Function at 0x41b05fa3
Capabilities:
Query or enumerate registry value

Disassembly:
je 0x41b0d1cd
lea ecx, [edx - 0x801]
push 0xb
pop edx
cmp ecx, edx
ja 0x41b05f8c
jmp 0x41b0cff7
and dword [ebp - 0x21c], ebx
jmp 0x41b06057
push 0xb
jmp 0x41b0d01f
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x41b28d84]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x1c]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x224], ecx
mov ecx, 0x80d
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x21c], 1
cmp edx, ecx
jbe 0x41b05f74
sub edx, 0x80e
je 0x41b0d2a6
dec edx
je 0x41b0d29a
dec edx
je 0x41b0d288
dec edx
je 0x41b0d25d
dec edx
je 0x41b0d23c
sub edx, 0x1803
jne 0x41b0607a
cmp dword [ebp + 0xc], 1
je 0x41b08c50
push 2
pop ecx
cmp dword [ebp + 0xc], ecx
je 0x41b08c76
cmp dword [ebp + 0xc], 3
jne 0x41b05f97
test byte [esi + 0x50], cl
je 0x41b05f97
test edi, edi
je 0x41b05f97
test eax, eax
je 0x41b05f97
push eax
push edi
call fcn.41b063ac
xor ebx, ebx
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x41b06063
mov dword [eax], ebx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.41b028d6
leave
ret 0x1c
push 2
pop ecx
sub edx, ecx
jne 0x41b05f8c
cmp dword [ebp + 0xc], 1
jne 0x41b08c22
test byte [esi + 0x50], cl
je 0x41b05f97
test edi, edi
je 0x41b05f97
test eax, eax
je 0x41b05f97
push eax
push edi
call fcn.41b060b6
jmp 0x41b06055
cmp dword [ebp + 0xc], ecx
jne 0x41b05f97
test byte [esi + 0x50], cl
je 0x41b05f97
test edi, edi
je 0x41b05f97
test eax, eax
je 0x41b05f97
push eax
push edi
call fcn.41b05a76
jmp 0x41b06055
test byte [esi + 0x50], 2
je 0x41b05f97
test edi, edi
je 0x41b05f97
test eax, eax
je 0x41b05f97
push eax
push edi
call fcn.41b059aa
jmp 0x41b06055
test byte [esi + 0x50], cl
je 0x41b05f97
test edi, edi
je 0x41b05f97
test eax, eax
je 0x41b05f97
push eax
push edi
call fcn.41b05a39
jmp 0x41b06055
jmp dword [ecx*4 + 0x41b0d2b8]
pop ebx
jmp 0x41b06057
push 7
pop ebx
jmp 0x41b0d0ab
mov eax, dword [ebp - 0x214]
cmp eax, dword [esi + 0x4c]
je 0x41b06057
push eax
push 0
push dword [0x41b28b30]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x41b06057
cmp eax, 1
jl 0x41b0d0dd
xor eax, eax
mov word [edi], ax
jmp 0x41b06055
push 0x15
jmp 0x41b0d01f
test edi, edi
je 0x41b05f97
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x41b0d231
cmp word [eax], 0x5c
mov dword [ebp - 0x214], eax
jne 0x41b0d206
cmp word [eax + 2], 0x5c
jne 0x41b0d206
movzx ecx, word [eax + 4]
cmp cx, 0x2e
je 0x41b0d1ff
cmp cx, 0x3f
jne 0x41b0d206
cmp word [eax + 6], 0x5c
je 0x41b0d21a
push eax
call fcn.41b24f72
mov dword [ebp - 0x214], eax
test eax, eax
je 0x41b0d081
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [edi], eax
jmp 0x41b0d0ab
mov dword [edi], 2
jmp 0x41b06055
test edi, edi
je 0x41b05f97
cmp dword [esi + 0x4c], ebx
je 0x41b0d231
push dword [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [edi], eax
jmp 0x41b06055
mov esi, dword [esi + 0x48]
shr eax, 1
test edi, edi
je 0x41b05f97
test esi, esi
je 0x41b0d0ce
push esi
push eax
push edi
call fcn.41b050d1
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0x15
jmp 0x41b06057
push eax
push edi
push dword [ebp + 0xc]
call fcn.41b115d1
push eax
call fcn.41b060ef
jmp 0x41b0d2b1
push edi
push dword [ebp + 0x10]
push esi
call fcn.41b117b1
jmp 0x41b0d2b1
push eax
push edi
push dword [ebp + 0x10]
push esi
call fcn.41b11760
mov ebx, eax
jmp 0x41b06057