Function at 0x41d11c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49a9d7
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4b8744]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov edi, ebx
sub ecx, ebx
je 0x41d174
dec ecx
je 0x41d16d
dec ecx
je 0x41d166
mov esi, 0x80000002
mov edi, 0x100
jmp 0x41d179
mov esi, 0x80000000
jmp 0x41d179
mov esi, 0x80000002
jmp 0x41d179
mov esi, 0x80000001
push edx
lea ecx, [esp + 0x28]
call fcn.0041cb7e
push 0x4a4198
lea ecx, [esp + 0x38]
mov dword [esp + 0x4c], ebx
call fcn.0041cb7e
xor eax, eax
lea ecx, [esp + 0x24]
inc eax
mov byte [esp + 0x48], al
mov ebx, eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
mov dword [esp + 0x18], ebx
call fcn.0041d4c4
test al, al
jne 0x41d1e7
push 0x4a419c
lea ecx, [esp + 0x30]
call fcn.0041cb7e
push 3
pop ebx
lea eax, [esp + 0x2c]
mov dword [esp + 0x48], 2
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebx
call fcn.0041d4c4
test al, al
je 0x41d1ec
mov byte [esp + 0x1c], 0
test bl, 2
je 0x41d1fd
lea ecx, [esp + 0x2c]
and ebx, 0xfffffffd
call fcn.0040e39e
and dword [esp + 0x48], 0
test bl, 1
je 0x41d210
lea ecx, [esp + 0x34]
call fcn.0040e39e
cmp byte [esp + 0x1c], 0
je 0x41d232
push edi
push dword [ebp + 8]
lea eax, [esp + 0x2c]
push eax
push esi
push 0
call fcn.0041cf20
add esp, 0x14
mov bh, al
jmp 0x41d396
lea ecx, [esp + 0x24]
call fcn.0040e359
push eax
lea ecx, [esp + 0x28]
call fcn.004052b2
push eax
lea ecx, [esp + 0x34]
call fcn.0041d3e8
lea ecx, [esp + 0x24]
mov byte [esp + 0x48], 3
call fcn.0040e359
push eax
lea ecx, [esp + 0x28]
call fcn.004052b2
push eax
lea ecx, [esp + 0x1c]
call fcn.0041d3e8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 4
call fcn.00404b49
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x14]
call fcn.00404b49
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathW]
lea eax, [esp + 0x10]
xor bh, bh
push eax
mov eax, edi
lea ecx, [esp + 0x30]
or eax, 9
push eax
push 0
call fcn.00404b49
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d384
push ecx
lea ecx, [esp + 0x20]
call fcn.0041d400
lea eax, [esp + 0x34]
mov byte [esp + 0x48], 5
push eax
lea ecx, [esp + 0x18]
call fcn.0041d497
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 6
call fcn.0041d3c7
lea ecx, [esp + 0x34]
mov byte [esp + 0x48], 5
call fcn.0040e39e
xor esi, esi
lea ecx, [esp + 0x1c]
call fcn.0040e359
push eax
lea ecx, [esp + 0x20]
call fcn.00404b49
push eax
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x41d371
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x20]
call fcn.0041d497
lea edx, [esp + 0x14]
mov byte [esp + 0x48], 7
mov ecx, eax
call fcn.0041cfba
mov bl, al
mov byte [esp + 0x48], 5
neg bl
lea ecx, [esp + 0x34]
sbb bl, bl
call fcn.0040e39e
inc bl
jne 0x41d36c
push edi
push dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push 0
call fcn.0041cf20
add esp, 0x14
mov bh, al
inc esi
test bh, bh
je 0x41d2fa
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
call fcn.0040e39e
lea ecx, [esp + 0x14]
call fcn.0040e39e
lea ecx, [esp + 0x2c]
call fcn.0040e39e
lea ecx, [esp + 0x24]
call fcn.0040e39e
mov al, bh
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret