Function at 0x402051
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x402058
call fcn.00436600
push dword [esp + 0x50]
call fcn.00419280
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00419000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00419000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x4020a9
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004340f0
call fcn.00436590
mov edx, 0x48b61e
pop ecx
push ecx
call fcn.00419230
mov ecx, eax
call fcn.00419240
je 0x402111
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 8]
call fcn.00434160
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00434190
lea eax, [esp + 4]
push eax
call fcn.004364a0
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00434190
call fcn.00436590
mov edx, 0x48b61e
pop ecx
push ecx
call fcn.00419230
mov ecx, eax
call fcn.00419240
je 0x402179
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 8]
call fcn.00434160
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004340f0
lea eax, [esp + 4]
push eax
call fcn.004364a0
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x402194
push 0x4925f0
push 0x24
push dword [esp + 0x54]
call fcn.004352f0
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x40221e
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4021ec
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040294d
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004364a0
cmp dword [esp + 0x14], 0
je 0x4021fc
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x48b02a
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
jmp 0x40292b
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x4022a7
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40227c
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040294d
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004364a0
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x48b02a
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
jmp 0x40292b
cmp dword [esp + 0x20], 0
je 0x402312
push dword [esp + 0x20]
call fcn.00435360
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x402312
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4022e7
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00419008
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, 0x48b02a
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
jmp 0x40292b
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 8], 0
je 0x4023a3
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x402378
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp + 8], eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0xc]
call fcn.0040294d
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.004364a0
push dword [esp + 0x1c]
call fcn.004354d0
mov edx, 0x48b02a
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
jmp 0x40292b
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4023b7
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop eax
mov dword [ebp], eax
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x402592
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x402477
mov dword [esp + 0x30], 0
jmp 0x4023e3
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x402472
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
mov eax, 0x48b41c
push eax
push 2
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004354f0
cdq
push edx
push eax
call fcn.00434510
call fcn.00419212
add dword [esp], edx
call fcn.00434590
pop eax
mov edx, 0x48b40c
push edx
call fcn.00436530
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
inc dword [esp + 0x30]
jno 0x4023e3
jmp 0x402510
mov dword [esp + 0x30], 0
jmp 0x402481
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x402510
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
mov eax, 0x48b41c
push eax
push 2
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004354f0
cdq
push edx
push eax
call fcn.00434510
call fcn.00419212
add dword [esp], edx
call fcn.00434590
pop eax
mov edx, 0x48b40c
push edx
call fcn.00436530
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
inc dword [esp + 0x30]
jno 0x402481
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0x18]
call fcn.00434160
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004340f0
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x402560
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x1c], eax
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x54]
call fcn.00419280
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
add esp, 4
jmp 0x40292b
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4025f3
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4025c2
push dword [esp + 0x20]
pop eax
call fcn.004191f0
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0x28]
pop eax
call fcn.004191f0
cdq
push edx
push eax
call fcn.00434680
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
jmp 0x4028f9
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4026bb
push 0
push 0
push dword [esp + 0x28]
call dword [0xdef754]
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x4026b6
push dword [esp + 0x28]
call fcn.00435360
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x4026b4
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call dword [0xdef754]
and eax, eax
je 0x4026ab
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0x34]
call fcn.00435500
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4026ab
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004364a0
push dword [esp + 0x10]
call fcn.00434160
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.004354d0
jmp 0x4026b6
jmp 0x4028f9
mov ebx, 7
cmp ebx, dword [esp]
jne 0x402833
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x40278d
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00435550
call fcn.00436590
mov edx, 0x48b02a
pop ecx
push ecx
call fcn.00419230
mov ecx, eax
call fcn.00419240
je 0x40273d
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
mov edx, 0x48b0a8
push edx
call fcn.00436530
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
jmp 0x40277d
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00435550
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
mov ebx, dword [esp + 0x30]
add ebx, 2
mov dword [esp + 0x30], ebx
jmp 0x4026c9
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00434190
call fcn.00436590
mov edx, 0x48b0a8
pop ecx
push ecx
call fcn.00419230
mov ecx, eax
call fcn.00419240
je 0x4027f5
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0x18]
call fcn.00434160
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004340f0
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x40282e
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004364a0
push dword [esp + 0x10]
call fcn.00434160
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
jmp 0x4028f9
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x402893
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x402867
push dword [esp + 0x20]
call fcn.004355c0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0x28]
call fcn.004355c0
push edx
push eax
call fcn.00434680
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
jmp 0x4028f9
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4028f9
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436460
pop edx
push eax
push dword [esp + 0x28]
call fcn.00435500
lea eax, [esp + 0x14]
push eax
call fcn.004364a0
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x4028f9
mov edx, dword [esp + 0x10]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.004364a0
push dword [esp + 0x10]
call fcn.00434160
push eax
mov ebp, dword [esp + 0x54]
pop eax
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.004354d0
mov edx, dword [esp + 0xc]
push edx
call fcn.00436460
pop edx
push eax
push edx
call fcn.00436530
pop eax
push eax
call fcn.00419200
pop edx
add eax, edx
jmp 0x40292b
push dword [esp]
call fcn.00436660
push dword [esp + 0xc]
call fcn.00436660
push dword [esp + 4]
call fcn.00436660
add esp, 0x30
pop ebx
pop ebp
ret 0x14