Function at 0x4116dc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x74
lea ebp, [esp - 4]
mov eax, dword [0x449e30]
xor eax, ebp
mov dword [ebp + 0x74], eax
push 0x2c
mov eax, 0x433bbd
call fcn.004217ef
xor ebx, ebx
push ebx
push str.CCryptContext::CheckProvider
lea ecx, [ebp + 0xc]
call fcn.004107dc
mov dword [ebp - 4], ebx
push str.Start...
push ebx
lea eax, [ebp + 0xc]
push eax
call fcn.00410918
add esp, 0xc
push ebx
push str.U.are.U_VerifyCriptoprovider
lea ecx, [ebp - 0x1c]
call fcn.00408bd8
mov byte [ebp - 4], 1
cmp dword [0x44b1ec], ebx
jne 0x4118f6
mov byte [ebp - 4], 2
mov edi, str.Microsoft_Base_Cryptographic_Provider_v1.0
push ebx
mov esi, 0x105
push esi
lea ecx, [ebp - 0x30]
call fcn.00409afd
mov byte [ebp - 4], 3
push ebx
push esi
lea ecx, [ebp - 0x24]
call fcn.00409afd
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x4118b1
lea ecx, [ebp - 0x18]
call fcn.0040d4d5
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x18]
call fcn.00409c34
push 0xf0000000
push 1
push edi
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x411898
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090006
jne 0x411898
mov dword [ebp + 8], ebx
mov byte [ebp - 4], 6
mov edi, 0x2001f
push edi
push str.SoftwareMicrosoftCryptographyDefaultsProvider
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 8]
call fcn.00401169
test eax, eax
jne 0x41188c
mov dword [ebp], ebx
push esi
push dword [ebp - 0x2c]
push dword [ebp]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x41188c
mov dword [ebp + 4], ebx
mov byte [ebp - 4], 7
inc dword [ebp]
push edi
push dword [ebp - 0x2c]
push dword [ebp + 8]
lea ecx, [ebp + 4]
call fcn.00401169
test eax, eax
jne 0x41187b
lea eax, [ebp - 0x38]
push eax
push str.Type
lea ecx, [ebp + 4]
call fcn.0040119e
cmp eax, ebx
jne 0x41187b
cmp dword [ebp - 0x38], 1
jne 0x41187b
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push str.Image_Path
lea ecx, [ebp + 4]
call fcn.004011d6
test eax, eax
jne 0x41187b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x41186f
push str.DllRegisterServer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x41186f
call eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x34]
call fcn.00409c02
mov byte [ebp - 4], 6
lea ecx, [ebp + 4]
call fcn.00401104
jmp 0x4117de
mov byte [ebp - 4], 5
lea ecx, [ebp + 8]
call fcn.00401104
mov edi, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x18]
call fcn.0040d470
inc dword [ebp - 0x14]
jmp 0x41176a
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.0040b4ee
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.0040b4ee
mov dword [ebp - 4], 1
jmp 0x4118da
mov dword [0x44b1ec], 1
push str.Finished...
push ebx
lea eax, [ebp + 0xc]
push eax
call fcn.00410918
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00408c0e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00410891
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.004217ad
add ebp, 0x78
leave
ret