Function at 0x41f3f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x4a39f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
push 0x62
push eax
lea ecx, [ebp - 0x12e]
push ecx
mov dword [ebp - 0x354], edi
mov dword [ebp - 0x358], esi
mov word [ebp - 0x130], ax
call fcn.00405300
xor edx, edx
push 0x208
push edx
lea eax, [ebp - 0x33a]
push eax
mov dword [ebp - 0x348], 0
mov word [ebp - 0x33c], dx
call fcn.00405300
xor ecx, ecx
push 0xc6
push ecx
lea edx, [ebp - 0xca]
push edx
mov word [ebp - 0xcc], cx
call fcn.00405300
mov eax, esi
add esp, 0x24
mov dword [ebp - 0x350], 0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f485
sub eax, edx
sar eax, 1
push 0x32
mov ecx, 0x63
lea edx, [ebp - 0x130]
sub ecx, eax
push edx
add ecx, ecx
push ebx
mov dword [ebp - 0x340], ecx
call dword [0x4653b0]
test eax, eax
jne 0x41f4d9
push str.cant_convert_class_guid_to_string
push 1
call fcn.004343f0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
push eax
push str.SYSTEMCurrentControlSetControlClass_s
lea ecx, [ebp - 0x33c]
push 0x105
push ecx
call fcn.00457d45
add esp, 0x10
lea edx, [ebp - 0x348]
push edx
push 3
push 0
lea eax, [ebp - 0x33c]
push eax
push 0x80000002
call dword [0x4650cc]
test eax, eax
je 0x41f544
push eax
lea ecx, [ebp - 0x33c]
push ecx
push str.ModifyFilters:_couldnt_open__S:_0x_08x
push 1
call fcn.004343f0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x340]
push edx
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0x350]
push ecx
push 0
push edi
push edx
call dword [0x4650c4]
test eax, eax
je 0x41f5a5
mov ecx, dword [ebp - 0x340]
push ecx
push eax
push edi
push str.ModifyFilters:_couldnt_query_class_filter_key__S:_0x_08x_len__d
push 1
call fcn.004343f0
mov edx, dword [ebp - 0x348]
add esp, 0x14
push edx
call dword [0x4650d0]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x350]
cmp eax, 7
je 0x41f5e1
push eax
push edi
push str.ModifyFilters:_class_filter_key__S_is_unexpected_type:__d
push 1
call fcn.004343f0
mov eax, dword [ebp - 0x348]
add esp, 0x10
push eax
call dword [0x4650d0]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x340]
shr eax, 1
xor ecx, ecx
xor edx, edx
mov word [ebp + eax*2 - 0xcc], cx
mov word [ebp + eax*2 - 0xca], dx
mov dword [ebp - 0x340], eax
xor ebx, ebx
mov eax, esi
lea edi, [ebp - 0xcc]
mov dword [ebp - 0x34c], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f616
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
mov byte [ebp - 0x341], bl
cmp word [ebp - 0xcc], bx
je 0x41f6e1
jmp 0x41f640
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f645
sub eax, edx
sar eax, 1
lea ebx, [eax + 1]
mov eax, dword [ebp - 0x358]
push eax
push edi
call fcn.00458117
add esp, 8
test eax, eax
jne 0x41f6c8
cmp dword [ebp + 8], eax
jne 0x41f78e
mov ecx, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x340]
lea edx, [esi + ecx]
cmp eax, edx
jbe 0x41f6a1
sub eax, esi
sub eax, ecx
add eax, eax
push eax
lea eax, [edi + esi*2]
push eax
push edi
call fcn.004072f0
mov eax, dword [ebp - 0x340]
add esp, 0xc
lea ecx, [esi + esi]
push ecx
sub eax, esi
lea edx, [ebp + eax*2 - 0xcc]
push 0
push edx
call fcn.00405300
add esp, 0xc
sub dword [ebp - 0x340], esi
mov byte [ebp - 0x341], 1
jmp 0x41f6d1
add dword [ebp - 0x34c], ebx
lea edi, [edi + ebx*2]
cmp word [edi], 0
jne 0x41f640
mov ebx, dword [ebp - 0x34c]
inc ebx
cmp dword [ebp + 8], 0
je 0x41f7b3
mov eax, dword [ebp - 0x340]
cmp ebx, eax
je 0x41f707
push ebx
push eax
push str.ModifyFilters:_Registry_length__u___computed_length__u
push 2
call fcn.004343f0
add esp, 0x10
mov eax, dword [ebp - 0x358]
mov edx, 0x64
sub edx, ebx
push edx
push eax
lea ecx, [ebp + ebx*2 - 0xce]
push ecx
call fcn.00457cfb
add esp, 0xc
add ebx, esi
mov edi, dword [ebp - 0x354]
mov ecx, dword [ebp - 0x348]
add ebx, ebx
push ebx
lea eax, [ebp - 0xcc]
push eax
push 7
push 0
push edi
push ecx
mov dword [ebp - 0x340], ebx
call dword [0x465094]
mov edx, dword [ebp - 0x348]
push edx
mov esi, eax
call dword [0x4650d0]
test esi, esi
je 0x41f7de
mov eax, dword [ebp - 0x340]
push eax
push esi
push edi
push str.ModifyFilters:_Couldnt_update_class_filter_key__S:_0x_08x
push 1
call fcn.004343f0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040506e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x354]
push eax
push str.ModifyFilters:_Desired_entry_already_in_class_key__S
push 2
call fcn.004343f0
mov ecx, dword [ebp - 0x348]
add esp, 0xc
push ecx
call dword [0x4650d0]
jmp 0x41f7ed
cmp byte [ebp - 0x341], 0
jne 0x41f728
push str.ModifyFilters:_Didnt_find_a_service_name_in_key_to_remove
push 2
call fcn.004343f0
mov edx, dword [ebp - 0x348]
add esp, 8
push edx
call dword [0x4650d0]
jmp 0x41f7ed
push str.ModifyFilters:_updated_filter_key
push 0x10
call fcn.004343f0
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040506e
mov esp, ebp
pop ebp
ret