Function at 0x41a2c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4c71c0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x50a4c0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
mov eax, dword [0x50a4c0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov cl, 0xd4
mov eax, 4
mov dl, 0xb0
xor esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov al, 0xc5
mov byte [esp + 0x50], dl
mov byte [esp + 0x54], dl
mov dl, 0xaf
mov bl, 0xb4
push 0x26
mov dword [esp + 0x10], esi
mov byte [esp + 0x40], 0x8c
mov byte [esp + 0x41], al
mov byte [esp + 0x42], 0xae
mov byte [esp + 0x43], cl
mov byte [esp + 0x44], 0xb9
mov byte [esp + 0x45], al
mov byte [esp + 0x46], 0xb5
mov byte [esp + 0x47], cl
mov byte [esp + 0x48], 0xa8
mov byte [esp + 0x49], al
mov byte [esp + 0x4a], 0xa0
mov byte [esp + 0x4b], cl
mov byte [esp + 0x4c], 0xad
mov byte [esp + 0x4d], al
mov byte [esp + 0x4e], 0xa4
mov byte [esp + 0x4f], cl
mov byte [esp + 0x50], 0x83
mov byte [esp + 0x51], al
mov byte [esp + 0x52], 0x92
mov byte [esp + 0x53], cl
mov byte [esp + 0x55], al
mov byte [esp + 0x56], 0xa6
mov byte [esp + 0x57], cl
mov byte [esp + 0x59], al
mov byte [esp + 0x5a], bl
mov byte [esp + 0x5b], cl
mov byte [esp + 0x5c], 0x96
mov byte [esp + 0x5d], al
mov byte [esp + 0x5e], dl
mov byte [esp + 0x5f], cl
mov byte [esp + 0x60], dl
mov byte [esp + 0x61], al
mov byte [esp + 0x62], bl
mov byte [esp + 0x63], cl
mov byte [esp + 0x64], 0xab
mov byte [esp + 0x65], al
mov byte [esp + 0x2c], 0x3f
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0x26
call fcn.004a41a8
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, esi
je 0x41a3e9
push 0x26
lea ecx, [esp + 0x40]
push ecx
push eax
call fcn.004a7010
add esp, 0xc
mov dword [esp + 0x70], esi
mov al, 0x9a
mov cl, 0xa9
push 0xe
mov byte [esp + 0x30], 0xd8
mov byte [esp + 0x31], al
mov byte [esp + 0x32], 0xf9
mov byte [esp + 0x33], cl
mov byte [esp + 0x34], 0xc0
mov byte [esp + 0x35], al
mov byte [esp + 0x36], 0xe3
mov byte [esp + 0x37], cl
mov byte [esp + 0x38], 0xc7
mov byte [esp + 0x39], al
mov byte [esp + 0x3a], 0xdf
mov byte [esp + 0x3b], cl
mov byte [esp + 0x3c], 0xf0
mov byte [esp + 0x3d], al
mov byte [esp + 0x50], 0x14
mov dword [esp + 0x44], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x4c], 0xe
call fcn.004a41a8
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, esi
je 0x41a474
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [eax], edx
mov edx, dword [esp + 0x34]
mov dword [eax + 4], ecx
mov cx, word [esp + 0x38]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
lea esi, [esp + 0x3c]
mov byte [esp + 0x70], 1
call fcn.004215e0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
lea esi, [esp + 0x28]
call fcn.004215e0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esp + 0xc], 3
lea ecx, [esp + 0x3c]
sete bl
call fcn.00421580
mov ecx, esi
call fcn.00421580
mov al, bl
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004a4a25
add esp, 0x68
ret