Function at 0x41bb7b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x5c
mov eax, 0x4890e6
call fcn.00454dca
lea ecx, [ebp - 0x68]
call fcn.0041b9f3
lea eax, [ebp - 0xd]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], 0x43
call fcn.0041bb21
mov edi, 0x4b6d04
push edi
lea ecx, [ebp - 0x34]
call fcn.0041acdf
push edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.0041acdf
push edi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.0041acdf
push edi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0041acdf
push edi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.0041acdf
push edi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.0041acdf
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 6
call fcn.0041b94e
pop ecx
lea esi, [ebp - 0x20]
call fcn.0041b8a8
mov eax, dword [ebp - 0x58]
xor esi, esi
sub eax, dword [ebp - 0x5c]
je 0x41bc3a
push esi
lea ecx, [ebp - 0x68]
call fcn.00414250
movzx eax, byte [eax]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041b340
pop ecx
pop ecx
test eax, eax
jne 0x41bc3a
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x5c]
inc esi
cmp esi, eax
jb 0x41bc13
lea esi, [ebp - 0x18]
call fcn.0041b8a8
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 0xc]
cmp eax, 0x28
jle 0x41bc75
push 0x28
lea eax, [ebp - 0x38]
push eax
mov ecx, esi
call fcn.0041af7d
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0041b646
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.0041a963
mov eax, dword [ebp - 0x58]
xor esi, esi
sub eax, dword [ebp - 0x5c]
je 0x41bca6
push esi
lea ecx, [ebp - 0x68]
call fcn.00414250
movzx eax, byte [eax]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041b4b9
pop ecx
pop ecx
test eax, eax
jne 0x41bca6
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x5c]
inc esi
cmp esi, eax
jb 0x41bc7f
lea esi, [ebp - 0x1c]
call fcn.0041b8a8
lea eax, [ebp - 0x24]
push eax
call fcn.0041ba82
lea esi, [ebp - 0x24]
call fcn.0041b8a8
lea ecx, [ebp - 0x4c]
mov dword [esp], 0x494950
call fcn.0041b9b2
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 8
call fcn.0041b58b
push 0x49494c
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 9
call fcn.0041b5e2
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0xa
call fcn.0041b58b
push 0x494948
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0xb
call fcn.0041b5e2
mov ecx, esi
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xc
call fcn.0041b58b
push 0x494944
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0xd
call fcn.0041b5e2
add esp, 0x48
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [ebp - 0x38]
push eax
mov byte [ebp - 4], 0xe
call fcn.0041b58b
add esp, 0xc
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0xf
call fcn.0041b646
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x40]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 6
call fcn.0041a963
mov eax, 0x400
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x50], eax
call fcn.00453559
pop ecx
push edi
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.0041acdf
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x10
call fcn.0041acdf
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push ebx
push 0x494928
push SysReAllocString
mov byte [ebp - 4], 0x11
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41beb3
cmp dword [ebp - 0x14], ebx
je 0x41beb3
push str.InstTime
lea ecx, [ebp - 0x2c]
call fcn.0041b0de
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x50]
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
test eax, eax
je 0x41be60
call fcn.0045471c
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x41be50
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0041a963
lea ecx, [edi - 0x10]
jmp 0x41bed9
lea ecx, [ebp - 0x28]
call fcn.0041b6b7
push 0x49490c
lea ecx, [ebp - 0x38]
call fcn.0041b714
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0x12
call fcn.0041b58b
add esp, 0xc
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x13
call fcn.0041b6fc
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x38]
add ecx, 0xfffffff0
call fcn.0041a963
push esi
jmp 0x41be3c
push esi
call fcn.0045471c
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x41bec8
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0041a963
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
call fcn.0041a963
lea ecx, [ebp - 0x68]
call fcn.00414fc0
push dword [ebp - 0x68]
call fcn.00453f5c
xor eax, eax
pop ecx
inc eax
call fcn.00454ea2
ret