Function at 0x411c52
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x411c58
call fcn.00453120
push dword [esp + 0x5c]
call fcn.00418690
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00418000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00418000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00418000
push dword [esp]
call fcn.004132f3
push dword [esp + 8]
mov edx, 0x5263da
pop ecx
call fcn.00418620
je 0x411d05
cmp dword [0x62acd4], 0
je 0x411ce9
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x62acec]
or ebx, 0xf003f
push ebx
push 0
push dword [0x62acb4]
push dword [0x62acd0]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x411d03
lea eax, [esp + 0x10]
push eax
push dword [0x62acb4]
push dword [0x62acd0]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x411d6a
lea eax, [esp + 0x18]
push eax
push dword [0x62acd0]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x62acd4], 0
je 0x411d52
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x62acec]
or ebx, 0xf003f
push ebx
push 0
push dword [0x62acb4]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x411d6a
lea eax, [esp + 0x10]
push eax
push dword [0x62acb4]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x412043
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
push dword [esp + 0x24]
call fcn.00450630
lea eax, [esp + 0x24]
push eax
call fcn.004530b0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x412043
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x411e4b
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411e38
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00451750
lea eax, [esp + 0x30]
push eax
call fcn.004530b0
jmp 0x411e46
mov edx, 0x52602e
lea ecx, [esp + 0x2c]
call fcn.00418008
jmp 0x412042
mov ebx, 2
cmp ebx, dword [esp]
jne 0x411ec0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411ead
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00451750
lea eax, [esp + 0x30]
push eax
call fcn.004530b0
jmp 0x411ebb
mov edx, 0x52602e
lea ecx, [esp + 0x2c]
call fcn.00418008
jmp 0x412042
mov ebx, 4
cmp ebx, dword [esp]
jne 0x411f32
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411f1f
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00450680
lea eax, [esp + 0x30]
push eax
call fcn.004530b0
jmp 0x411f2d
mov edx, 0x52641c
lea ecx, [esp + 0x2c]
call fcn.00418008
jmp 0x412042
mov ebx, 3
cmp ebx, dword [esp]
jne 0x412042
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00451dd0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x412042
mov edx, 0x52602e
lea ecx, [esp + 0x2c]
call fcn.00418008
mov dword [esp + 0x44], 0
jmp 0x411f9d
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x412039
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
call fcn.004520d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x411ff6
mov edx, dword [esp + 0x2c]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
mov edx, 0x52641c
push edx
call fcn.00453060
lea eax, [esp + 0x30]
push eax
call fcn.004530b0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453030
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00450de0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004530b0
inc dword [esp + 0x44]
jno 0x411f9d
push dword [esp + 0x3c]
call fcn.00451f90
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00453030
pop edx
push eax
push edx
call fcn.00453060
pop eax
push eax
call fcn.00418660
pop edx
add eax, edx
jmp 0x412074
push dword [esp + 8]
call fcn.004531b0
push dword [esp + 0x20]
call fcn.004531b0
push dword [esp]
call fcn.004531b0
push dword [esp + 4]
call fcn.004531b0
push dword [esp + 0x28]
call fcn.004531b0
add esp, 0x48
pop ebx
ret 0xc