Function at 0x4042b0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412113
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2c0
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x2b0], 0
mov byte [ebp - 4], 3
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x280], 0
test ecx, ecx
je 0x4043c3
mov eax, dword [ecx]
lea edx, [ebp - 0x280]
push edx
push 0x4132d0
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x4043c8
mov esi, dword [ebp - 0x280]
push esi
mov dword [ebp - 0x2b4], esi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [ebp - 0x280]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push str.mac_extension_maps
lea eax, [ebp - 0x2a8]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00402980
mov esi, eax
test esi, esi
js 0x4043c8
push str.options
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00402980
mov esi, eax
test esi, esi
js 0x4043c8
push str.maps
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00402980
mov esi, eax
jmp 0x4043c8
mov esi, 0x80004005
mov dword [ebp - 0x294], 0
mov byte [ebp - 4], 4
mov dword [ebp - 0x2c0], VariantClear
mov dword [ebp - 0x2b8], str.VirtualStoreMACHINESOFTWAREMediafourCommonMac_Extension_MapsMapsA5EF848A_CB75_4AF2_87EB_7BAD1D7E1D4C
test esi, esi
js 0x404b32
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x294]
push eax
push 0x20019
push 0
push str.VirtualStoreMACHINESOFTWAREMediafourCommonMac_Extension_MapsMapsA5EF848A_CB75_4AF2_87EB_7BAD1D7E1D4C
push SysReAllocString
call edi
mov eax, dword [ebp - 0x294]
test eax, eax
jne 0x404458
lea eax, [ebp - 0x294]
mov dword [ebp - 0x2c0], reloc.OLEAUT32.dll_SysReAllocString
push eax
push 0x20019
push 0
push str.SOFTWAREMediafourCommonMac_Extension_MapsMapsA5EF848A_CB75_4AF2_87EB_7BAD1D7E1D4C
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2b8], str.SOFTWAREMediafourCommonMac_Extension_MapsMapsA5EF848A_CB75_4AF2_87EB_7BAD1D7E1D4C
call edi
mov eax, dword [ebp - 0x294]
test eax, eax
je 0x404b32
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x280], 0
push ecx
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x29c], 4
push ecx
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x298], 4
push ecx
push 0
push str.RemoveExtensions
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x4044a5
movzx eax, ax
or eax, 0x80070000
mov edi, str.true
mov ecx, str.false
test eax, eax
js 0x4044ec
cmp dword [ebp - 0x29c], 4
jne 0x4044ec
cmp dword [ebp - 0x298], 4
jne 0x4044ec
cmp dword [ebp - 0x280], 0
mov eax, edi
cmove eax, ecx
lea ecx, [ebp - 0x2a4]
push eax
push str.removeExtensions
call fcn.00402850
mov esi, eax
test esi, esi
js 0x404576
lea eax, [ebp - 0x298]
mov dword [ebp - 0x280], 0
push eax
lea eax, [ebp - 0x280]
mov dword [ebp - 0x29c], 4
push eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x298], 4
push eax
push 0
push str.ShowExtensions
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x404540
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x404576
cmp dword [ebp - 0x29c], 4
jne 0x404576
cmp dword [ebp - 0x298], 4
jne 0x404576
cmp dword [ebp - 0x280], 0
lea ecx, [ebp - 0x2a4]
mov eax, str.false
cmove edi, eax
push edi
push str.showExtensions
call fcn.00402850
mov esi, eax
xor eax, eax
push 0x200
push eax
mov dword [ebp - 0x29c], eax
lea eax, [ebp - 0x268]
push eax
call fcn.004064d0
add esp, 0xc
mov dword [ebp - 0x2ac], 0x100
lea eax, [ebp - 0x2ac]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x404b15
nop dword [eax]
inc dword [ebp - 0x29c]
lea eax, [ebp - 0x268]
push 7
push str.usermap
push eax
mov dword [ebp - 0x2ac], 0x100
call fcn.00408b92
add esp, 0xc
test eax, eax
jne 0x404ae4
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x2bc], eax
test esi, esi
js 0x404ae4
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x2b8]
lea eax, [ebp - 0x2bc]
push str._1_2
push eax
call fcn.00402200
mov edi, dword [ebp - 0x2bc]
add esp, 0x10
mov dword [ebp - 0x290], eax
test eax, eax
js 0x404aba
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x404664
js 0x40465a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x27c], 0
lea eax, [ebp - 0x27c]
push eax
push 0x20019
push 0
push edi
push dword [ebp - 0x2c0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
mov dword [ebp - 0x290], ecx
test ecx, ecx
jle 0x40469c
movzx ecx, cx
or ecx, 0x80070000
mov dword [ebp - 0x290], ecx
test ecx, ecx
js 0x404aba
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x298], 0
xor esi, esi
mov dword [ebp - 0x280], esi
lea eax, [ebp - 0x284]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], esi
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x28c], 4
push eax
push esi
push str.AppendExtension
push dword [ebp - 0x27c]
mov dword [ebp - 0x284], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x40471b
