Function at 0x41cc44
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x420164]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x230], eax
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x234], edx
push 0x208
push eax
mov dword [ebp - 0x214], eax
mov edi, eax
mov byte [ebp - 0x20d], al
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], 3
mov byte [ebx], 1
call sub.msvcrt.dll_memset
add esp, 0xc
call fcn.0041c766
push eax
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0040d9fc
mov esi, eax
test esi, esi
js 0x41ce70
push 0x40b350
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0040da31
mov esi, eax
test esi, esi
js 0x41ce70
lea eax, [ebp - 0x214]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x20c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x41cd14
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41ce70
xor ecx, ecx
lea eax, [ebp - 0x220]
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], ecx
push eax
push ecx
push ecx
push ecx
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jle 0x41cd5c
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x41ce70
mov eax, dword [ebp - 0x220]
lea eax, [eax*2 + 2]
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x41cd8f
mov esi, 0x8007000e
jmp 0x41ce91
xor ebx, ebx
cmp dword [ebp - 0x224], ebx
jbe 0x41ce5d
mov eax, dword [ebp - 0x220]
push 0
push 0
push 0
inc eax
push 0
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x22c]
push eax
push edi
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jle 0x41cdd6
movzx esi, si
or esi, 0x80070000
cmp esi, 0x80070002
je 0x41ce30
test esi, esi
js 0x41ce6a
push dword [ebp - 0x230]
mov edx, dword [ebp - 0x214]
lea ecx, [ebp - 0x228]
push edi
call fcn.0041c730
mov esi, eax
cmp esi, 0x80070002
je 0x41ce30
test esi, esi
js 0x41ce6a
mov eax, dword [ebp - 0x218]
mov cl, 1
mov byte [ebp - 0x20d], cl
cmp dword [ebp - 0x228], eax
jge 0x41ce3c
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x218], eax
jmp 0x41ce3c
mov cl, byte [ebp - 0x20d]
mov eax, dword [ebp - 0x218]
inc ebx
cmp ebx, dword [ebp - 0x224]
jb 0x41cd9d
test cl, cl
je 0x41ce5d
mov ecx, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x21c]
mov dword [ecx], eax
jmp 0x41ce66
mov ebx, dword [ebp - 0x21c]
mov byte [ebx], 0
xor esi, esi
jmp 0x41ce70
mov ebx, dword [ebp - 0x21c]
cmp esi, 0x80070002
jne 0x41ce7d
xor esi, esi
mov byte [ebx], 0
test edi, edi
je 0x41ce91
push edi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x214], 0
je 0x41cea6
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041d370
leave
ret 4