Function at 0x4137f5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x20], edi
call fcn.0056d061
test eax, eax
jne 0x413b36
call fcn.0056ce24
test eax, eax
jne 0x413b36
mov dl, 1
mov ecx, ebx
call fcn.00413ff7
test al, al
jne 0x413b36
xor eax, eax
mov esi, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
mov byte [esp + 0x13], al
cmp dword [0x6e4b28], eax
je 0x413862
push 0x6cee28
mov byte [esp + 0x17], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov ecx, dword [ebx + 0xc]
lea edx, [esp + 0x14]
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
movzx eax, word [ebx + 0x10]
shr eax, 1
and eax, 0x10
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00412cfe
test eax, eax
jne 0x4139fe
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x4138a0
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push 0
lea ecx, [esp + 0x30]
push ecx
push 0
push dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x413907
cmp dword [esp + 0x18], eax
je 0x413907
push dword [esp + 0x18]
lea ecx, [esp + 0x28]
call fcn.0040fa23
test al, al
jne 0x4138dd
mov esi, dword [esp + 0x24]
push 8
pop edi
jmp 0x413907
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x4138eb
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push esi
lea ecx, [esp + 0x30]
push ecx
push 0
push dword [ebx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, edi
call fcn.004129b9
test eax, eax
je 0x41395c
mov eax, dword [ebx + 0xc]
xor edi, edi
push dword [esp + 0x14]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x6c2310], edi
call fcn.00412b66
movzx eax, word [ebx + 0x10]
lea edx, [esp + 0x14]
mov ecx, dword [ebx + 0xc]
shr eax, 1
push edi
and eax, 0x10
mov dword [esp + 0x18], edi
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00412cfe
mov edi, eax
test edi, edi
je 0x41388e
jmp 0x413965
mov ecx, dword [esp + 0x14]
call fcn.00412c70
test edi, edi
jne 0x4139fa
test esi, esi
je 0x4139fa
movzx eax, word [ebx + 0x10]
and eax, 0xf
cmp dword [esp + 0x28], eax
jne 0x4139ce
dec eax
cmp eax, 1
ja 0x4139d5
mov eax, dword [esp + 0x18]
shr eax, 1
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4139c1
test dx, dx
je 0x4139bd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4139c1
add eax, 4
add ecx, 4
test dx, dx
jne 0x41399b
xor eax, eax
jmp 0x4139c6
sbb eax, eax
or eax, 1
test eax, eax
je 0x413af1
push 0
jmp 0x413ac1
mov eax, dword [ebp + 8]
cmp dword [esp + 0x18], eax
jne 0x4139ce
push dword [esp + 0x18]
push dword [esp + 0x24]
push esi
call fcn.0057687a
add esp, 0xc
test eax, eax
jne 0x4139ce
xor edi, edi
jmp 0x413af1
mov edi, dword [esp + 0x20]
mov ecx, dword [ebx + 4]
cmp ecx, 0xcccccccc
je 0x4139ce
movzx eax, word [ebx + 0x10]
and eax, 0xf
jle 0x413a5f
cmp eax, 2
jle 0x413a4b
cmp eax, 4
je 0x413a37
cmp eax, 0xb
jne 0x413a5f
cmp dword [ebp + 8], 8
jne 0x413b41
cmp dword [edi], ecx
jne 0x4139ce
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jmp 0x4139f1
cmp dword [ebp + 8], 4
je 0x413a47
push 0x59948e
jmp 0x413b46
cmp dword [edi], ecx
jmp 0x4139f1
cmp dword [ebp + 8], 2
jae 0x413a5b
push 0x59948d
jmp 0x413b46
cmp ecx, edi
jmp 0x4139f1
push 0x599491
jmp 0x413b46
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x413a77
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push dword [ebp + 8]
movzx eax, word [ebx + 0x10]
push dword [esp + 0x24]
and eax, 0xf
push eax
push 0
push dword [ebx]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov ecx, edi
call fcn.004129b9
test eax, eax
je 0x413b1b
mov eax, dword [ebx + 0xc]
xor edi, edi
push dword [esp + 0x14]
movzx eax, word [eax + 6]
and eax, 0xf
imul eax, eax, 0xc
mov dword [eax + 0x6c2310], edi
call fcn.00412b66
mov dword [esp + 0x14], edi
push edi
movzx eax, word [ebx + 0x10]
lea edx, [esp + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, 0x20
or eax, 8
shr eax, 1
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00412cfe
mov edi, eax
test edi, edi
je 0x413a69
mov edx, str.OrapiWriteFail:_CacheKey_in_WriteValue
mov ecx, edi
call fcn.004137cd
cmp dword [0x6e4b28], 0
je 0x413b0c
cmp byte [esp + 0x13], 0
je 0x413b0c
push 0x6cee28
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x413b17
push esi
call fcn.0056eede
pop ecx
mov eax, edi
jmp 0x413b38
test edi, edi
je 0x413b2b
mov edx, str.OrapiWriteFail:_RegSetValueExW
mov ecx, edi
call fcn.004137cd
mov ecx, dword [esp + 0x14]
call fcn.00412c70
jmp 0x413af1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x59948f
call fcn.0056c1fd
int3