Function at 0x411790
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459e78
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x4747c0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor edi, edi
call fcn.0041aba0
test eax, eax
jne 0x4119c5
call fcn.0042263d
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4117de
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push edi
push str.SOFTWAREMicrosoftDirectX
mov dword [esp + 0x3c], edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411886
mov ecx, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], 0x100
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x100
or eax, ecx
jge 0x41184b
push 0x100
lea ecx, [esp + 0x10]
call fcn.00401240
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push edi
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0044121e
add esp, 8
cmp eax, edi
jl 0x41189d
cmp eax, dword [esi - 8]
jg 0x41189d
xor edx, edx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], dx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi - 0xc]
cmp eax, edi
jge 0x4118a7
or eax, 0xffffffff
jmp 0x4118c2
push 0x80070057
call fcn.00401000
push 0x464804
push esi
call fcn.004414c0
add esp, 8
cmp eax, edi
jne 0x4118be
or eax, 0xffffffff
jmp 0x4118c2
sub eax, esi
sar eax, 1
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040b830
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.0040c110
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411906
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
cmp dword [esi - 0xc], edi
jge 0x411914
or eax, 0xffffffff
jmp 0x41192f
push 0x464804
push esi
call fcn.004414c0
add esp, 8
cmp eax, edi
jne 0x41192b
or eax, 0xffffffff
jmp 0x41192f
sub eax, esi
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0040b8e0
push 1
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x34], 2
call fcn.0040b860
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.0040c110
mov byte [esp + 0x2c], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411987
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0xc]
push esi
call fcn.00441213
add esp, 4
cmp eax, 9
jl 0x41199e
mov edi, 1
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411a34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x411a34
call fcn.0042263d
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x4119df
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x26
push 0x464808
lea ecx, [esp + 0x20]
mov dword [esp + 0x34], 4
call fcn.0040c320
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411a29
lea edi, [eax + 1]
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x2c], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411a54
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret