Function at 0x4106d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
test byte [0x415868], 8
jne 0x410858
mov edi, dword [0x415860]
cmp edi, 0x415860
jne 0x41071e
jmp 0x4107d0
mov edi, dword [edi]
cmp edi, 0x415860
je 0x4107d0
cmp dword [edi + 8], esi
jne 0x410710
mov eax, dword [edi + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x410710
mov eax, dword [edi + 0x10]
test eax, eax
je 0x410710
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test eax, eax
jne 0x410710
test byte [0x415868], 8
jne 0x410778
mov eax, dword [edi + 0x14]
mov dword [ebp + 8], eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.ucrtbase.dll__wcsdup]
mov eax, dword [edi + 0x14]
call fcn.0040ffa0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
call fcn.0040ffa0
mov esi, eax
mov eax, ebx
call fcn.0040ffa0
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], str.found__s:_s_in_settings_list__returning__s_n
mov dword [esp + 8], str.get_reg_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
jmp 0x410761
mov dword [ebp - 0x1c], 0
test byte [0x415868], 8
jne 0x4109a8
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], 0x2000000
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
je 0x410940
movzx edx, byte [0x415868]
cmp eax, 2
je 0x4108b0
and edx, 2
jne 0x4108cc
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x415868], 8
jne 0x410900
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0040ffa0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
call fcn.0040ffa0
mov edi, eax
mov eax, ebx
call fcn.0040ffa0
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], str.path_s__name_s__def_s_n
mov dword [esp + 8], str.get_reg_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
jmp 0x4106f8
and edx, 8
jne 0x410a78
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, eax
jmp 0x41083d
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.RegOpenKey_failed_on_wine_config_key__res_ld__n
mov dword [esp + 8], str.get_config_key
mov dword [esp + 4], 0x415868
mov dword [esp], 1
call fcn.00410270
jmp 0x41082c
mov eax, ebx
call fcn.0040ffa0
mov dword [esp + 0xc], str.returning__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.get_reg_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2c]
lea esi, [ebp - 0x20]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], esi
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
cmp eax, 2
je 0x410aa1
test eax, eax
je 0x4109fc
test byte [0x415868], 2
je 0x41082c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Couldnt_query_values_length__res_ld__n
jmp 0x4108d8
mov eax, dword [ebp - 0x30]
call fcn.0040ffa0
mov edi, eax
mov eax, dword [ebp - 0x2c]
call fcn.0040ffa0
mov dword [ebp - 0x34], eax
mov eax, ebx
call fcn.0040ffa0
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], str.subkey_s__name_s__def_s_n
mov dword [esp + 8], str.get_config_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
jmp 0x4107e4
mov eax, dword [ebp - 0x20]
add eax, 2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov ebx, eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
test byte [0x415868], 8
je 0x41082e
mov eax, ebx
call fcn.0040ffa0
mov dword [esp + 0xc], str.buffer_s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.get_config_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
jmp 0x41082e
mov dword [esp + 0xc], str.Section_key_not_present___using_default_n
mov dword [esp + 8], str.get_config_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
jmp 0x4108b9
test byte [0x415868], 8
jne 0x410abd
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wcsdup]
mov ebx, eax
jmp 0x41082e
mov dword [esp + 0xc], str.Value_not_present___using_default_n
mov dword [esp + 8], str.get_config_key
mov dword [esp + 4], 0x415868
mov dword [esp], 3
call fcn.00410270
jmp 0x410aaa