Function at 0x413566
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41356d
call fcn.0042e970
push dword [esp + 0x50]
call fcn.004192b0
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00419000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00419000
mov dword [0x4b5001], 0x30001c5
mov dword [0x4b5001], 0x30001c6
mov dword [esp + 0x10], 0x20019
mov dword [0x4b5001], 0x30001c9
cmp dword [esp + 0x48], 0
je 0x4135e6
mov dword [0x4b5001], 0x30001c9
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001c9
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0042c9a0
call fcn.0042e900
mov edx, 0x4b569c
pop ecx
push ecx
call fcn.004192f0
mov ecx, eax
call fcn.00419270
je 0x41366c
mov dword [0x4b5001], 0x30001c9
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 8]
call fcn.0042c970
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0042ca10
lea eax, [esp + 4]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001c9
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0042ca10
call fcn.0042e900
mov edx, 0x4b569c
pop ecx
push ecx
call fcn.004192f0
mov ecx, eax
call fcn.00419270
je 0x4136f2
mov dword [0x4b5001], 0x30001c9
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 8]
call fcn.0042c970
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0042c9a0
lea eax, [esp + 4]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001c9
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x41372b
mov dword [0x4b5001], 0x30001c9
push 0x4b8edc
push 0x24
push dword [esp + 0x54]
call fcn.0042d910
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001c9
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 8], eax
mov dword [0x4b5001], 0x30001c9
cmp dword [esp + 8], 0
je 0x413827
mov dword [0x4b5001], 0x30001c9
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4137c3
mov dword [0x4b5001], 0x30001c9
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b5001], 0x30001c9
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00414411
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001c9
cmp dword [esp + 0x14], 0
je 0x4137f1
mov dword [0x4b5001], 0x30001c9
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001c9
mov edx, 0x4b51b2
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
pop eax
push eax
call fcn.004192c0
pop edx
add eax, edx
jmp 0x4143ef
mov dword [0x4b5001], 0x30001c9
mov dword [0x4b5001], 0x30001cb
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
mov dword [0x4b5001], 0x30001cc
cmp dword [esp + 8], 0
je 0x41390e
mov dword [0x4b5001], 0x30001cd
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4138c5
mov dword [0x4b5001], 0x30001ce
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b5001], 0x30001cf
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00414411
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001d0
mov dword [0x4b5001], 0x30001d2
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x4b5001], 0x30001d3
mov edx, 0x4b51b2
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
pop eax
push eax
call fcn.004192c0
pop edx
add eax, edx
jmp 0x4143ef
mov dword [0x4b5001], 0x30001d4
mov dword [0x4b5001], 0x30001d6
cmp dword [esp + 0x20], 0
je 0x4139ef
mov dword [0x4b5001], 0x30001d7
push dword [esp + 0x20]
call fcn.0042d740
mov dword [esp + 0x1c], eax
mov dword [0x4b5001], 0x30001d8
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4139e5
mov dword [0x4b5001], 0x30001d9
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x41399c
mov dword [0x4b5001], 0x30001da
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov dword [0x4b5001], 0x30001db
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00419008
mov dword [0x4b5001], 0x30001dc
mov dword [0x4b5001], 0x30001de
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x4b5001], 0x30001df
mov edx, 0x4b51b2
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
pop eax
push eax
call fcn.004192c0
pop edx
add eax, edx
jmp 0x4143ef
mov dword [0x4b5001], 0x30001e0
mov dword [0x4b5001], 0x30001e1
mov dword [0x4b5001], 0x30001e3
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
mov dword [0x4b5001], 0x30001e4
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [0x4b5001], 0x30001e5
cmp dword [esp + 8], 0
je 0x413ae8
mov dword [0x4b5001], 0x30001e6
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x413a9f
