Function at 0x41f610
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1814
call fcn.0048e7b0
mov eax, dword [0x515584]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0x1810], ebx
push esi
push edi
test ebx, ebx
je 0x41fb6d
push 0x400
lea eax, [ebp - 0x4f0]
mov dword [ebp - 0x16fc], 1
push 0
push eax
mov dword [ebp - 0x1700], 0x400
call fcn.00490000
add esp, 0xc
lea eax, [ebp - 0x1700]
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x16fc]
push eax
push 0x4da2f4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x41f76b
lea ecx, [ebp - 0x4f0]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41f6a0
sub ecx, edx
cmp ecx, 0x40
jne 0x41f76b
push 0x20
lea eax, [ebp - 0x4f0]
push eax
push ecx
lea edx, [ecx + 0x40]
lea ecx, [ebp - 0x88]
call fcn.0041e830
lea ecx, [ebp - 0x1788]
mov edx, 0x80
lea esi, [ebp - 0x4d0]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x41f6f9
mov al, byte [ecx + esi]
test al, al
je 0x41f6f9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x41f6e0
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x4f0]
push eax
call fcn.00490000
add esp, 0xc
lea edx, [ebp - 0x4f0]
lea ecx, [ebp - 0x88]
push 0x400
call fcn.0041e880
add esp, 4
lea eax, [ebp - 0x1788]
push eax
lea eax, [ebp - 0x4f0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41f76b
lea eax, [ebp - 0x88]
mov edx, 0xff
push eax
mov ecx, ebx
call fcn.0041e6a0
neg eax
sbb eax, eax
add eax, 1
jne 0x41fb6d
push 0x1000
lea eax, [ebp - 0x16f8]
push 0
push eax
call fcn.00490000
add esp, 0xc
lea ecx, [ebp - 0x16f8]
call fcn.0041f540
lea ecx, [ebp - 0xf0]
call fcn.0041ea10
test eax, eax
jne 0x41f7c8
lea ecx, [ebp - 0xf0]
call fcn.0041ec50
test eax, eax
jne 0x41f7c8
lea ecx, [ebp - 0xf0]
call fcn.0041eeb0
test eax, eax
jne 0x41f7c8
lea ecx, [ebp - 0xf0]
call fcn.0041f1a0
test eax, eax
je 0x41f809
lea ecx, [ebp - 0xf0]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41f7d1
sub ecx, edx
je 0x41f7f7
nop dword [eax]
dec ecx
cmp byte [ebp + ecx - 0xf0], 0x20
jne 0x41f7f7
mov byte [ebp + ecx - 0xf0], 0
test ecx, ecx
jne 0x41f7e0
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x16f8]
call fcn.0041e6d0
push 0x64
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.00490000
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x180c]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41f9a4
xor edi, edi
mov dword [ebp - 0x16fc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x16fc]
push eax
lea eax, [ebp - 0x6f8]
push eax
push edi
push dword [ebp - 0x180c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41f99c
lea eax, [ebp - 0x1700]
push eax
push 1
push 0
lea eax, [ebp - 0x6f8]
push eax
push dword [ebp - 0x180c]
call esi
test eax, eax
jne 0x41f966
lea eax, [ebp - 0x1704]
mov dword [ebp - 0x1708], 1
push eax
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x1704], 0x208
push eax
lea eax, [ebp - 0x1708]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x1700]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41f95e
push 0x64
push eax
lea eax, [ebp - 0x1770]
push eax
call fcn.00490000
add esp, 8
lea edx, [ebp - 0x1770]
lea ecx, [ebp - 0x2f8]
call fcn.0041f3d0
add esp, 4
test eax, eax
je 0x41f95e
cmp byte [ebp - 0x70], 0
je 0x41f922
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x1770]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x41f95e
lea ecx, [ebp - 0x70]
mov edx, 0x64
lea esi, [ebp - 0x1770]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x41f94d
mov al, byte [ecx + esi]
test al, al
je 0x41f94d
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x41f934
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x1700]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x16fc]
mov dword [ebp - 0x16fc], 0x104
push eax
lea eax, [ebp - 0x6f8]
inc edi
push eax
push edi
push dword [ebp - 0x180c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x41f877
push dword [ebp - 0x180c]
call ebx
cmp byte [ebp - 0x70], 0
je 0x41f9ea
lea ecx, [ebp - 0xf0]
mov edx, 0x64
lea esi, [ebp - 0x70]
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x41f9d9
mov al, byte [ecx + esi]
test al, al
je 0x41f9d9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x41f9c0
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
jne 0x41faff
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00490000
mov edi, dword [sym.imp.NETAPI32.dll_Netbios]
lea eax, [ebp - 0x1808]
mov dword [ebp - 0x44], eax
add esp, 0xc
mov eax, 0x100
mov byte [ebp - 0x48], 0x37
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x48]
push eax
call edi
test al, al
jne 0x41fb11
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00490000
mov bl, byte [ebp - 0x1807]
lea eax, [ebp - 0x48]
add esp, 0xc
mov byte [ebp - 0x48], 0x32
mov byte [ebp - 0x18], bl
push eax
call edi
push 0x40
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00490000
lea ecx, [ebp - 0x3e]
mov byte [ebp - 0x48], 0x33
mov esi, 0x4da170
mov byte [ebp - 0x18], bl
mov eax, ecx
add esp, 0xc
mov edx, 0x10
sub esi, eax
nop
lea eax, [edx + 0x7fffffee]
test eax, eax
je 0x41fa89
mov al, byte [ecx + esi]
test al, al
je 0x41fa89
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x41fa70
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov eax, 0x258
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x44], 0x521f98
call edi
test al, al
jne 0x41fb11
movzx eax, byte [0x521f9d]
push eax
movzx eax, byte [0x521f9c]
push eax
movzx eax, byte [0x521f9b]
push eax
movzx eax, byte [0x521f9a]
push eax
movzx eax, byte [0x521f99]
push eax
movzx eax, byte [0x521f98]
push eax
push str._02X_02X_02X_02X_02X_02X
lea eax, [ebp - 0xf0]
push 0x64
push eax
call fcn.0041e730
xor ecx, ecx
add esp, 0x24
test eax, eax
setns cl
test ecx, ecx
je 0x41fb11
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x16f8]
call fcn.0041e6d0
cmp byte [ebp - 0x16f8], 0
jne 0x41fb54
lea ecx, [ebp - 0x16f8]
mov edx, str.Mid2Failed
mov eax, ecx
mov esi, 0x1000
sub edx, eax
nop
lea eax, [esi + 0x7fffeffe]
test eax, eax
je 0x41fb49
mov al, byte [edx + ecx]
test al, al
je 0x41fb49
mov byte [ecx], al
inc ecx
sub esi, 1
jne 0x41fb30
test esi, esi
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
mov edx, dword [ebp - 0x1810]
lea ecx, [ebp - 0x16f8]
push 0xff
call fcn.0041e880
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048d7c2
mov esp, ebp
pop ebp
ret