Function at 0x40beea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40bef0
call fcn.00470d10
push dword [esp + 0x5c]
call fcn.00411ba0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00411000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00411000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00411000
push dword [esp]
call fcn.0040d58b
push dword [esp + 8]
mov edx, 0x55039e
pop ecx
call fcn.00411b60
je 0x40bf9d
cmp dword [0x18127c0], 0
je 0x40bf81
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x18127d8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x18127a0]
push dword [0x18127bc]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x40bf9b
lea eax, [esp + 0x10]
push eax
push dword [0x18127a0]
push dword [0x18127bc]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x40c002
lea eax, [esp + 0x18]
push eax
push dword [0x18127bc]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x18127c0], 0
je 0x40bfea
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x18127d8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x18127a0]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x40c002
lea eax, [esp + 0x10]
push eax
push dword [0x18127a0]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40c2db
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470c00
pop edx
push eax
push dword [esp + 0x24]
call fcn.0046e560
lea eax, [esp + 0x24]
push eax
call fcn.00470c30
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40c2db
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40c0e3
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40c0d0
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470c00
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0046f3a0
lea eax, [esp + 0x30]
push eax
call fcn.00470c30
jmp 0x40c0de
mov edx, 0x550028
lea ecx, [esp + 0x2c]
call fcn.00411008
jmp 0x40c2da
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40c158
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40c145
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470c00
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0046f3a0
lea eax, [esp + 0x30]
push eax
call fcn.00470c30
jmp 0x40c153
mov edx, 0x550028
lea ecx, [esp + 0x2c]
call fcn.00411008
jmp 0x40c2da
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40c1ca
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40c1b7
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470c00
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0046e620
lea eax, [esp + 0x30]
push eax
call fcn.00470c30
jmp 0x40c1c5
mov edx, 0x5503d8
lea ecx, [esp + 0x2c]
call fcn.00411008
jmp 0x40c2da
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40c2da
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.0046fbb0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40c2da
mov edx, 0x550028
lea ecx, [esp + 0x2c]
call fcn.00411008
mov dword [esp + 0x44], 0
jmp 0x40c235
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x40c2d1
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
call fcn.0046faf0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x40c28e
mov edx, dword [esp + 0x2c]
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470cc0
mov edx, 0x5503d8
push edx
call fcn.00470cc0
lea eax, [esp + 0x30]
push eax
call fcn.00470c30
mov edx, dword [esp + 0x2c]
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470cc0
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470c00
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0046f4f0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.00470c30
inc dword [esp + 0x44]
jno 0x40c235
push dword [esp + 0x3c]
call fcn.0046fb00
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00470c00
pop edx
push eax
push edx
call fcn.00470cc0
pop eax
push eax
call fcn.00411b30
pop edx
add eax, edx
jmp 0x40c30c
push dword [esp + 8]
call fcn.00470d80
push dword [esp + 0x20]
call fcn.00470d80
push dword [esp]
call fcn.00470d80
push dword [esp + 4]
call fcn.00470d80
push dword [esp + 0x28]
call fcn.00470d80
add esp, 0x48
pop ebx
ret 0xc