Function at 0x40aea6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40aeac
call fcn.00420660
push dword [esp + 0x4c]
call fcn.0040e240
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.0040e000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.0040e000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 8]
call fcn.0040e000
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0041ea80
call fcn.004205f0
mov edx, 0x4771ce
call fcn.0040e250
mov ecx, eax
call fcn.0040e1d0
je 0x40af53
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push dword [esp + 8]
call fcn.0041e830
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0041eaf0
lea eax, [esp + 4]
push eax
call fcn.00420500
push dword [esp + 8]
mov edx, 0x477028
pop ecx
call fcn.0040e1d0
je 0x40af86
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x40afbc
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x40]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x38]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40b109
mov dword [esp + 0x1c], 0xff
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
push 0xff
call fcn.0041e310
lea eax, [esp + 0x18]
push eax
call fcn.00420500
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40b109
push dword [esp + 0x20]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40b09b
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40b08b
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x24]
call fcn.0041ea80
lea eax, [esp + 0x34]
push eax
call fcn.00420500
jmp 0x40b099
mov edx, 0x477028
lea ecx, [esp + 0x30]
call fcn.0040e008
jmp 0x40b108
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40b108
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40b0fa
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.004204c0
pop edx
push eax
mov eax, dword [esp + 0x24]
cdq
push edx
push eax
call fcn.0041ed60
lea eax, [esp + 0x34]
push eax
call fcn.00420500
jmp 0x40b108
mov edx, 0x47707a
lea ecx, [esp + 0x30]
call fcn.0040e008
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x2c]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
pop eax
push eax
call fcn.0040e210
pop edx
add eax, edx
jmp 0x40b13a
push dword [esp + 8]
call fcn.004206f0
push dword [esp + 0x14]
call fcn.004206f0
push dword [esp + 4]
call fcn.004206f0
push dword [esp]
call fcn.004206f0
push dword [esp + 0x2c]
call fcn.004206f0
add esp, 0x34
pop ebx
ret 0x10