Function at 0x41dc61
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x264
mov eax, 0x451f9c
call fcn.0043364b
mov edi, ecx
push 0x206
lea eax, [ebp - 0x21a]
push 0
push eax
call fcn.00435650
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x270]
push eax
push str.vtime
push str.SoftwareKingsoftKBROWSER
push 0x80000001
mov dword [ebp - 0x26c], 0x208
mov dword [ebp - 0x270], 1
call ebx
cmp word [ebp - 0x21c], 0
je 0x41dd1b
lea eax, [ebp - 0x21c]
push eax
call fcn.0042deec
pop ecx
push 0
mov esi, eax
call fcn.0042ea86
mov dword [ebp - 0x268], eax
pop ecx
mov ecx, edx
lea eax, [esi + 0x15180]
cdq
cmp edx, ecx
jl 0x41dd1b
jg 0x41dd0f
cmp eax, dword [ebp - 0x268]
jbe 0x41dd1b
mov ecx, edi
call fcn.0041d849
jmp 0x41df88
push 0
call fcn.0042ea86
pop ecx
push edx
push eax
lea eax, [ebp - 0x21c]
push 0x46157c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x264]
call fcn.00404a24
and dword [ebp - 4], 0
cmp dword [ebp - 0x250], 8
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x264]
cmovae ecx, dword [ebp - 0x264]
add eax, eax
push eax
push ecx
push 1
push str.vtime
mov esi, str.SoftwareKingsoftKBROWSER
push esi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x270]
push eax
push 0x461840
push esi
push 0x80000001
call ebx
cmp word [ebp - 0x21c], 0
jne 0x41de02
xor eax, eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x270]
push eax
push 0x461840
push 0x46161c
push 0x80000002
call ebx
cmp word [ebp - 0x21c], 0
jne 0x41de02
mov ecx, edi
call fcn.0041d849
mov esi, eax
jmp 0x41df77
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00404a24
mov byte [ebp - 4], 1
call fcn.0041db48
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41de28
mov eax, dword [eax]
push ecx
push eax
push dword [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00405897
test eax, eax
je 0x41df5f
call fcn.0041db48
lea ecx, [ebp - 0x234]
cmp ecx, eax
je 0x41de5d
push 0xffffffffffffffff
push 0
push eax
call fcn.00404dac
and dword [ebp - 0x23c], 0
xor eax, eax
mov dword [ebp - 0x238], 7
mov word [ebp - 0x24c], ax
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 2
call fcn.0041d266
mov byte [ebp - 4], 3
mov esi, dword [ebp - 0x268]
cmp dword [esi - 4], 1
mov ebx, dword [esi - 0xc]
jle 0x41deab
push ebx
lea ecx, [ebp - 0x268]
call fcn.004055cc
mov esi, dword [ebp - 0x268]
push ebx
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.0042f597
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call fcn.00401723
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00405103
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x224]
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x234]
cmovae ecx, dword [ebp - 0x234]
add eax, eax
push eax
push ecx
push 1
push 0x461840
push str.SoftwareKingsoftKBROWSER
push 0x80000001
call ebx
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 0x24c]
cmovae ecx, dword [ebp - 0x24c]
add eax, eax
push eax
push ecx
push 1
push 0x461674
push str.SoftwareKingsoftKBROWSER
push 0x80000001
call ebx
lea ecx, [esi - 0x10]
call fcn.0040390b
push 0
push 1
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 1
call fcn.00404e3f
mov ecx, edi
call fcn.0041d849
push 0
push 1
lea ecx, [ebp - 0x234]
mov esi, eax
call fcn.00404e3f
push 0
push 1
lea ecx, [ebp - 0x264]
call fcn.00404e3f
mov eax, esi
call fcn.004335fa
ret