Function at 0x41d940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529f48
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
mov edi, str._ZRegedit::ReadKeyValue_Start
mov dword [ebp - 4], 0
call fcn.00408b90
mov esi, dword [ebp + 0x20]
mov eax, esi
cmp esi, 0x12
jb 0x41d99a
mov eax, 0x12
cmp dword [ebp + 0x24], 0x10
mov edx, dword [ebp + 0x10]
jae 0x41d9a6
lea edx, [ebp + 0x10]
push eax
mov ecx, str.HKEY_LOCAL_MACHINE
call fcn.00402130
add esp, 4
test eax, eax
jne 0x41d9cc
cmp esi, 0x12
jae 0x41d9c2
or eax, 0xffffffff
jmp 0x41d9ca
xor eax, eax
cmp esi, 0x12
setne al
test eax, eax
sete al
test al, al
je 0x41d9da
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x41da3b
mov ecx, str.HKEY_CLASSES_ROOT
lea edi, [ebp + 0x10]
call fcn.00404da0
test al, al
je 0x41d9f2
mov eax, SysReAllocStringLen
jmp 0x41da3b
mov ecx, str.HKEY_CURRENT_USER
lea edi, [ebp + 0x10]
call fcn.00404da0
test al, al
je 0x41da0a
mov eax, SysReAllocStringLen
jmp 0x41da3b
mov ecx, str.HKEY_USERS
lea edi, [ebp + 0x10]
call fcn.00404da0
test al, al
je 0x41da22
mov eax, SysReAllocStringLen
jmp 0x41da3b
mov ecx, str.HKEY_CURRENT_CONFIG
lea edi, [ebp + 0x10]
call fcn.00404da0
test al, al
mov eax, VariantClear
jne 0x41da3b
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x50]
push ecx
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41dbea
mov edi, 7
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x54]
push ecx
push eax
lea edx, [ebp - 0x4c]
push edx
push eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x50]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push eax
call esi
test eax, eax
jne 0x41dbb2
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
ja 0x41daac
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401dc0
jmp 0x41dab9
sub eax, ecx
push 0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041f000
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x41dac5
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x54]
push ecx
push eax
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
push edx
push 0
push ebx
push eax
call esi
test eax, eax
jne 0x41dbb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x60], esp
xor edx, edx
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
push edx
lea eax, [ebp - 0x2c]
mov dword [ecx + 0x14], edi
push eax
mov word [ecx], dx
call fcn.00401c60
lea ecx, [ebp - 0x48]
push ecx
call fcn.00420800
add esp, 0x20
mov ecx, dword [ebp - 0x5c]
push eax
mov byte [ebp - 4], 2
call fcn.00404500
mov byte [ebp - 4], 1
cmp dword [ebp - 0x34], 0x10
jb 0x41db2d
mov edx, dword [ebp - 0x48]
push edx
call fcn.004ad85d
add esp, 4
mov edi, dword [ebp - 0x58]
cmp dword [edi + 0x14], 0x10
jb 0x41db3a
mov eax, dword [edi]
jmp 0x41db3c
mov eax, edi
push 0xa
push eax
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00520ed1
mov ecx, eax
add esp, 0xc
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x41db50
sub ecx, esi
push ecx
push eax
mov ecx, edi
call fcn.004047d0
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, str._ZRegedit::ReadKeyValue_End
call fcn.00408b90
cmp dword [ebp - 0x18], 8
jb 0x41db88
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004ad85d
add esp, 4
xor eax, eax
cmp dword [ebp + 0x24], 0x10
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x41dbae
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004ad85d
add esp, 4
mov al, 1
jmp 0x41dbfe
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 8
jb 0x41dbce
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004ad85d
add esp, 4
xor ecx, ecx
cmp dword [ebp + 0x24], 0x10
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
jb 0x41dbfc
mov edx, dword [ebp + 0x10]
push edx
jmp 0x41dbf4
cmp dword [ebp + 0x24], 0x10
jb 0x41dbfc
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ad85d
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret