Function at 0x41e1c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4736d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x475280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x20]
call fcn.004166f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.004166f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.004166f0
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], 0
cmp dword [ebp + 8], 0x80000001
jne 0x41e25c
lea ecx, [ebp - 0x1c]
call fcn.004129e0
push eax
push 1
call fcn.0041fa20
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x41e245
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041c370
jmp 0x41e39e
lea ecx, [ebp - 0x1c]
call fcn.0041b460
test eax, eax
je 0x41e25c
lea ecx, [ebp - 0x1c]
call fcn.0041b460
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x20]
call fcn.004129e0
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041f850
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x41e28b
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041c370
jmp 0x41e39e
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
lea ecx, [ebp - 0x14]
call fcn.0041b460
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x20]
call fcn.0041b460
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.0041d730
test eax, eax
jne 0x41e2d8
xor edx, edx
jne 0x41e2c6
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041c370
jmp 0x41e39e
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041f5e0
movzx edx, al
test edx, edx
je 0x41e2ec
jmp 0x41e33c
cmp dword [ebp - 0x18], 0
ja 0x41e307
mov dword [ebp - 0x10], 0x8000ffff
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041c370
jmp 0x41e39e
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0041fb30
push eax
lea ecx, [ebp - 0x14]
call fcn.0041c700
lea ecx, [ebp - 0x14]
call fcn.0041b460
test eax, eax
jne 0x41e337
mov dword [ebp - 0x10], 0x8007000e
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041c370
jmp 0x41e39e
jmp 0x41e292
cmp dword [ebp - 0x24], 0xb
je 0x41e354
mov dword [ebp - 0x10], 0x8007000d
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041c370
jmp 0x41e39e
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
call fcn.0041b460
push eax
call fcn.00417800
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x41e382
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0041c370
jmp 0x41e39e
cmp dword [ebp - 0x28], 0
je 0x41e390
lea ecx, [ebp - 0x14]
call fcn.0041c190
cmp dword [ebp + 0x18], 0
je 0x41e39e
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x18]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0041c3a0
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.0041c680
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0041f520
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0041f520
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14