Function at 0x41da80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe98
mov eax, dword [0x43b050]
xor eax, ebp
mov dword [ebp - 0x24], eax
cmp dword [0x43d680], 1
je 0x41daa3
xor eax, eax
jmp 0x41ddac
xor eax, eax
jne 0x41da93
mov ecx, dword [0x4329f0]
mov dword [ebp - 0xe70], ecx
mov edx, dword [0x4329f4]
mov dword [ebp - 0xe6c], edx
mov eax, dword [0x4329f8]
mov dword [ebp - 0xe68], eax
mov ecx, dword [0x4329fc]
mov dword [ebp - 0xe64], ecx
push 0x1fa
push 0
lea edx, [ebp - 0xe60]
push edx
call fcn.00421960
add esp, 0xc
mov eax, dword [0x432a00]
mov dword [ebp - 0xc66], eax
mov ecx, dword [0x432a04]
mov dword [ebp - 0xc62], ecx
mov dx, word [0x432a08]
mov word [ebp - 0xc5e], dx
push 0x200
push 0
lea eax, [ebp - 0xc5c]
push eax
call fcn.00421960
add esp, 0xc
mov ecx, dword [0x432a0c]
mov dword [ebp - 0xa5c], ecx
mov edx, dword [0x432a10]
mov dword [ebp - 0xa58], edx
mov eax, dword [0x432a14]
mov dword [ebp - 0xa54], eax
push 0x1fe
push 0
lea ecx, [ebp - 0xa50]
push ecx
call fcn.00421960
add esp, 0xc
mov edx, dword [0x432a18]
mov dword [ebp - 0x852], edx
mov eax, dword [0x432a1c]
mov dword [ebp - 0x84e], eax
mov ecx, dword [0x432a20]
mov dword [ebp - 0x84a], ecx
mov dx, word [0x432a24]
mov word [ebp - 0x846], dx
push 0x1fc
push 0
lea eax, [ebp - 0x844]
push eax
call fcn.00421960
add esp, 0xc
mov ecx, dword [0x432a28]
mov dword [ebp - 0x648], ecx
mov edx, dword [0x432a2c]
mov dword [ebp - 0x644], edx
mov eax, dword [0x432a30]
mov dword [ebp - 0x640], eax
mov ecx, dword [0x432a34]
mov dword [ebp - 0x63c], ecx
push 0x1fa
push 0
lea edx, [ebp - 0x638]
push edx
call fcn.00421960
add esp, 0xc
mov eax, dword [0x432a38]
mov dword [ebp - 0x43e], eax
mov ecx, dword [0x432a3c]
mov dword [ebp - 0x43a], ecx
mov edx, dword [0x432a40]
mov dword [ebp - 0x436], edx
mov ax, word [0x432a44]
mov word [ebp - 0x432], ax
push 0x1fc
push 0
lea ecx, [ebp - 0x430]
push ecx
call fcn.00421960
add esp, 0xc
mov edx, dword [0x432a48]
mov dword [ebp - 0x234], edx
mov eax, dword [0x432a4c]
mov dword [ebp - 0x230], eax
push 0x202
push 0
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00421960
add esp, 0xc
mov dword [ebp - 0x1c], 0x15
mov dword [ebp - 0x18], 0x65
mov dword [ebp - 0x14], 0x29
mov dword [ebp - 0x10], 0x21
mov dword [ebp - 0xc], 0x1f
mov dword [ebp - 8], 0x105
mov dword [ebp - 4], 0x105
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0xe8c], edx
mov eax, dword [ebp + 0xc]
add eax, 0x510
mov dword [ebp - 0xe88], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x4be
mov dword [ebp - 0xe84], ecx
mov edx, dword [ebp + 0xc]
add edx, 0x47c
mov dword [ebp - 0xe80], edx
mov eax, dword [ebp + 0xc]
add eax, 0x2a
mov dword [ebp - 0xe7c], eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x68
mov dword [ebp - 0xe78], ecx
mov edx, dword [ebp + 0xc]
add edx, 0x272
mov dword [ebp - 0xe74], edx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xe90], 0
jmp 0x41dd0e
mov eax, dword [ebp - 0xe90]
add eax, 1
mov dword [ebp - 0xe90], eax
cmp dword [ebp - 0xe90], 7
jae 0x41dda9
mov ecx, dword [ebp - 0xe90]
mov edx, dword [ebp + ecx*4 - 0x1c]
shl edx, 1
push edx
push 0
mov eax, dword [ebp - 0xe90]
mov ecx, dword [ebp + eax*4 - 0xe8c]
push ecx
call fcn.00421960
add esp, 0xc
mov edx, dword [ebp - 0xe90]
mov eax, dword [ebp + edx*4 - 0x1c]
shl eax, 1
mov dword [ebp - 0xe98], eax
lea ecx, [ebp - 0xe98]
push ecx
mov edx, dword [ebp - 0xe90]
mov eax, dword [ebp + edx*4 - 0xe8c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xe90]
imul ecx, ecx, 0x20a
lea edx, [ebp + ecx - 0xe70]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xe94], eax
cmp dword [ebp - 0xe94], 0
je 0x41dda4
mov dword [ebp - 0x20], 0
jmp 0x41dcff
jmp 0x41dcff
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0041f86b
mov esp, ebp
pop ebp
ret