Function at 0x416b30
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x51f16c
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x56b338]
xor eax, esp
mov dword [esp + 0x4a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56b338]
xor eax, esp
push eax
lea eax, [esp + 0x4c0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4d0]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4d4]
mov esi, ecx
mov edi, edx
xor ebp, ebp
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebp
call fcn.0040d310
mov ebx, 8
add esp, 4
cmp dword [eax + 0x18], ebx
jb 0x416ba7
mov eax, dword [eax + 4]
jmp 0x416baa
add eax, 4
lea ecx, [esp + 0x1c]
push ecx
push 0x109
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [esp + 0x48], ebx
mov esi, eax
jb 0x416bd2
mov edx, dword [esp + 0x34]
push edx
call fcn.0042f3a5
add esp, 4
cmp esi, ebp
je 0x416bdd
xor eax, eax
jmp 0x416fb8
mov ecx, edi
mov dword [esp + 0x24], ebp
call fcn.00421cd0
test eax, eax
jbe 0x416fa8
mov eax, dword [esp + 0x24]
push eax
mov eax, edi
call fcn.00421f70
mov esi, eax
mov al, byte [esi + 8]
test al, al
je 0x416fa8
cmp al, 7
jne 0x416fa8
push 0x562e3c
mov eax, esi
call fcn.004221c0
mov edi, eax
push str.type
mov eax, esi
call fcn.004221c0
mov ebp, eax
push str.value
mov eax, esi
call fcn.004221c0
mov ebx, eax
mov al, byte [edi + 8]
test al, al
je 0x416fa8
cmp al, 4
jne 0x416fa8
mov al, byte [ebp + 8]
test al, al
je 0x416c59
cmp al, 4
je 0x416c68
mov al, byte [ebx + 8]
test al, al
je 0x416c68
cmp al, 4
je 0x416fa8
lea esi, [esp + 0x30]
mov ecx, edi
call fcn.00421650
xor esi, esi
push eax
lea ecx, [esp + 0x88]
mov dword [esp + 0x4cc], esi
call fcn.0040d310
add esp, 4
mov byte [esp + 0x4c8], 2
cmp dword [esp + 0x48], 0x10
jb 0x416ca8
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0042f3a5
add esp, 4
mov al, byte [ebp + 8]
test al, al
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], esi
mov byte [esp + 0x34], 0
je 0x416ccf
cmp al, 4
jne 0x416ccf
mov al, byte [ebx + 8]
test al, al
je 0x416ccf
cmp al, 4
je 0x416d06
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x416ce7
lea eax, [esp + 0x88]
mov edx, dword [esp + 0x1c]
push esi
push esi
push esi
push esi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416f9c
mov eax, dword [esp + 0x20]
add dword [eax], 1
mov dword [esp + 0x18], esi
lea esi, [esp + 0x68]
mov ecx, ebp
call fcn.00421650
mov ecx, str.REG_SZ
mov edi, esi
mov byte [esp + 0x4c8], 3
call fcn.004083c0
test al, al
je 0x416d3a
mov dword [esp + 0x18], 1
jmp 0x416e8f
mov ecx, str.REG_EXPAND_SZ
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416d59
mov dword [esp + 0x18], 2
jmp 0x416e8f
mov ecx, str.REG_BINARY
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416d78
mov dword [esp + 0x18], 3
jmp 0x416e8f
mov ecx, str.REG_DWORD
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416d97
mov dword [esp + 0x18], 4
jmp 0x416e8f
mov ecx, str.REG_DWORD_LITTLE_ENDIAN
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416db6
mov dword [esp + 0x18], 4
jmp 0x416e8f
mov ecx, str.REG_DWORD_BIG_ENDIAN
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416dd5
mov dword [esp + 0x18], 5
jmp 0x416e8f
mov ecx, str.REG_LINK
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416df4
mov dword [esp + 0x18], 6
jmp 0x416e8f
mov ecx, str.REG_MULTI_SZ
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416e13
mov dword [esp + 0x18], 7
jmp 0x416e8f
mov ecx, str.REG_RESOURCE_LIST
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416e2f
mov dword [esp + 0x18], 8
jmp 0x416e8f
mov ecx, str.REG_FULL_RESOURCE_DESCRIPTOR
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416e4b
mov dword [esp + 0x18], 9
jmp 0x416e8f
mov ecx, str.REG_RESOURCE_REQUIREMENTS_LIST
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
je 0x416e67
mov dword [esp + 0x18], 0xa
jmp 0x416e8f
mov ecx, str.REG_QWORD
lea edi, [esp + 0x68]
call fcn.004083c0
test al, al
jne 0x416e87
mov ecx, str.REG_QWORD_LITTLE_ENDIAN
call fcn.004083c0
test al, al
je 0x416e8f
mov dword [esp + 0x18], 0xb
push 0x3fe
lea eax, [esp + 0xc2]
push 0
push eax
mov word [esp + 0xc8], 0
call fcn.00436020
add esp, 0xc
lea esi, [esp + 0x4c]
mov ecx, ebx
mov dword [esp + 0x2c], 0x200
call fcn.00421650
push eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x4cc], 4
call fcn.0040d310
add esp, 4
mov ecx, esi
mov byte [esp + 0x4c8], 3
call fcn.00405930
mov eax, dword [esp + 0x18]
cmp eax, 2
je 0x416fe2
cmp eax, 1
je 0x416fe2
cmp eax, 7
je 0x416fe2
cmp eax, 4
je 0x416f13
cmp eax, 3
jne 0x416f87
mov eax, dword [esp + 0x88]
mov edi, 8
cmp dword [esp + 0x9c], edi
jae 0x416f2f
lea eax, [esp + 0x88]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417059
cmp dword [esp + 0xb8], edi
movsx esi, word [esp + 0xbc]
mov eax, dword [esp + 0xa4]
jae 0x416f76
lea eax, [esp + 0xa4]
push eax
call fcn.0042f8e8
add esp, 4
cmp eax, esi
je 0x417052
lea ecx, [esp + 0xa0]
call fcn.004022c0
lea ecx, [esp + 0x68]
call fcn.00405930
lea ecx, [esp + 0x84]
call fcn.004022c0
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x4c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a8]
xor ecx, esp
call fcn.0042f3aa
add esp, 0x4b8
ret 8
mov eax, dword [esp + 0x88]
mov esi, 8
cmp dword [esp + 0x9c], esi
jae 0x416ffe
lea eax, [esp + 0x88]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x417059
cmp dword [esp + 0xb8], esi
mov eax, dword [esp + 0xa4]
jae 0x417039
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0042f57c
add esp, 8
test eax, eax
je 0x416f87
mov eax, dword [esp + 0x20]
add dword [eax], 1
lea ecx, [esp + 0xa0]
call fcn.004022c0
lea ecx, [esp + 0x68]
call fcn.00405930
lea ecx, [esp + 0x84]
mov dword [esp + 0x4c8], 0xffffffff
call fcn.004022c0
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esi, 1
mov dword [esp + 0x24], esi
call fcn.00421cd0
cmp esi, eax
jae 0x416fa8
mov edi, dword [esp + 0x28]
jmp 0x416bf0