Function at 0x41820c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x418212
call fcn.00435af0
push dword [esp + 0x5c]
call fcn.0041d390
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0041d000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0041d000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0041d000
push dword [esp]
call fcn.00419949
push dword [esp + 8]
mov edx, 0x47f77a
pop ecx
call fcn.0041d320
je 0x4182bf
cmp dword [0xa345c0], 0
je 0x4182a3
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0xa345d8]
or ebx, 0xf003f
push ebx
push 0
push dword [0xa345a0]
push dword [0xa345bc]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4182bd
lea eax, [esp + 0x10]
push eax
push dword [0xa345a0]
push dword [0xa345bc]
call sub.ADVAPI32.DLL_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x418324
lea eax, [esp + 0x18]
push eax
push dword [0xa345bc]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0xa345c0], 0
je 0x41830c
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0xa345d8]
or ebx, 0xf003f
push ebx
push 0
push dword [0xa345a0]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x418324
lea eax, [esp + 0x10]
push eax
push dword [0xa345a0]
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4185fe
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
push dword [esp + 0x24]
call fcn.0041dcb0
lea eax, [esp + 0x24]
push eax
call fcn.004359f0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4185fe
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x418405
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4183f2
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0041e5e0
lea eax, [esp + 0x30]
push eax
call fcn.004359f0
jmp 0x418400
mov edx, 0x47f046
lea ecx, [esp + 0x2c]
call fcn.0041d008
jmp 0x4185fd
mov ebx, 2
cmp ebx, dword [esp]
jne 0x41847a
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x418467
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0041e5e0
lea eax, [esp + 0x30]
push eax
call fcn.004359f0
jmp 0x418475
mov edx, 0x47f046
lea ecx, [esp + 0x2c]
call fcn.0041d008
jmp 0x4185fd
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4184ec
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4184d9
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0041e060
lea eax, [esp + 0x30]
push eax
call fcn.004359f0
jmp 0x4184e7
mov edx, 0x47f7d6
lea ecx, [esp + 0x2c]
call fcn.0041d008
jmp 0x4185fd
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4185fd
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00433d30
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4185fd
mov edx, 0x47f046
lea ecx, [esp + 0x2c]
call fcn.0041d008
mov dword [esp + 0x44], 0
jmp 0x418557
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x4185f4
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.0041d2c0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x4185b1
mov edx, dword [esp + 0x2c]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
mov edx, 0x47f7d6
push edx
call fcn.00435990
lea eax, [esp + 0x30]
push eax
call fcn.004359f0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435950
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0041ecf0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004359f0
inc dword [esp + 0x44]
jno 0x418557
push dword [esp + 0x3c]
call fcn.00433ef0
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00435950
pop edx
push eax
push edx
call fcn.00435990
pop eax
push eax
call fcn.0041d360
pop edx
add eax, edx
jmp 0x41862f
push dword [esp + 8]
call fcn.00435b50
push dword [esp + 0x20]
call fcn.00435b50
push dword [esp]
call fcn.00435b50
push dword [esp + 4]
call fcn.00435b50
push dword [esp + 0x28]
call fcn.00435b50
add esp, 0x48
pop ebx
ret 0xc