Function at 0x41d0b6
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c0
mov eax, dword [0x4231e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp + 8]
sub esp, 0x10
lea edi, [ebp - 0x8b4]
xor ebx, ebx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8b8], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebp - 0x8b4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041d057
test eax, eax
jne 0x41d2e3
lea eax, [ebp - 0x8bc]
mov dword [ebp - 0x8bc], 0xff
push eax
lea eax, [ebp - 0x8a4]
push eax
push 0x4021a0
push 0x402f70
sub esp, 0x10
lea esi, [ebp - 0x8b4]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041d67d
test eax, eax
je 0x41d142
xor eax, eax
mov word [ebp - 0x8a4], ax
push 0x28
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x8b4]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2a4]
push 0x401d6c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x54]
mov esi, 0x80000000
push eax
push 0x403ba8
lea eax, [ebp - 0x2a4]
push eax
push esi
call fcn.0041d81b
lea eax, [ebp - 0x8b8]
push eax
push 0x40293c
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, 0xff
jmp 0x41d24d
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x2a4]
push 0x4060c8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x8c0], edi
lea eax, [ebp - 0x8c0]
push eax
lea eax, [ebp - 0x4a4]
push eax
push 0x4021a0
lea eax, [ebp - 0x2a4]
push eax
push esi
call fcn.0041d6f5
test eax, eax
jne 0x41d24c
lea eax, [ebp - 0x8a4]
push eax
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41d24c
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x2a4]
push 0x401d6c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0x403ba8
lea eax, [ebp - 0x2a4]
push eax
push esi
call fcn.0041d81b
inc ebx
push edi
lea eax, [ebp - 0x6a4]
push eax
push ebx
push dword [ebp - 0x8b8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x41d1ba
push dword [ebp - 0x8b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2a4]
push 0x4054b4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x4a4]
lea esi, [ebp - 0x8b4]
push edi
push eax
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041d405
cmp word [ebp - 0x4a4], 0
jne 0x41d2c6
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x4a4]
push eax
push 0x4021a0
lea eax, [ebp - 0x2a4]
push eax
push 0x80000000
call fcn.0041d81b
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0041f3a0
leave
ret 0x10