Function at 0x416116
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x43c
mov eax, 0x43c3db
call fcn.0043a0ca
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
xor edi, edi
inc edi
mov dword [ebp - 4], edi
mov byte [ebp - 0x43c], bl
mov eax, dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], ebx
push 2
pop ecx
mov dword [ebp - 0x428], ecx
mov eax, ecx
mov dword [ebp - 0x428], eax
and eax, 0xfffffffd
mov dword [ebp - 0x428], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], edi
mov byte [ebp - 4], cl
lea eax, [ebp - 0x424]
push eax
push edi
push ebx
push 0x402d4c
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x4163f7
mov dword [ebp - 0x41c], 0x400
push 0x402
push ebx
lea eax, [ebp - 0x418]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x402b78
mov edx, 0x402
lea ecx, [ebp - 0x418]
call fcn.00416b73
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push 0x402d88
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x41622e
mov eax, dword [ebp - 0x41c]
and eax, 0xfffffffe
cmp eax, 0x402
jae 0x416356
xor ecx, ecx
mov word [ebp + eax - 0x418], cx
push 0x402d98
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41632f
mov dword [esi], edi
push 2
pop edi
mov dword [ebp - 0x420], ebx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x448]
call fcn.00416a92
mov byte [ebp - 4], 3
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push ebx
push 0x402da0
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x41637f
mov eax, dword [ebp - 0x41c]
inc eax
xor ecx, ecx
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004398b6
pop ecx
mov dword [ebp - 0x420], eax
test eax, eax
je 0x41637f
lea ecx, [ebp - 0x41c]
push ecx
push eax
push ebx
push ebx
push 0x402da0
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x41637f
mov ecx, dword [ebp - 0x41c]
shr ecx, 1
xor edx, edx
mov eax, dword [ebp - 0x420]
mov word [eax + ecx*2], dx
cmp dword [esi + 4], edx
je 0x4162df
push dword [esi + 4]
call sub.msvcrt.dll_free
pop ecx
mov dword [esi + 4], ebx
mov ecx, dword [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x4162e8
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004398b6
pop ecx
mov ecx, eax
mov dword [esi + 4], ecx
test ecx, ecx
jne 0x41635b
mov dword [ebp - 0x42c], 0xbbef
push 0x447c48
lea eax, [ebp - 0x42c]
push eax
call sub.msvcrt.dll__CxxThrowException
push 0x402d9c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
neg eax
sbb eax, eax
and eax, 0xfffffffe
push 2
pop edi
add eax, edi
mov dword [esi], eax
jmp 0x416231
call fcn.00439e83
mov edx, dword [ebp - 0x420]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x416364
sub edx, edi
sar edx, 1
push dword [ebp - 0x420]
inc edx
call fcn.004121d8
mov dword [ebp - 0x41c], 0x400
xor eax, eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push 0x402dc4
push dword [ebp - 0x424]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x4163e6
mov eax, dword [ebp - 0x41c]
and eax, 0xfffffffe
cmp eax, 0x402
jae 0x416356
xor ecx, ecx
mov word [ebp + eax - 0x418], cx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
cdq
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
push 2
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x448]
call fcn.00416a3f
or dword [ebp - 4], 0xffffffff
push ebx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
call fcn.0043a01c
ret