mov dword [0x4b5001], 0x30001e7
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b5001], 0x30001e8
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0xc]
call fcn.00414411
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001e9
mov dword [0x4b5001], 0x30001eb
push dword [esp + 0x1c]
call fcn.0042d8d0
mov dword [0x4b5001], 0x30001ec
mov edx, 0x4b51b2
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
pop eax
push eax
call fcn.004192c0
pop edx
add eax, edx
jmp 0x4143ef
mov dword [0x4b5001], 0x30001ed
mov dword [0x4b5001], 0x30001ef
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x413b1a
mov dword [0x4b5001], 0x30001f0
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp], eax
mov dword [0x4b5001], 0x30001f1
mov dword [0x4b5001], 0x30001f3
push dword [esp + 0x18]
mov dword [0x4b5001], 0x30001f4
mov ebx, 3
cmp ebx, dword [esp]
jne 0x413de7
mov dword [0x4b5001], 0x30001f5
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x413c3f
mov dword [0x4b5001], 0x30001f6
mov dword [esp + 0x30], 0
jmp 0x413b82
mov dword [0x4b5001], 0x30001f6
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x413c30
mov dword [0x4b5001], 0x30001f7
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
mov edx, 0x4b5358
push edx
call fcn.0042e810
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
mov eax, 0x4b5522
push eax
push 2
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0042d920
cdq
push edx
push eax
call fcn.0042cd10
call fcn.004192d2
add dword [esp], edx
call fcn.0042d210
pop eax
mov edx, 0x4b5516
push edx
call fcn.0042e810
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001f8
inc dword [esp + 0x30]
jno 0x413b78
mov dword [0x4b5001], 0x30001f9
jmp 0x413d15
mov dword [0x4b5001], 0x30001f9
mov dword [0x4b5001], 0x30001fa
mov dword [esp + 0x30], 0
jmp 0x413c67
mov dword [0x4b5001], 0x30001fa
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x413d15
mov dword [0x4b5001], 0x30001fb
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
mov edx, 0x4b5358
push edx
call fcn.0042e810
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
mov eax, 0x4b5522
push eax
push 2
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.0042d920
cdq
push edx
push eax
call fcn.0042cd10
call fcn.004192d2
add dword [esp], edx
call fcn.0042d210
pop eax
mov edx, 0x4b5516
push edx
call fcn.0042e810
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001fc
inc dword [esp + 0x30]
jno 0x413c5d
mov dword [0x4b5001], 0x30001fd
mov dword [0x4b5001], 0x30001fe
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0042c970
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0042c9a0
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x30001ff
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x413d97
mov dword [0x4b5001], 0x3000200
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x1c], eax
mov dword [0x4b5001], 0x3000201
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b5001], 0x3000202
mov dword [0x4b5001], 0x3000203
push dword [esp + 0x54]
call fcn.004192b0
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
pop eax
push eax
call fcn.004192c0
pop edx
add eax, edx
add esp, 4
jmp 0x4143ef
mov dword [0x4b5001], 0x3000205
mov ebx, 4
cmp ebx, dword [esp]
jne 0x413e92
mov dword [0x4b5001], 0x3000206
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x413e43
mov dword [0x4b5001], 0x3000207
push dword [esp + 0x20]
pop eax
call fcn.00419230
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x10], eax
mov dword [0x4b5001], 0x3000208
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
mov dword [0x4b5001], 0x3000209
mov dword [0x4b5001], 0x300020a
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0x28]
pop eax
call fcn.00419230
cdq
push edx
push eax
call fcn.0042c6a0
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x300020c
jmp 0x414395
mov dword [0x4b5001], 0x300020c
mov ebx, 2
cmp ebx, dword [esp]
jne 0x414016
mov dword [0x4b5001], 0x300020d
push 0
push 0
push dword [esp + 0x28]
call dword [0x4fe85c]
mov dword [esp + 0x28], eax
mov dword [0x4b5001], 0x300020e
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x413ff3
mov dword [0x4b5001], 0x300020f
push dword [esp + 0x28]
call fcn.0042d740
mov dword [esp + 0x2c], eax
mov dword [0x4b5001], 0x3000210
cmp dword [esp + 0x2c], 0
