Function at 0x41b3b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cff8
mov eax, dword fs:[0]
push eax
sub esp, 0x4d4
mov eax, dword [0x4ade78]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4cc], 0
call fcn.0041c470
test al, al
jne 0x41b40e
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x3ff
lea eax, [ebp - 0x40f]
push 0
mov ebx, 1
push eax
mov dword [ebp - 0x4cc], ebx
mov byte [ebp - 0x410], 0
call fcn.00462e00
add esp, 0xc
mov dword [ebp - 0x4d8], 0
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4d0], 0
push str.SOFTWAREWow6432NodeMicr
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 4], ebx
call fcn.00401b30
push 0x17
push str.osoftInternet_Explorer
lea ecx, [ebp - 0x4c8]
mov byte [ebp - 4], 2
call fcn.004035a0
mov eax, dword [ebp - 0x4c8]
mov edx, ebx
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x41b4b4
push 0
lea ecx, [ebp - 0x4c8]
call fcn.00407d40
mov eax, dword [ebp - 0x4c8]
push 1
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x4d8]
call fcn.0041c100
mov esi, dword [ebp - 0x4d8]
or ecx, 0xffffffff
test eax, eax
jne 0x41b698
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0
push str.svcVersion
push esi
mov dword [ebp - 0x4dc], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41b562
mov eax, dword [ebp - 0x4c4]
cmp eax, 1
je 0x41b519
cmp eax, 2
jne 0x41b562
mov eax, dword [ebp - 0x4dc]
test eax, eax
je 0x41b52f
cmp byte [ebp + eax - 0x411], 0
je 0x41b536
jmp 0x41b562
mov byte [ebp - 0x410], 0
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.00401b30
mov eax, dword [eax]
mov ebx, 3
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x4cc], ebx
mov byte [ebp - 0x4bd], 1
jne 0x41b569
mov byte [ebp - 0x4bd], 0
test bl, 2
je 0x41b597
mov edx, dword [ebp - 0x4c4]
add edx, 0xfffffff0
and ebx, 0xfffffffd
mov dword [ebp - 0x4cc], ebx
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41b597
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x4bd], 0
je 0x41b5bc
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b5b0
jmp 0x41b667
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x410]
push eax
push str.Version
lea ecx, [ebp - 0x4d8]
mov dword [ebp - 0x4c4], 0x400
call fcn.0041c1b0
test eax, eax
jne 0x41b612
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.00401b30
mov eax, dword [eax]
or ebx, 4
cmp dword [eax - 0xc], 0
mov dword [ebp - 0x4cc], ebx
mov byte [ebp - 0x4bd], 1
jne 0x41b619
mov byte [ebp - 0x4bd], 0
test bl, 4
je 0x41b647
mov edx, dword [ebp - 0x4c4]
add edx, 0xfffffff0
and ebx, 0xfffffffb
mov dword [ebp - 0x4cc], ebx
lea eax, [edx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41b647
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x4bd], 0
je 0x41b678
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41b660
sub ecx, edx
push ecx
lea eax, [ebp - 0x410]
push eax
mov ecx, edi
call fcn.00408620
test esi, esi
je 0x41b68b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x4d8], esi
mov dword [ebp - 0x4d4], 0
or ecx, 0xffffffff
mov ebx, dword [ebp - 0x4c8]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41b6b9
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
test esi, esi
je 0x41b6c4
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461234
mov esp, ebp
pop ebp
ret