Function at 0x4102c7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4102cd
call fcn.004521e0
push dword [esp + 0x5c]
call fcn.00415460
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00415000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00415000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00415000
push dword [esp]
call fcn.00411966
push dword [esp + 8]
mov edx, 0x4a5b62
pop ecx
call fcn.004153f0
je 0x41037a
cmp dword [0x584364], 0
je 0x41035e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x58437c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x584344]
push dword [0x584360]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x410378
lea eax, [esp + 0x10]
push eax
push dword [0x584344]
push dword [0x584360]
call sub.ADVAPI32.DLL_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x4103df
lea eax, [esp + 0x18]
push eax
push dword [0x584360]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x584364], 0
je 0x4103c7
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x58437c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x584344]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4103df
lea eax, [esp + 0x10]
push eax
push dword [0x584344]
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4106b9
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452040
pop edx
push eax
push dword [esp + 0x24]
call fcn.0044fac0
lea eax, [esp + 0x24]
push eax
call fcn.004520e0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4106b9
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4104c0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4104ad
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452040
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00450950
lea eax, [esp + 0x30]
push eax
call fcn.004520e0
jmp 0x4104bb
mov edx, 0x4a5020
lea ecx, [esp + 0x2c]
call fcn.00415008
jmp 0x4106b8
mov ebx, 2
cmp ebx, dword [esp]
jne 0x410535
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x410522
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452040
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00450950
lea eax, [esp + 0x30]
push eax
call fcn.004520e0
jmp 0x410530
mov edx, 0x4a5020
lea ecx, [esp + 0x2c]
call fcn.00415008
jmp 0x4106b8
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4105a7
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x410594
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452040
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0044fef0
lea eax, [esp + 0x30]
push eax
call fcn.004520e0
jmp 0x4105a2
mov edx, 0x4a5bd8
lea ecx, [esp + 0x2c]
call fcn.00415008
jmp 0x4106b8
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4106b8
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00450f60
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4106b8
mov edx, 0x4a5020
lea ecx, [esp + 0x2c]
call fcn.00415008
mov dword [esp + 0x44], 0
jmp 0x410612
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x4106af
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.004153a0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x41066c
mov edx, dword [esp + 0x2c]
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452080
mov edx, 0x4a5bd8
push edx
call fcn.00452080
lea eax, [esp + 0x30]
push eax
call fcn.004520e0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452080
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452040
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0044f9a0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004520e0
inc dword [esp + 0x44]
jno 0x410612
push dword [esp + 0x3c]
call fcn.00451140
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00452040
pop edx
push eax
push edx
call fcn.00452080
pop eax
push eax
call fcn.00415430
pop edx
add eax, edx
jmp 0x4106ea
push dword [esp + 8]
call fcn.00452270
push dword [esp + 0x20]
call fcn.00452270
push dword [esp]
call fcn.00452270
push dword [esp + 4]
call fcn.00452270
push dword [esp + 0x28]
call fcn.00452270
add esp, 0x48
pop ebx
ret 0xc