Function at 0x4151c0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x51cd0c
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x569338]
xor eax, esp
mov dword [esp + 0x4a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x569338]
xor eax, esp
push eax
lea eax, [esp + 0x4c0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4d0]
mov edi, dword [esp + 0x4d4]
mov esi, edx
lea edx, [esp + 0x30]
xor ebp, ebp
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebp
call fcn.0040c9d0
mov ebx, 8
add esp, 4
cmp dword [eax + 0x18], ebx
jb 0x415235
mov eax, dword [eax + 4]
jmp 0x415238
add eax, 4
lea ecx, [esp + 0x1c]
push ecx
push 0x109
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [esp + 0x48], ebx
mov esi, eax
jb 0x415260
mov edx, dword [esp + 0x34]
push edx
call fcn.0042d197
add esp, 4
cmp esi, ebp
je 0x41526b
xor eax, eax
jmp 0x415649
mov ecx, edi
mov dword [esp + 0x24], ebp
call fcn.00420100
test eax, eax
jbe 0x415639
mov edi, edi
mov eax, dword [esp + 0x24]
push eax
mov eax, edi
call fcn.004203a0
mov esi, eax
mov al, byte [esi + 8]
test al, al
je 0x415639
cmp al, 7
jne 0x415639
push 0x560c94
mov eax, esi
call fcn.004205f0
mov edi, eax
push str.type
mov eax, esi
call fcn.004205f0
mov ebp, eax
push str.value
mov eax, esi
call fcn.004205f0
mov ebx, eax
mov al, byte [edi + 8]
test al, al
je 0x415639
cmp al, 4
jne 0x415639
mov al, byte [ebp + 8]
test al, al
je 0x4152e9
cmp al, 4
je 0x4152f8
mov al, byte [ebx + 8]
test al, al
je 0x4152f8
cmp al, 4
je 0x415639
lea esi, [esp + 0x30]
mov ecx, edi
call fcn.0041fa80
lea ecx, [esp + 0x84]
push ecx
xor esi, esi
mov ecx, eax
mov dword [esp + 0x4cc], esi
call fcn.0040c9d0
add esp, 4
mov byte [esp + 0x4c8], 2
cmp dword [esp + 0x48], 0x10
jb 0x41533a
mov edx, dword [esp + 0x34]
push edx
call fcn.0042d197
add esp, 4
mov al, byte [ebp + 8]
test al, al
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], esi
mov byte [esp + 0x34], 0
je 0x415361
cmp al, 4
jne 0x415361
mov al, byte [ebx + 8]
test al, al
je 0x415361
cmp al, 4
je 0x415398
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x415379
lea eax, [esp + 0x88]
push esi
push esi
push esi
push esi
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41562d
mov eax, dword [esp + 0x20]
add dword [eax], 1
mov dword [esp + 0x18], esi
lea esi, [esp + 0x68]
mov ecx, ebp
call fcn.0041fa80
mov ecx, str.REG_SZ
mov edi, esi
mov byte [esp + 0x4c8], 3
call fcn.00408340
test al, al
je 0x4153cc
mov dword [esp + 0x18], 1
jmp 0x41551e
mov ecx, str.REG_EXPAND_SZ
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x4153eb
mov dword [esp + 0x18], 2
jmp 0x41551e
mov ecx, str.REG_BINARY
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x41540a
mov dword [esp + 0x18], 3
jmp 0x41551e
mov ecx, str.REG_DWORD
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x415429
mov dword [esp + 0x18], 4
jmp 0x41551e
mov ecx, str.REG_DWORD_LITTLE_ENDIAN
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x415448
mov dword [esp + 0x18], 4
jmp 0x41551e
mov ecx, str.REG_DWORD_BIG_ENDIAN
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x415467
mov dword [esp + 0x18], 5
jmp 0x41551e
mov ecx, str.REG_LINK
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x415486
mov dword [esp + 0x18], 6
jmp 0x41551e
mov ecx, str.REG_MULTI_SZ
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x4154a2
mov dword [esp + 0x18], 7
jmp 0x41551e
mov ecx, str.REG_RESOURCE_LIST
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x4154be
mov dword [esp + 0x18], 8
jmp 0x41551e
mov ecx, str.REG_FULL_RESOURCE_DESCRIPTOR
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x4154da
mov dword [esp + 0x18], 9
jmp 0x41551e
mov ecx, str.REG_RESOURCE_REQUIREMENTS_LIST
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
je 0x4154f6
mov dword [esp + 0x18], 0xa
jmp 0x41551e
mov ecx, str.REG_QWORD
lea edi, [esp + 0x68]
call fcn.00408340
test al, al
jne 0x415516
mov ecx, str.REG_QWORD_LITTLE_ENDIAN
call fcn.00408340
test al, al
je 0x41551e
mov dword [esp + 0x18], 0xb
push 0x3fe
lea ecx, [esp + 0xc2]
push 0
push ecx
mov word [esp + 0xc8], 0
call fcn.00433df0
add esp, 0xc
lea esi, [esp + 0x4c]
mov ecx, ebx
mov dword [esp + 0x2c], 0x200
call fcn.0041fa80
lea edx, [esp + 0xa0]
push edx
mov ecx, eax
mov byte [esp + 0x4cc], 4
call fcn.0040c9d0
add esp, 4
mov ecx, esi
mov byte [esp + 0x4c8], 3
call fcn.004056f0
mov eax, dword [esp + 0x18]
cmp eax, 2
je 0x415673
cmp eax, 1
je 0x415673
cmp eax, 7
je 0x415673
cmp eax, 4
je 0x4155a4
cmp eax, 3
jne 0x415618
mov eax, dword [esp + 0x88]
mov edi, 8
cmp dword [esp + 0x9c], edi
jae 0x4155c0
lea eax, [esp + 0x88]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4156ea
cmp dword [esp + 0xb8], edi
movsx esi, word [esp + 0xbc]
mov eax, dword [esp + 0xa4]
jae 0x415607
lea eax, [esp + 0xa4]
push eax
call fcn.0042d47b
add esp, 4
cmp eax, esi
je 0x4156e3
lea ecx, [esp + 0xa0]
call fcn.004022c0
lea ecx, [esp + 0x68]
call fcn.004056f0
lea ecx, [esp + 0x84]
call fcn.004022c0
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x4c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a8]
xor ecx, esp
call fcn.0042d085
add esp, 0x4b8
ret 8
mov eax, dword [esp + 0x88]
mov esi, 8
cmp dword [esp + 0x9c], esi
jae 0x41568f
lea eax, [esp + 0x88]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4156ea
cmp dword [esp + 0xb8], esi
mov eax, dword [esp + 0xa4]
jae 0x4156ca
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0042d19c
add esp, 8
test eax, eax
je 0x415618
mov eax, dword [esp + 0x20]
add dword [eax], 1
lea ecx, [esp + 0xa0]
call fcn.004022c0
lea ecx, [esp + 0x68]
call fcn.004056f0
lea ecx, [esp + 0x84]
mov dword [esp + 0x4c8], 0xffffffff
call fcn.004022c0
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esi, 1
mov dword [esp + 0x24], esi
call fcn.00420100
cmp esi, eax
jae 0x415639
mov edi, dword [esp + 0x28]
jmp 0x415280