je 0x413fdd
mov dword [0x4b5001], 0x3000211
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call dword [0x4fe85c]
and eax, eax
je 0x413fc0
mov dword [0x4b5001], 0x3000212
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0x34]
call fcn.0042d880
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000213
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x413fb6
mov dword [0x4b5001], 0x3000214
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000215
push dword [esp + 0x10]
call fcn.0042c970
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b5001], 0x3000216
mov dword [0x4b5001], 0x3000217
mov dword [0x4b5001], 0x3000218
push dword [esp + 0x2c]
call fcn.0042d8d0
mov dword [0x4b5001], 0x3000219
mov dword [0x4b5001], 0x300021a
jmp 0x413ffd
mov dword [0x4b5001], 0x300021a
mov dword [0x4b5001], 0x300021c
mov dword [0x4b5001], 0x300021e
jmp 0x414395
mov dword [0x4b5001], 0x300021e
mov ebx, 7
cmp ebx, dword [esp]
jne 0x414242
mov dword [0x4b5001], 0x300021f
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x41414c
mov dword [0x4b5001], 0x3000220
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.0042d930
call fcn.0042e900
mov edx, 0x4b51b2
pop ecx
push ecx
call fcn.004192f0
mov ecx, eax
call fcn.00419270
je 0x4140ca
mov dword [0x4b5001], 0x3000221
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
mov edx, 0x4b51dc
push edx
call fcn.0042e810
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000222
jmp 0x41411e
mov dword [0x4b5001], 0x3000222
mov dword [0x4b5001], 0x3000223
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.0042d930
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000224
mov dword [0x4b5001], 0x3000225
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
mov dword [0x4b5001], 0x3000226
jmp 0x41402e
mov dword [0x4b5001], 0x3000227
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.0042ca10
call fcn.0042e900
mov edx, 0x4b51dc
pop ecx
push ecx
call fcn.004192f0
mov ecx, eax
call fcn.00419270
je 0x4141c8
mov dword [0x4b5001], 0x3000228
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0042c970
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0042c9a0
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000229
mov dword [0x4b5001], 0x300022a
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x414229
mov dword [0x4b5001], 0x300022b
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x300022c
push dword [esp + 0x10]
call fcn.0042c970
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b5001], 0x300022d
mov dword [0x4b5001], 0x300022f
jmp 0x414395
mov dword [0x4b5001], 0x300022f
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4142ef
mov dword [0x4b5001], 0x3000230
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4142a2
mov dword [0x4b5001], 0x3000231
push dword [esp + 0x20]
call fcn.0042d9a0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov dword [0x4b5001], 0x3000232
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
mov dword [0x4b5001], 0x3000233
mov dword [0x4b5001], 0x3000234
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0042d9a0
push edx
push eax
call fcn.0042c6a0
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000236
jmp 0x414395
mov dword [0x4b5001], 0x3000236
mov ebx, 1
cmp ebx, dword [esp]
jne 0x414395
mov dword [0x4b5001], 0x3000237
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e7d0
pop edx
push eax
push dword [esp + 0x28]
call fcn.0042d880
lea eax, [esp + 0x14]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x3000238
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x41438b
mov dword [0x4b5001], 0x3000239
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.0042e870
mov dword [0x4b5001], 0x300023a
push dword [esp + 0x10]
call fcn.0042c970
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b5001], 0x300023b
mov dword [0x4b5001], 0x300023c
pop eax
mov dword [0x4b5001], 0x300023e
push dword [esp + 0x1c]
call fcn.0042d8d0
mov dword [0x4b5001], 0x3000240
mov edx, dword [esp + 0xc]
push edx
call fcn.0042e7d0
pop edx
push eax
push edx
call fcn.0042e810
pop eax
push eax
call fcn.004192c0
pop edx
add eax, edx
jmp 0x4143ef
push dword [esp]
call fcn.0042e9d0
push dword [esp + 0xc]
call fcn.0042e9d0
push dword [esp + 4]
call fcn.0042e9d0
add esp, 0x30
pop ebx
pop ebp
ret 0x14