Function at 0x41dd4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41dd53
call fcn.00465f10
push dword [esp + 0x5c]
call fcn.004236d0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00423000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00423000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00423000
push dword [esp]
call fcn.0041f3ec
push dword [esp + 8]
mov edx, 0x4ffc72
pop ecx
call fcn.00423660
je 0x41de00
cmp dword [0x6719d0], 0
je 0x41dde4
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x6719e8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x6719b0]
push dword [0x6719cc]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41ddfe
lea eax, [esp + 0x10]
push eax
push dword [0x6719b0]
push dword [0x6719cc]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x41de65
lea eax, [esp + 0x18]
push eax
push dword [0x6719cc]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x6719d0], 0
je 0x41de4d
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x6719e8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x6719b0]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41de65
lea eax, [esp + 0x10]
push eax
push dword [0x6719b0]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41e13f
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push dword [esp + 0x24]
call fcn.00463790
lea eax, [esp + 0x24]
push eax
call fcn.00465e10
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41e13f
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x41df46
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41df33
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00464530
lea eax, [esp + 0x30]
push eax
call fcn.00465e10
jmp 0x41df41
mov edx, 0x4ff050
lea ecx, [esp + 0x2c]
call fcn.00423008
jmp 0x41e13e
mov ebx, 2
cmp ebx, dword [esp]
jne 0x41dfbb
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41dfa8
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00464530
lea eax, [esp + 0x30]
push eax
call fcn.00465e10
jmp 0x41dfb6
mov edx, 0x4ff050
lea ecx, [esp + 0x2c]
call fcn.00423008
jmp 0x41e13e
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41e02d
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41e01a
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00463eb0
lea eax, [esp + 0x30]
push eax
call fcn.00465e10
jmp 0x41e028
mov edx, 0x4ffd0c
lea ecx, [esp + 0x2c]
call fcn.00423008
jmp 0x41e13e
mov ebx, 3
cmp ebx, dword [esp]
jne 0x41e13e
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00464be0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41e13e
mov edx, 0x4ff050
lea ecx, [esp + 0x2c]
call fcn.00423008
mov dword [esp + 0x44], 0
jmp 0x41e098
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x41e135
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.00423610
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x41e0f2
mov edx, dword [esp + 0x2c]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, 0x4ffd0c
push edx
call fcn.00465db0
lea eax, [esp + 0x30]
push eax
call fcn.00465e10
mov edx, dword [esp + 0x2c]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00463670
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.00465e10
inc dword [esp + 0x44]
jno 0x41e098
push dword [esp + 0x3c]
call fcn.00464dc0
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
pop eax
push eax
call fcn.004236a0
pop edx
add eax, edx
jmp 0x41e170
push dword [esp + 8]
call fcn.00465fa0
push dword [esp + 0x20]
call fcn.00465fa0
push dword [esp]
call fcn.00465fa0
push dword [esp + 4]
call fcn.00465fa0
push dword [esp + 0x28]
call fcn.00465fa0
add esp, 0x48
pop ebx
ret 0xc