Function at 0x117dd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x117dd8
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1180de
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x1180f4
call fcn.00013c90
lea eax, [ebp - 0x14]
mov edx, 6
call fcn.0002aea4
xor eax, eax
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x118056
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x24]
call fcn.00025330
mov eax, dword [ebp - 0x24]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
cmp dword [ebp - 0x10], 0
je 0x118003
mov dword [ebp - 0x18], 6
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1180fc
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0x117faa
cmp dword [ebp - 0xc], 3
jne 0x117faa
cmp dword [ebp - 0x18], 6
jne 0x117faa
xor ebx, ebx
xor esi, esi
mov eax, 1
jmp 0x117ec2
mov edx, dword [ebp - 0x14]
movzx esi, byte [edx + eax - 1]
cmp esi, 1
jl 0x117ebf
cmp esi, 6
jle 0x117ec1
mov ebx, eax
inc eax
cmp eax, 6
jg 0x117ecb
test ebx, ebx
je 0x117ead
test ebx, ebx
jne 0x117f6d
mov eax, 1
lea edx, [ebp - 0x1e]
mov byte [edx], al
inc eax
inc edx
cmp eax, 7
jne 0x117edb
mov eax, 1
mov ebx, 6
lea edx, [ebp - 0x1e]
mov ecx, dword [ebp - 0x14]
mov cl, byte [ecx + eax - 1]
cmp cl, byte [edx]
jne 0x117eff
mov byte [edx], 0
inc edx
dec ebx
jne 0x117ef1
inc eax
cmp eax, 7
jne 0x117ee9
xor ebx, ebx
xor esi, esi
mov eax, 1
jmp 0x117f20
movzx esi, byte [ebp + eax - 0x1f]
test esi, esi
je 0x117f1f
mov ebx, eax
inc eax
cmp eax, 6
jg 0x117f29
test ebx, ebx
je 0x117f14
test ebx, ebx
jne 0x117f44
mov edx, 0x2a82dc
mov eax, dword [ebp - 0x14]
mov ecx, 6
call fcn.00012840
jmp 0x118027
push ebp
lea edx, [ebp - 0x2c]
mov eax, esi
call fcn.00033438
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x118118
call fcn.00013f18
mov eax, dword [ebp - 0x28]
call fcn.00117cb0
pop ecx
jmp 0x118027
push ebp
push 0x118130
lea edx, [ebp - 0x34]
mov eax, ebx
call fcn.00033438
push dword [ebp - 0x34]
push 0x118148
lea edx, [ebp - 0x38]
mov eax, esi
call fcn.00033438
push dword [ebp - 0x38]
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00013f8c
mov eax, dword [ebp - 0x30]
call fcn.00117cb0
pop ecx
jmp 0x118027
push ebp
push 0x118154
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.00033468
push dword [ebp - 0x40]
push 0x11816c
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x44]
call fcn.00033468
push dword [ebp - 0x44]
push 0x118148
lea edx, [ebp - 0x48]
mov eax, ebx
call fcn.0002b100
push dword [ebp - 0x48]
lea eax, [ebp - 0x3c]
mov edx, 6
call fcn.00013f8c
mov eax, dword [ebp - 0x3c]
call fcn.00117cb0
pop ecx
jmp 0x118027
push ebp
lea edx, [ebp - 0x50]
mov eax, ebx
call fcn.0002b100
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x118178
call fcn.00013f18
mov eax, dword [ebp - 0x4c]
call fcn.00117d40
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x11805d
cmp dword [ebp - 0x10], 0
je 0x118043
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, 6
call fcn.0002aecc
ret