Function at 0x41c5d0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49c0f6
mov eax, dword fs:[0]
push eax
sub esp, 0x680
mov eax, dword [0x4c2c40]
xor eax, esp
mov dword [esp + 0x678], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c2c40]
xor eax, esp
push eax
lea eax, [esp + 0x694]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6a8]
mov ebx, dword [esp + 0x6ac]
mov edi, dword [ecx + 4]
cmp edi, dword [ecx + 8]
mov ebp, dword [esp + 0x6a4]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov esi, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
jbe 0x41c648
call fcn.00478a25
lea ecx, [ebp + 0x98]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 8]
test eax, eax
mov dword [esp + 0x34], edi
je 0x41c66c
add eax, 0x104
mov dword [esp + 0x1c], eax
jmp 0x41c673
add ecx, 0xc
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x41c801
jmp 0x41c680
test esi, esi
mov edi, dword [ebx + 4]
je 0x41c68b
cmp esi, ebx
je 0x41c690
call fcn.00478a25
cmp dword [esp + 0x24], edi
je 0x41c6e5
test esi, esi
jne 0x41c69f
call fcn.00478a25
mov edx, dword [esp + 0x24]
cmp edx, dword [esi + 4]
jne 0x41c6ad
call fcn.00478a25
mov ecx, dword [esp + 0x24]
mov edi, dword [ebp + 0x14]
add ecx, 0xc
cmp dword [ebp + 0x18], 8
jb 0x41c6c2
mov eax, dword [ebp + 4]
jmp 0x41c6c5
lea eax, [ebp + 4]
push eax
mov eax, dword [ecx + 0x14]
call fcn.0040e760
test eax, eax
je 0x41c801
lea esi, [esp + 0x20]
call fcn.0041ed90
mov esi, dword [esp + 0x20]
jmp 0x41c680
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 8]
test eax, eax
je 0x41c6f5
lea ecx, [eax + 0x3c]
jmp 0x41c6f8
add ecx, 0x28
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
test al, al
je 0x41c91c
mov eax, dword [ebp + 0x6c]
lea ecx, [ebp + 0x58]
push 0x4a9fc8
mov edi, 0xe
call fcn.0040e760
test eax, eax
jne 0x41c91c
lea eax, [esp + 0x14]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareCanon_Inc_ICUniversal_Installer_Shared
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c8f2
push 0x206
lea ecx, [esp + 0x282]
push ebx
push ecx
mov dword [esp + 0x24], 0x104
mov word [esp + 0x288], bx
call fcn.0047dfc0
add esp, 0xc
push 0x206
lea edx, [esp + 0x48a]
push ebx
push edx
mov dword [esp + 0x28], ebx
mov word [esp + 0x490], bx
call fcn.0047dfc0
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x280]
push ecx
push ebx
push ebx
push str.Region
push edx
call esi
cmp eax, ebx
jne 0x41c80a
lea edx, [esp + 0x27c]
lea edi, [esp + 0x54]
call fcn.00443e70
mov dword [esp + 0x69c], ebx
add ebp, 0x94
push ebp
mov ebx, eax
call fcn.004490e0
test al, al
mov ecx, edi
sete bl
mov dword [esp + 0x69c], 0xffffffff
call fcn.00443eb0
test bl, bl
je 0x41c808
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x41c8f4
xor ebx, ebx
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push str.CiGSupport
push eax
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
jne 0x41c8a8
push 0x206
lea ecx, [esp + 0x7a]
push ebx
push ecx
mov word [esp + 0x80], bx
call fcn.0047dfc0
