Function at 0x41e785
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
movzx eax, word [eax]
and eax, 0x2000
je 0x41e498
push 8
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
test eax, eax
je 0x41e498
push str.Error_in_expression:_this_type_of_array_not_supported_in_expressions.
xor eax, eax
cmp dword [ebp + 0x10], 1
sete al
lea eax, [eax + eax + 1]
push eax
call fcn.0041aa80
pop ecx
pop ecx
cmp dword [ebp + 0xc], 9
jne 0x41e4c5
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp eax, 9
je 0x41e4c3
push str.Error_in_expression:_expected_an_object_reference.
xor eax, eax
cmp dword [ebp + 0x10], 1
sete al
lea eax, [eax + eax + 1]
push eax
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x41e510
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp eax, 9
jne 0x41e510
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.00407426
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41e510
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
movzx eax, word [eax]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4002
jg 0x41e546
cmp dword [ebp - 0x24], 0x4002
je case.0x41e565.6
cmp dword [ebp - 0x24], 0x1a
ja case.0x41e565.11
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax + 0x41e8fc]
jmp dword [eax*4 + 0x41e8d4]
mov eax, dword [ebp - 0x24]
sub eax, 0x4004
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x16
ja case.0x41e565.11
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax + 0x41e933]
jmp dword [eax*4 + 0x41e917]
push 3
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 5
je 0x41e599
cmp dword [ebp - 0x28], 8
je 0x41e5ae
cmp dword [ebp - 0x28], 0xb
je 0x41e5b9
jmp 0x41e5d4
push 5
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 4], eax
jmp 0x41e5d4
push dword [ebp + 8]
call fcn.0041dd50
pop ecx
jmp 0x41e5d4
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 8], 0
setne cl
mov eax, dword [ebp + 8]
mov word [eax + 8], cx
mov eax, dword [ebp + 8]
mov word [eax], 0xb
jmp 0x41e8d2
push 5
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
je 0x41e606
cmp dword [ebp - 0x2c], 8
je 0x41e61b
cmp dword [ebp - 0x2c], 0xb
je 0x41e626
jmp 0x41e65b
push 3
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 4], eax
jmp 0x41e65b
push dword [ebp + 8]
call fcn.0041dce9
pop ecx
jmp 0x41e65b
mov eax, dword [ebp + 8]
fld qword [0x42e520]
fld qword [eax + 8]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x41e644
mov dword [ebp - 0x30], 1
jmp 0x41e648
and dword [ebp - 0x30], 0
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0x30]
mov word [eax + 8], cx
mov eax, dword [ebp + 8]
mov word [eax], 0xb
jmp 0x41e8d2
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
je 0x41e6d0
cmp dword [ebp - 0x34], 5
je 0x41e6be
cmp dword [ebp - 0x34], 8
je 0x41e68f
cmp dword [ebp - 0x34], 0xb
je 0x41e6ac
cmp dword [ebp - 0x34], 0x10
je 0x41e6d0
jmp 0x41e6df
push 0
push 0x43de48
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 8]
mov word [eax], 8
jmp 0x41e6df
mov eax, dword [ebp + 8]
and word [eax + 8], 0
mov eax, dword [ebp + 8]
mov word [eax], 0xb
jmp 0x41e6df
mov eax, dword [ebp + 8]
mov word [eax], 5
mov eax, dword [ebp + 8]
fldz
fstp qword [eax + 8]
jmp 0x41e6df
mov eax, dword [ebp + 8]
mov word [eax], 3
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
jmp 0x41e8d2
push 9
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x41e711
cmp dword [ebp - 0x38], 9
je 0x41e711
cmp dword [ebp - 0x38], 0xb
je 0x41e713
jmp 0x41e740
jmp 0x41e75a
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 8], 0
setne cl
mov dword [ebp - 0x1c], ecx
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0x1c]
mov word [eax + 8], cx
mov eax, dword [ebp + 8]
mov word [eax], 0xb
jmp 0x41e75a
push str.IDispatch_pointers_not_allowed_in_expressions
xor eax, eax
cmp dword [ebp + 0x10], 1
sete al
lea eax, [eax + eax + 1]
push eax
call fcn.0041aa80
pop ecx
pop ecx
jmp 0x41e8d2
push dword [ebp + 8]
call fcn.0041adc2
pop ecx
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x41e796
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push dword [eax - 4]
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.0041ae8f
pop ecx
pop ecx
test eax, eax
je 0x41e794
push dword [ebp + 8]
call fcn.0041adc2
pop ecx
jmp 0x41e7a9
push 0
push 0x43de49
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
je 0x41e810
cmp dword [ebp - 0x3c], 5
je 0x41e805
cmp dword [ebp - 0x3c], 0xb
je 0x41e7c9
cmp dword [ebp - 0x3c], 0x10
je 0x41e81b
jmp 0x41e840
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x41e7e7
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.0041ea20
pop ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp + 8]
mov word [eax], 0xb
mov eax, dword [ebp + 8]
mov cx, word [ebp - 0x20]
mov word [eax + 8], cx
jmp 0x41e840
push dword [ebp + 8]
call fcn.0041ddf2
pop ecx
jmp 0x41e840
push dword [ebp + 8]
call fcn.0041ddb2
pop ecx
jmp 0x41e840
mov eax, dword [ebp + 8]
push dword [eax + 8]
call fcn.0041b779
pop ecx
cmp eax, 5
jne 0x41e837
push dword [ebp + 8]
call fcn.0041ddf2
pop ecx
jmp 0x41e840
push dword [ebp + 8]
call fcn.0041ddb2
pop ecx
jmp 0x41e8d2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
je 0x41e889
cmp dword [ebp - 0x40], 5
je 0x41e877
cmp dword [ebp - 0x40], 0xb
je 0x41e865
cmp dword [ebp - 0x40], 0x10
je 0x41e889
jmp 0x41e89a
mov eax, dword [ebp + 8]
mov word [eax], 0xb
mov eax, dword [ebp + 8]
and word [eax + 8], 0
jmp 0x41e8b6
mov eax, dword [ebp + 8]
mov word [eax], 5
mov eax, dword [ebp + 8]
fldz
fstp qword [eax + 8]
jmp 0x41e8b6
mov eax, dword [ebp + 8]
mov word [eax], 3
mov eax, dword [ebp + 8]
and dword [eax + 8], 0
jmp 0x41e8b6
push 8
push 0
push dword [ebp + 8]
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.0041adc2
pop ecx
jmp 0x41e8d2
push str.unexpected_operand_type
xor eax, eax
cmp dword [ebp + 0x10], 1
sete al
lea eax, [eax + eax + 1]
push eax
call fcn.0041aa80
pop ecx
pop ecx
leave
ret