Function at 0x41f90d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x45c
lea ebp, [esp - 4]
mov eax, dword [0x4dc104]
xor eax, ebp
mov dword [ebp + 0x45c], eax
push 0x5c
mov eax, 0x4b552c
call fcn.0048ccde
mov eax, dword [ebp + 0x468]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x46c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x470]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x474]
mov dword [ebp - 0x4c], eax
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x41f975
mov dword [ebp - 0x18], ebx
xor eax, eax
inc eax
cmp dword [ebp - 0x18], eax
jne 0x41f980
mov dword [ebp - 0x18], eax
mov edi, 0x4c5c2c
push dword [ebp - 0x30]
lea esi, [ebp + 0x1c]
call fcn.004040f1
mov dword [ebp - 4], ebx
push edi
mov eax, esi
push eax
call fcn.00420b43
push 0xffffffffffffffff
push ebx
mov eax, dword [ebp - 0x1c]
call fcn.00420d36
cmp dword [ebp + 0x34], 8
mov ecx, dword [ebp + 0x20]
jae 0x41f9b3
lea ecx, [ebp + 0x20]
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
mov eax, 0x100
and edx, eax
add edx, eax
or edx, 0x20019
push edx
push ebx
push ecx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fbe9
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x2c]
lea esi, [ebp - 0x44]
call fcn.0042169a
mov byte [ebp - 4], 1
mov dword [ebp - 0x38], 0xff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x38], 0xff
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp + 0x25c]
push ecx
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x41fba1
mov dword [ebp - 0x34], 0x104
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x40]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x25c]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41fba1
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x40]
lea esi, [ebp - 0x48]
call fcn.0042169a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x28]
push eax
push ebx
push str.FileSysPath
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41fb95
cmp dword [ebp - 0x28], 1
je 0x41faad
cmp dword [ebp - 0x28], 2
jne 0x41fb95
mov eax, dword [ebp - 0x34]
shr eax, 1
push eax
lea eax, [ebp + 0x54]
push eax
lea esi, [ebp - 0x68]
call fcn.00420b1f
mov byte [ebp - 4], 4
cmp dword [eax + 0x18], 8
jb 0x41face
mov eax, dword [eax + 4]
jmp 0x41fad1
add eax, 4
push eax
lea esi, [ebp + 0x38]
call fcn.0041e185
pop ecx
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.00405617
push edi
mov eax, esi
push eax
call fcn.00420b43
push str.Scripts
mov eax, esi
push eax
call fcn.00420b43
push edi
mov eax, esi
push eax
call fcn.00420b43
push 0xffffffffffffffff
push ebx
mov eax, dword [ebp - 0x1c]
call fcn.00420d36
mov eax, esi
push eax
lea esi, [ebp]
call fcn.004040f1
mov byte [ebp - 4], 7
push 0xffffffffffffffff
push ebx
push dword [ebp - 0x30]
lea ecx, [ebp + 0x38]
call fcn.00405560
push edi
lea eax, [ebp + 0x38]
push eax
call fcn.00420b43
push 0xffffffffffffffff
push ebx
mov eax, dword [ebp - 0x1c]
lea esi, [ebp + 0x38]
call fcn.00420d36
push edi
mov eax, esi
push eax
call fcn.00420b43
lea eax, [ebp + 0x25c]
push eax
mov eax, esi
push eax
call fcn.00420b43
lea eax, [ebp]
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x3c]
mov ecx, esi
call fcn.0041f36b
add esp, 0xc
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp]
call fcn.00405617
mov byte [ebp - 4], 3
push ebx
push 1
mov ecx, esi
call fcn.00405617
mov byte [ebp - 4], 2
lea esi, [ebp - 0x48]
call fcn.0041dd16
mov dword [ebp - 4], 1
jmp 0x41fbbe
cmp dword [ebp - 0x24], ebx
je 0x41fa04
cmp dword [ebp - 0x24], 0x103
jne 0x41fbd4
mov byte [ebp - 0x11], 1
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x44]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.00405617
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
test eax, eax
jne 0x41f985
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x45c]
xor ecx, ebp
call fcn.00488689
add ebp, 0x460
leave
ret