Function at 0x41e91e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x45c
lea ebp, [esp - 4]
mov eax, dword [0x4d9114]
xor eax, ebp
mov dword [ebp + 0x45c], eax
push 0x5c
mov eax, 0x4b1abc
call fcn.0048bc6e
mov eax, dword [ebp + 0x468]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x46c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x470]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x474]
mov dword [ebp - 0x4c], eax
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x41e986
mov dword [ebp - 0x18], ebx
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jne 0x41e991
mov dword [ebp - 0x18], eax
mov edi, 0x4c2ce4
push dword [ebp - 0x30]
lea esi, [ebp + 0x1c]
call fcn.004040d3
mov dword [ebp - 4], ebx
push edi
mov eax, esi
push eax
call fcn.0041fb54
push 0xffffffffffffffff
push ebx
mov eax, dword [ebp - 0x1c]
call fcn.0041fd47
cmp dword [ebp + 0x34], 8
mov ecx, dword [ebp + 0x20]
jae 0x41e9c4
lea ecx, [ebp + 0x20]
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
mov eax, 0x100
and edx, eax
add edx, eax
or edx, 0x20019
push edx
push ebx
push ecx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ebfa
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x2c]
lea esi, [ebp - 0x44]
call fcn.00420708
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0xff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x38], 0xff
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp + 0x25c]
push ecx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x41ebb2
mov dword [ebp - 0x34], 0x104
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x40]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x25c]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ebb2
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x40]
lea esi, [ebp - 0x48]
call fcn.00420708
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push str.FileSysPath
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41eba6
cmp dword [ebp - 0x28], 1
je 0x41eabe
cmp dword [ebp - 0x28], 2
jne 0x41eba6
mov eax, dword [ebp - 0x34]
shr eax, 1
push eax
lea eax, [ebp + 0x54]
push eax
lea esi, [ebp - 0x68]
call fcn.0041fb30
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x41eadf
mov eax, dword [eax + 4]
jmp 0x41eae2
add eax, 4
push eax
lea esi, [ebp + 0x38]
call fcn.0041d196
pop ecx
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.0040515f
push edi
mov eax, esi
push eax
call fcn.0041fb54
push str.Scripts
mov eax, esi
push eax
call fcn.0041fb54
push edi
mov eax, esi
push eax
call fcn.0041fb54
push 0xffffffffffffffff
push ebx
mov eax, dword [ebp - 0x1c]
call fcn.0041fd47
mov eax, esi
push eax
lea esi, [ebp]
call fcn.004040d3
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x30]
lea ecx, [ebp + 0x38]
call fcn.004050a8
push edi
lea eax, [ebp + 0x38]
push eax
call fcn.0041fb54
push 0xffffffffffffffff
push ebx
mov eax, dword [ebp - 0x1c]
lea esi, [ebp + 0x38]
call fcn.0041fd47
push edi
mov eax, esi
push eax
call fcn.0041fb54
lea eax, [ebp + 0x25c]
push eax
mov eax, esi
push eax
call fcn.0041fb54
lea eax, [ebp]
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.0041e37c
add esp, 0xc
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp]
call fcn.0040515f
mov byte [ebp - 4], 3
push ebx
push 1
mov ecx, esi
call fcn.0040515f
mov byte [ebp - 4], 2
lea esi, [ebp - 0x48]
call fcn.0041cd27
mov dword [ebp - 4], 1
jmp 0x41ebcf
cmp dword [ebp - 0x24], ebx
je 0x41ea15
cmp dword [ebp - 0x24], 0x103
jne 0x41ebe5
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x44]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.0040515f
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
test eax, eax
jne 0x41e996
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x45c]
xor ecx, ebp
call fcn.004876e8
add ebp, 0x460
leave
ret