Function at 0x41de52
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x548], 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x41e134
mov ecx, dword [ebp + 8]
mov edx, edi
push ebx
call fcn.0041d7cf
test eax, eax
je 0x41e134
lea eax, [ebp - 0x548]
push eax
push 1
push 0
push 0x403bd0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x104
test eax, eax
jne 0x41dfd5
push 0x96
lea eax, [ebp - 0x540]
mov dword [ebp - 0x550], 0x208
push eax
push 0x24
push dword [0x42c790]
mov dword [ebp - 0x54c], 1
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x41dfc9
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x54c]
push eax
push 0
lea eax, [ebp - 0x540]
push eax
push dword [ebp - 0x548]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41dfc9
cmp dword [ebp - 0x54c], 1
jne 0x41dfc9
push edi
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x41dfc9
lea eax, [ebp - 0x20c]
test eax, eax
je 0x41df54
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ecx
lea eax, [ebp - 0x544]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.00418514
test eax, eax
js 0x41dfc9
push ecx
lea eax, [ebp - 0x414]
mov edx, esi
push eax
mov eax, dword [ebp - 0x544]
sub edx, eax
push ecx
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + eax*2]
call fcn.00418577
test eax, eax
js 0x41dfc9
lea ecx, [ebp - 0x20c]
call fcn.00424fe2
test eax, eax
je 0x41dfc9
mov edx, dword [ebx]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, edi
call fcn.004183cc
test eax, eax
js 0x41dfc9
push dword [ebp - 0x548]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x41e136
push dword [ebp - 0x548]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
mov edx, edi
push ebx
call fcn.0041d7cf
test eax, eax
je 0x41e08e
push esi
lea eax, [ebp - 0x414]
push eax
push 0x21
push dword [0x42c790]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x41e08e
push edi
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x41e08e
lea eax, [ebp - 0x20c]
test eax, eax
je 0x41e029
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ecx
lea eax, [ebp - 0x544]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.00418514
test eax, eax
js 0x41e08e
push ecx
lea eax, [ebp - 0x414]
mov edx, esi
push eax
mov eax, dword [ebp - 0x544]
sub edx, eax
push ecx
lea ecx, [ebp - 0x20c]
lea ecx, [ecx + eax*2]
call fcn.00418577
test eax, eax
js 0x41e08e
lea ecx, [ebp - 0x20c]
call fcn.00424fe2
test eax, eax
je 0x41e08e
mov edx, dword [ebx]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004183cc
test eax, eax
jns 0x41dfc1
mov ecx, dword [ebp + 8]
mov edx, edi
push ebx
call fcn.0041d7cf
test eax, eax
je 0x41e134
push esi
lea eax, [ebp - 0x414]
push eax
push 0x25
push dword [0x42c790]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x41e134
push edi
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x41e134
lea eax, [ebp - 0x20c]
test eax, eax
je 0x41e0de
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push ecx
lea eax, [ebp - 0x544]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.00418514
test eax, eax
js 0x41e134
push ecx
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x544]
sub esi, eax
push ecx
lea ecx, [ebp - 0x20c]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.00418577
test eax, eax
js 0x41e134
mov edx, dword [ebx]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004183cc
test eax, eax
jns 0x41dfc1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429770
mov esp, ebp
pop ebp
ret 4