Function at 0x41173b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x411741
call fcn.0042f150
push dword [esp + 0x5c]
call fcn.004176e0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00417000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00417000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00417000
push dword [esp]
call fcn.00412dda
push dword [esp + 8]
mov edx, 0x47b3cc
pop ecx
call fcn.00417670
je 0x4117ee
cmp dword [0x523548], 0
je 0x4117d2
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x523560]
or ebx, 0xf003f
push ebx
push 0
push dword [0x523528]
push dword [0x523544]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4117ec
lea eax, [esp + 0x10]
push eax
push dword [0x523528]
push dword [0x523544]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x411853
lea eax, [esp + 0x18]
push eax
push dword [0x523544]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x523548], 0
je 0x41183b
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x523560]
or ebx, 0xf003f
push ebx
push 0
push dword [0x523528]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x411853
lea eax, [esp + 0x10]
push eax
push dword [0x523528]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x411b2d
mov dword [esp + 0x1c], 0x400
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
push dword [esp + 0x24]
call fcn.0042c6b0
lea eax, [esp + 0x24]
push eax
call fcn.0042f050
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x411b2d
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x411934
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411921
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0042d5c0
lea eax, [esp + 0x30]
push eax
call fcn.0042f050
jmp 0x41192f
mov edx, 0x47b028
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x411b2c
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4119a9
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411996
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0042d5c0
lea eax, [esp + 0x30]
push eax
call fcn.0042f050
jmp 0x4119a4
mov edx, 0x47b028
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x411b2c
mov ebx, 4
cmp ebx, dword [esp]
jne 0x411a1b
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411a08
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0042c700
lea eax, [esp + 0x30]
push eax
call fcn.0042f050
jmp 0x411a16
mov edx, 0x47b40e
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x411b2c
mov ebx, 3
cmp ebx, dword [esp]
jne 0x411b2c
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.0042dd50
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411b2c
mov edx, 0x47b028
lea ecx, [esp + 0x2c]
call fcn.00417008
mov dword [esp + 0x44], 0
jmp 0x411a86
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x411b23
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.00417620
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x411ae0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
mov edx, 0x47b40e
push edx
call fcn.0042eff0
lea eax, [esp + 0x30]
push eax
call fcn.0042f050
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042efb0
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0042cc40
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.0042f050
inc dword [esp + 0x44]
jno 0x411a86
push dword [esp + 0x3c]
call fcn.0042dd80
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.0042efb0
pop edx
push eax
push edx
call fcn.0042eff0
pop eax
push eax
call fcn.004176b0
pop edx
add eax, edx
jmp 0x411b5e
push dword [esp + 8]
call fcn.0042f1e0
push dword [esp + 0x20]
call fcn.0042f1e0
push dword [esp]
call fcn.0042f1e0
push dword [esp + 4]
call fcn.0042f1e0
push dword [esp + 0x28]
call fcn.0042f1e0
add esp, 0x48
pop ebx
ret 0xc