Function at 0x41c2d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xe0
push ebx
lea edx, [esp + 0x14]
push ebp
sub edx, eax
mov ebp, ecx
xor ebx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x41c2e6
push esi
push edi
lea edi, [esp + 0x20]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x41c2f7
mov ax, word [0x43bed0]
mov word [edi], ax
mov eax, dword [esp + 0xf4]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41c311
lea edi, [esp + 0x20]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x41c320
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebx
lea edx, [esp + 0x2c]
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edi, edi
jmp 0x41c360
push edi
lea eax, [esp + 0x74]
push str.use_encoding__d
push eax
call fcn.0042da36
movzx ecx, byte [edi + ebp + 0x260]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x20], ecx
push ebx
lea ecx, [esp + 0x80]
push ecx
push edx
mov dword [esp + 0x30], 4
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x14]
jne 0x41c3b2
mov eax, dword [esp + 0x10]
cmp eax, ebx
setne al
mov byte [edi + ebp + 0x260], al
inc edi
cmp edi, 8
jle 0x41c360
mov ecx, dword [ebp + 0x220]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.preferred_encoding
mov edi, 4
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c3ff
mov eax, dword [esp + 0x10]
movzx edx, byte [ebp + 0x21a]
mov dword [ebp + 0x220], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x2c]
push str.restricted
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c43c
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebp + 0x21b]
cmp eax, ebx
setne al
lea edx, [esp + 0x14]
push edx
mov byte [ebp + 0x21a], al
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.viewonly
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c47e
mov eax, dword [esp + 0x10]
cmp eax, ebx
movzx eax, byte [ebp + 0x21c]
setne dl
lea ecx, [esp + 0x14]
push ecx
mov byte [ebp + 0x21b], dl
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
push str.fullscreen
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c4c0
mov eax, dword [esp + 0x10]
movzx edx, byte [ebp + 0x21d]
cmp eax, ebx
setne cl
lea eax, [esp + 0x14]
push eax
mov byte [ebp + 0x21c], cl
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x2c]
push str.8bit
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c502
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebp + 0x230]
cmp eax, ebx
setne al
lea edx, [esp + 0x14]
push edx
mov byte [ebp + 0x21d], al
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.shared
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c544
mov eax, dword [esp + 0x10]
cmp eax, ebx
movzx eax, byte [ebp + 0x224]
setne dl
lea ecx, [esp + 0x14]
push ecx
mov byte [ebp + 0x230], dl
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
push str.swapmouse
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c586
mov eax, dword [esp + 0x10]
movzx edx, byte [ebp + 0x231]
cmp eax, ebx
setne cl
lea eax, [esp + 0x14]
push eax
mov byte [ebp + 0x224], cl
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x2c]
push str.belldeiconify
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c5c8
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebp + 0x225]
cmp eax, ebx
setne al
lea edx, [esp + 0x14]
push edx
mov byte [ebp + 0x231], al
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.emulate3
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c60a
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov eax, dword [ebp + 0x228]
setne dl
lea ecx, [esp + 0x14]
push ecx
mov byte [ebp + 0x225], dl
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
push str.emulate3timeout
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c64b
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x22c]
lea edx, [esp + 0x14]
push edx
mov dword [ebp + 0x228], eax
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.emulate3fuzz
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c687
mov eax, dword [esp + 0x10]
movzx edx, byte [ebp + 0x232]
mov dword [ebp + 0x22c], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x2c]
push str.disableclipboard
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c6c4
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebp + 0x239]
cmp eax, ebx
setne al
lea edx, [esp + 0x14]
push edx
mov byte [ebp + 0x232], al
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.fitwindow
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c706
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov eax, dword [ebp + 0x240]
setne dl
lea ecx, [esp + 0x14]
push ecx
mov byte [ebp + 0x239], dl
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
push str.scale_den
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c747
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x23c]
lea edx, [esp + 0x14]
push edx
mov dword [ebp + 0x240], eax
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.scale_num
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c783
mov eax, dword [esp + 0x10]
movzx edx, byte [ebp + 0x254]
mov dword [ebp + 0x23c], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x2c]
push str.cursorshape
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c7c0
mov eax, dword [esp + 0x10]
movzx ecx, byte [ebp + 0x255]
cmp eax, ebx
setne al
lea edx, [esp + 0x14]
push edx
mov byte [ebp + 0x254], al
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
push str.noremotecursor
push ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c802
mov eax, dword [esp + 0x10]
cmp eax, ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
setne dl
push ebx
mov byte [ebp + 0x255], dl
mov edx, dword [esp + 0x2c]
push str.compresslevel
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
je 0x41c836
or eax, 0xffffffff
jmp 0x41c83a
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
mov byte [ebp + 0x244], bl
je 0x41c852
mov dword [ebp + 0x248], eax
mov byte [ebp + 0x244], 1
movzx eax, byte [ebp + 0x238]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
push str.scaling
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
mov eax, dword [esp + 0x18]
jne 0x41c889
mov eax, dword [esp + 0x10]
cmp eax, ebx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
setne cl
push ebx
mov byte [ebp + 0x238], cl
mov ecx, dword [esp + 0x2c]
push str.quality
push ecx
mov byte [ebp + 0x24c], 1
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], ebx
call esi
test eax, eax
pop edi
pop esi
je 0x41c8e2
mov eax, 6
mov dword [ebp + 0x250], eax
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop ebx
add esp, 0xe0
ret 8
mov eax, dword [esp + 8]
cmp eax, 0xffffffff
jne 0x41c8c6
mov byte [ebp + 0x24c], bl
jmp 0x41c8cc