl, 1
mov bh, bl
test eax, eax
je 0xb18edd
mov dword [0xc958c8], eax
mov byte [0xc958cc], bl
movzx eax, byte [0xc958cc]
neg eax
push 8
sbb eax, eax
push 0
and eax, 0xf001b
add eax, 4
push 0
push eax
mov eax, dword [0xc958c8]
push eax
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_MapViewOfFile]
mov dword [0xc958d0], eax
cmp dword [0xc958d0], 0
je 0xb18edd
xor esi, esi
test bh, bh
je 0xb18ead
mov ecx, dword [0xc958d0]
call fcn.00a7f3a9
call fcn.00c018d9
test al, al
jne 0xb18ead
lea ecx, [ebp - 0x10]
call fcn.00aa25f0
test eax, eax
js 0xb18ead
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW]
test eax, eax
je 0xb18ea6
mov ecx, dword [ebp - 8]
call fcn.00c01c39
push dword [ebp - 8]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
call fcn.00ab2edc
test eax, eax
je 0xb18eca
mov eax, dword [0xc95880]
mov dword [0xc95888], eax
mov eax, dword [0xc95884]
mov dword [0xc9588c], eax
call fcn.00a7f350
call fcn.00ab280d
mov byte [0xc958cd], 1
jmp 0xb18ee2
mov esi, 0x80004005
cmp dword [0xc96f78], 0
je 0xb18ef7
mov eax, dword [0xc96f78]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_ReleaseMutex]
test esi, esi
jns 0xa41b17
mov eax, dword [ebp - 0x14]
jmp 0xa41b35
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.00a7f3a9
cmp dword [0xc97ae0], 0
jne 0xb18f4f
lea edx, [ebp - 0x18]
mov byte [0xc958d8], 0
lea ecx, [ebp - 0x20]
call fcn.00ab31c0
test al, al
jne 0xb18f4f
call fcn.00c018d9
test al, al
jne 0xb18f4f
push 0
lea ecx, [ebp - 0x20]
call fcn.00c01d35
mov eax, dword [ebp - 0x1c]
jmp 0xa41b35
movzx eax, ax
or eax, 0x80070000
test eax, eax
jmp 0xa41c74
mov edx, dword [0xc97ae0]
test edx, edx
jne 0xb18f73
mov edx, dword [ebp - 0x28]
push 0
mov ecx, 0xd77800
call fcn.00c034fc
test eax, eax
jns 0xa41c84
mov ecx, dword [ebp + 4]
mov edx, 0x23c
push eax
push 0x9fdf00
call fcn.00ab606d
jmp 0xa41c84