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x404a77
cmp dword [ebp - 0x28c], 4
jne 0x404a77
cmp dword [ebp - 0x284], 4
jne 0x404a77
cmp dword [ebp - 0x288], 0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x28c], 0
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], 4
push eax
push 0
push str.AssignTypeCreator
push dword [ebp - 0x27c]
setne byte [ebp - 0x29d]
mov dword [ebp - 0x284], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x40479d
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x404a77
cmp dword [ebp - 0x288], 4
jne 0x404a77
cmp dword [ebp - 0x284], 4
jne 0x404a77
cmp dword [ebp - 0x28c], 0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x28c], 0
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x288], 4
push eax
push 0
push str.DontRemoveFileExtension
push dword [ebp - 0x27c]
setne byte [ebp - 0x2d0]
mov dword [ebp - 0x284], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x40481f
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x404a77
cmp dword [ebp - 0x288], 4
jne 0x404a77
cmp dword [ebp - 0x284], 4
jne 0x404a77
cmp dword [ebp - 0x28c], 0
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x288], 4
push eax
lea eax, [ebp - 0x288]
mov dword [ebp - 0x284], 4
push eax
push 0
push str.FileCreator
push dword [ebp - 0x27c]
setne byte [ebp - 0x2cc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x404897
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x404a77
cmp dword [ebp - 0x288], 4
jne 0x404a77
cmp dword [ebp - 0x284], 4
jne 0x404a77
lea eax, [ebp - 0x284]
mov dword [ebp - 0x288], 4
push eax
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x284], 4
push eax
lea eax, [ebp - 0x288]
push eax
push 0
push str.FileType
push dword [ebp - 0x27c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jle 0x404901
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x404a77
cmp dword [ebp - 0x288], 4
jne 0x404a77
cmp dword [ebp - 0x284], 4
jne 0x404a77
lea eax, [ebp - 0x298]
push eax
push str.FileExtension
lea ecx, [ebp - 0x27c]
call fcn.00402f10
test eax, eax
js 0x404a77
lea eax, [ebp - 0x280]
push eax
push 0x41889c
lea ecx, [ebp - 0x27c]
call fcn.00402f10
test eax, eax
js 0x404a71
movups xmm0, xmmword [0x4132c0]
lea eax, [ebp - 0x268]
push str.defaultmap
push eax
movups xmmword [ebp - 0x278], xmm0
call fcn.004088c2
add esp, 8
test eax, eax
je 0x40499c
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, eax
mov dword [ebp - 0x290], ecx
jmp 0x4049a2
mov ecx, dword [ebp - 0x290]
test ecx, ecx
js 0x404a71
push 0x50
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.004064d0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x28
push eax
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
mov dword [ebp - 0x28c], 0
push 0x41824c
lea eax, [ebp - 0x28c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00402700
mov esi, dword [ebp - 0x280]
mov ecx, eax
mov dword [ebp - 0x290], ecx
test ecx, ecx
js 0x404a5b
lea eax, [ebp - 0x68]
push eax
push 0x418254
lea ecx, [ebp - 0x28c]
call fcn.00402850
mov dword [ebp - 0x290], eax
test eax, eax
js 0x404a5b
push dword [ebp - 0x298]
mov dl, byte [ebp - 0x29d]
lea ecx, [ebp - 0x28c]
push dword [ebp - 0x2c4]
push dword [ebp - 0x2c8]
push esi
push dword [ebp - 0x2cc]
push dword [ebp - 0x2d0]
call fcn.004034c0
add esp, 0x18
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x28c]
test eax, eax
je 0x404a77
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x404a77
mov esi, dword [ebp - 0x280]
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x404a92
js 0x404a8a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x27c], eax
test esi, esi
je 0x404aa7
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
mov eax, dword [ebp - 0x27c]
jmp 0x404aad
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x298]
test ecx, ecx
je 0x404ac0
push ecx
call esi
mov eax, dword [ebp - 0x27c]
test edi, edi
je 0x404ad1
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x404ade
js 0x404ade
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x290]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x29c]
push eax
push dword [ebp - 0x294]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4045d0
mov eax, dword [ebp - 0x294]
test eax, eax
je 0x404b32
js 0x404b28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x294], 0
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x2b0]
test eax, eax
je 0x404b46
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x2a4]
test eax, eax
je 0x404b5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x2a8]
test eax, eax
je 0x404b6e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xe
mov eax, dword [ebp - 0x2b4]
test eax, eax
je 0x404b85
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00404f90
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret