Function at 0x4108a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x27c
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0x274], eax
mov eax, ecx
mov dword [esp + 0x14], vtable.ErrorClass.0
push ebx
mov ebx, dword [esp + 0x284]
push ebp
mov ebp, dword [esp + 0x28c]
mov ecx, dword [eax + 0xc]
push esi
mov dword [esp + 0x14], eax
or ecx, 0x20019
mov eax, dword [eax]
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], vtable.TextErrorClass.0
mov dword [esp + 0x28], 0x43c8e0
mov dword [esp + 0x2c], 0
push edi
mov edi, dword [esp + 0x298]
cmp eax, 0x80000004
je 0x4109ac
cmp eax, 0x80000050
je 0x4109ac
lea edx, [esp + 0x1c]
push edx
push ecx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4109b0
push ecx
push esi
push eax
lea ecx, [esp + 0x30]
call fcn.00408c20
test al, al
jne 0x4109b0
or dword [ebx + 0x14], 0x200
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x41097f
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410967
sub ecx, edx
sar ecx, 1
lea esi, [ecx*2 + 2]
jmp 0x410981
xor esi, esi
push esi
mov ecx, ebx
call fcn.004106c0
test al, al
je 0x410cf7
push esi
push edi
push dword [ebx + 0x28]
call fcn.00421610
mov dword [ebx + 0x20], 1
add esp, 0xc
mov bl, 1
jmp 0x410cf9
mov dword [esp + 0x1c], eax
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, esi
movzx edx, word [esi]
test dx, dx
je 0x4109d2
nop
add eax, 2
cmp dx, 0x5c
cmove ecx, eax
movzx edx, word [eax]
test dx, dx
jne 0x4109c0
mov eax, dword [ebx]
test ecx, ecx
cmovne esi, ecx
mov ecx, ebx
push esi
mov eax, dword [eax + 0x10]
call eax
test al, al
je 0x410cf7
or dword [ebx + 0x14], 1
xor ebp, ebp
cmp dword [ebx + 0x24], ebp
jne 0x410a33
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x1c]
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x410a1a
cmp eax, 0xea
jne 0x410a33
lea eax, [esp + 0x44]
mov dword [esp + 0x14], ebp
push eax
lea ecx, [esp + 0x18]
call fcn.00407f20
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x24], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x68], eax
xor eax, eax
mov word [esp + 0x6c], ax
mov eax, dword [edi]
shr eax, 2
not al
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x60], 2
mov dword [esp + 0x64], pe_nt_image_headers32
test al, 1
je 0x410bb4
lea esp, [esp]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x7c]
push ebp
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x410aa6
cmp eax, 0xea
jne 0x410bb4
push 1
push dword [esp + 0x6c]
inc ebp
mov ecx, ebx
mov dword [esp + 0x1c], ebp
call fcn.00408aa0
mov esi, eax
test esi, esi
je 0x410cea
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
add edx, 0x2ac18000
push 0
push 0x989680
adc ecx, 0xfe624e21
push ecx
push edx
call fcn.00434690
mov ecx, eax
add ecx, 0xffff573f
adc edx, 0xffffffff
test edx, edx
ja 0x410b02
jb 0x410afd
cmp ecx, 0x7fff573d
ja 0x410b02
mov dword [esi + 0x24], eax
jmp 0x410b09
mov dword [esi + 0x24], 0
mov eax, dword [edi]
shr eax, 3
not al
test al, 1
je 0x410a70
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov ebp, dword [eax + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp eax, 0x80000004
je 0x410b6e
cmp eax, 0x80000050
je 0x410b6e
lea ecx, [esp + 0x34]
push ecx
push 0x20019
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x410b72
push ecx
push ebp
push eax
mov ecx, 0x44cdfc
call fcn.00408c20
test al, al
je 0x410b8b
jmp 0x410b72
mov dword [esp + 0x34], eax
push dword [edi]
mov ecx, dword [esp + 0x1c]
push 0x44cdfc
push 0
push esi
push 0
push dword [esp + 0x48]
call fcn.00410dc0
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x410b9c
mov ebp, dword [esp + 0x14]
jmp 0x410a70
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x34], 0
jmp 0x410a70
mov eax, dword [edi]
xor esi, esi
shr eax, 1
not al
test al, 1
je 0x410c4e
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ebx, [ebx]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x40], eax
lea eax, [esp + 0x4c]
push eax
push 0
lea eax, [esp + 0x58]
mov dword [esp + 0x54], 0
push eax
push 0
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x7c]
push esi
push dword [esp + 0x38]
call ebp
test eax, eax
je 0x410c09
cmp eax, 0xea
jne 0x410c4e
mov eax, dword [esp + 0x68]
mov ecx, ebx
cmp word [eax], 0
je 0x410c27
push 0
push eax
call fcn.00408aa0
mov ecx, eax
test ecx, ecx
je 0x410cea
mov eax, dword [esp + 0x50]
inc esi
mov dword [ecx + 0x20], eax
lea eax, [esp + 0x24]
push dword [edi]
push eax
push dword [esp + 0x48]
push ecx
push dword [esp + 0x78]
mov ecx, dword [esp + 0x2c]
push dword [esp + 0x30]
call fcn.00410dc0
jmp 0x410bd0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x410c65
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], 0
mov esi, dword [esp + 0x29c]
test esi, esi
je 0x410cdd
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x410cdd
test byte [ebx + 0x14], 1
je 0x410cd6
push dword [ebx + 0x18]
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.0040c000
test al, al
je 0x410cea
mov ecx, dword [esp + 0x18]
lea eax, [esi - 1]
push eax
push edi
push ebp
push ebx
call fcn.004108a0
test al, al
je 0x410cea
push 0
mov ecx, ebp
call fcn.0040c140
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x410cd6
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 4]
cmp eax, dword [edi + 4]
jb 0x410cc3
cmp eax, dword [edi + 0x14]
jbe 0x410cc9
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, esi
test esi, esi
jne 0x410cb3
mov esi, dword [esp + 0x29c]
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x410c77
lea ecx, [esp + 0x58]
mov bl, 1
call fcn.00408240
jmp 0x410cf9
lea ecx, [esp + 0x58]
xor bl, bl
call fcn.00408240
jmp 0x410cf9
xor bl, bl
cmp dword [esp + 0x30], 0
mov dword [esp + 0x24], vtable.TextErrorClass.0
je 0x410d24
push dword [esp + 0x2c]
call fcn.0041f5f1
add esp, 4
mov dword [esp + 0x2c], 0x43c8e0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], vtable.ErrorClass.0
test eax, eax
je 0x410d3b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x284]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041e8c8
add esp, 0x27c
ret 0x10