Function at 0x41e6bf
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x118
mov eax, 0x49f5d1
call fcn.0047bb4d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x78]
push eax
push 9
xor ebx, ebx
push ebx
push 0x4b52c8
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, ebx
je 0x41e709
push 0x4b530c
xor ecx, ecx
inc ecx
call fcn.0040d57f
pop ecx
xor al, al
jmp 0x41ea34
push 0x400
call fcn.00474de9
mov edi, eax
pop ecx
mov dword [ebp - 0x88], edi
cmp edi, ebx
jne 0x41e727
push 0x4b5348
jmp 0x41e6f9
lea ecx, [ebp - 0x4c]
call fcn.00404c9b
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.ADVAPI32.DLL_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
mov dword [ebp - 0x74], ebx
push ebx
jmp 0x41e98e
push 0x4b53d8
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push eax
push 0x4b53d8
push edi
call fcn.0047aec6
add esp, 0xc
cmp eax, ebx
jne 0x41e97f
push 0x4b53ec
push edi
call fcn.0047728c
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
cmp eax, ebx
je 0x41e97f
push 0x4b53ec
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax*2]
push 0x4b53f8
push eax
mov dword [ebp - 0x70], eax
call fcn.0047728c
pop ecx
pop ecx
cmp eax, ebx
je 0x41e97f
mov ecx, dword [ebp - 0x70]
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp - 0x68]
call fcn.00409d53
mov byte [ebp - 4], 4
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x4c]
call fcn.00404d40
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68]
call fcn.00403d16
lea eax, [ebp - 0x7c]
push eax
push 9
push ebx
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x41e97f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
push ebx
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], 0x200
call esi
test eax, eax
jne 0x41e976
lea eax, [ebp - 0x80]
push eax
push 9
push ebx
push edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
test eax, eax
jne 0x41e97f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
mov dword [ebp - 0x70], ebx
push ebx
jmp 0x41e86d
push 0x4b5488
push edi
call fcn.00479740
pop ecx
pop ecx
cmp eax, ebx
jne 0x41e85e
mov edi, dword [ebp - 0x8c]
lea ecx, [ebp - 0x4c]
call fcn.0040d20c
mov edi, dword [ebp - 0x88]
inc dword [ebp - 0x70]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
push dword [ebp - 0x70]
push dword [ebp - 0x80]
mov dword [ebp - 0x6c], 0x200
call esi
mov dword [ebp - 0x84], eax
cmp eax, ebx
je 0x41e839
cmp eax, 0x103
jne 0x41e89d
push 0x4b5400
push 4
pop ecx
call fcn.0040d57f
pop ecx
jmp 0x41e96d
lea eax, [ebp - 0x124]
push eax
call fcn.004090fb
mov edi, eax
mov byte [ebp - 4], 5
push 0x4b544c
push edi
call fcn.0040b677
pop ecx
pop ecx
cmp edi, ebx
jne 0x41e8c4
xor eax, eax
jmp 0x41e8cb
mov eax, dword [edi]
mov eax, dword [eax + 4]
add eax, edi
mov ecx, dword [eax + 0x14]
push dword [ebp - 0x84]
and ecx, 0xfffff9ff
or ecx, 0x800
push edi
mov dword [eax + 0x14], ecx
call fcn.0040a33c
push 0x4b5474
push edi
call fcn.0040b677
pop ecx
pop ecx
cmp edi, ebx
je 0x41e901
mov eax, dword [edi]
mov ebx, dword [eax + 4]
add ebx, edi
mov eax, dword [ebx + 0x14]
push dword [ebp - 0x70]
and eax, 0xfffff9ff
or eax, 0x800
push edi
mov dword [ebx + 0x14], eax
call fcn.0040a33c
push 0x4b027c
push edi
call fcn.0040b677
pop ecx
pop ecx
lea ebx, [ebp - 0x30]
mov ecx, edi
call fcn.00409165
mov byte [ebp - 4], 6
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x41e940
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
call fcn.00403d16
mov byte [ebp - 4], 0
lea eax, [ebp - 0x124]
call fcn.00407bad
mov edi, dword [ebp - 0x88]
xor ebx, ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
inc dword [ebp - 0x74]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
push dword [ebp - 0x74]
push dword [ebp - 0x78]
mov dword [ebp - 0x6c], 0x200
call esi
cmp eax, ebx
je 0x41e74a
lea eax, [ebp - 0x124]
push eax
call fcn.004090fb
mov esi, eax
mov byte [ebp - 4], 1
push 0x4b5398
push esi
call fcn.0040b677
pop ecx
pop ecx
push dword [ebp - 0x74]
push esi
call fcn.0040a33c
lea ebx, [ebp - 0x30]
mov ecx, esi
call fcn.00409165
push 2
pop ecx
mov byte [ebp - 4], cl
cmp dword [ebp - 0x1c], 8
mov eax, dword [ebp - 0x30]
jae 0x41e9e5
mov eax, ebx
push eax
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.00403d16
mov byte [ebp - 4], 0
lea eax, [ebp - 0x124]
call fcn.00407bad
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push edi
call fcn.00477120
mov dword [esp], 0x4b5498
push 3
pop ecx
call fcn.0040d57f
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.00403d16
mov al, 1
call fcn.0047bbd0
ret