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, ebx
jne 0x41c858
push 0x4aa234
jmp 0x41c862
cmp eax, 1
jne 0x41c86e
push 0x4aa238
lea edx, [esp + 0x78]
call fcn.0041ef90
add esp, 4
mov edi, dword [esp + 0x28]
mov esi, 0x4aa23c
mov ecx, edi
call fcn.0040e040
test eax, eax
je 0x41c8a0
lea esi, [esp + 0x74]
mov ecx, edi
call fcn.0040e040
test eax, eax
je 0x41c8a0
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x41c8f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x488]
push ecx
push ebx
push ebx
push 0x4aa244
push edx
mov dword [esp + 0x30], 0x104
call esi
test eax, eax
jne 0x41c8e7
mov ecx, dword [esp + 0x2c]
lea esi, [esp + 0x484]
call fcn.0040e040
test eax, eax
jne 0x41c7f6
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [esp + 0x694]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x678]
xor ecx, esp
call fcn.00478599
add esp, 0x68c
ret
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 8]
test eax, eax
lea ebx, [eax + 0xe4]
jne 0x41c930
lea ebx, [esi + 0x6c]
lea edx, [ebp + 0x94]
push edx
call fcn.004490e0
test al, al
je 0x41c801
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx + 0x14]
push 0x4aa23c
mov edi, 3
mov ecx, ebx
call fcn.0040e760
test eax, eax
je 0x41c973
mov eax, dword [esp + 0x1c]
mov ecx, ebx
call fcn.00413180
test eax, eax
jne 0x41c801
mov eax, dword [esi + 8]
test eax, eax
lea edi, [eax + 0x3c]
jne 0x41c980
lea edi, [esi + 0x28]
lea eax, [ebp + 0x38]
push eax
lea ebx, [ebp + 0x58]
call fcn.00442c40
add esp, 4
test al, al
je 0x41c801
cmp dword [ebp + 0x8c], 0
je 0x41ca10
mov esi, str.LessThan
lea ecx, [ebp + 0x58]
call fcn.0040e040
test eax, eax
jne 0x41ca10
mov edx, str.LessOrEqual
lea eax, [esp + 0x38]
call fcn.004015e0
mov dword [esp + 0x69c], 1
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 8]
test eax, eax
je 0x41c9da
add eax, 0x3c
jmp 0x41c9dd
lea eax, [ecx + 0x28]
push eax
lea edi, [ebp + 0x74]
lea ebx, [esp + 0x3c]
call fcn.00442c40
add esp, 4
test al, al
lea ecx, [esp + 0x38]
sete bl
mov dword [esp + 0x69c], 0xffffffff
call fcn.00401620
test bl, bl
jne 0x41c801
mov edi, edi
mov ebx, dword [esp + 0x14]
mov edi, dword [ebx + 8]
cmp dword [ebx + 4], edi
jbe 0x41ca21
call fcn.00478a25
mov esi, dword [esp + 0x34]
cmp esi, edi
je 0x41c8f2
cmp esi, dword [ebx + 8]
jb 0x41ca37
call fcn.00478a25
mov ecx, dword [esi]
mov edi, dword [ebp + 0x14]
mov ebx, 8
cmp dword [ebp + 0x18], ebx
jb 0x41ca4b
mov eax, dword [ebp + 4]
jmp 0x41ca4e
lea eax, [ebp + 4]
push eax
mov eax, dword [ecx + 0x14]
call fcn.0040e760
test eax, eax
jne 0x41ca8f
mov ecx, dword [esp + 0x14]
cmp esi, dword [ecx + 8]
jb 0x41ca69
call fcn.00478a25
mov ecx, dword [esi]
mov edi, dword [ebp + 0x30]
add ecx, 0x1c
cmp dword [ebp + 0x34], ebx
jb 0x41ca7b
mov eax, dword [ebp + 0x20]
jmp 0x41ca7e
lea eax, [ebp + 0x20]
push eax
mov eax, dword [ecx + 0x14]
call fcn.0040e760
test eax, eax
je 0x41c801
mov edx, dword [esp + 0x14]
cmp esi, dword [edx + 8]
jb 0x41ca9d
call fcn.00478a25
add esi, 4
mov dword [esp + 0x34], esi
jmp 0x41ca10