Function at 0x415518
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
xor edx, edx
push esi
push edi
inc edx
mov dword [ebp - 0x10], ebx
mov ecx, 0x40683c
mov dword [ebp - 0xc], ebx
mov esi, ebx
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 0x14], ebx
call fcn.0041a268
cmp dword [ebp + 8], ebx
jne 0x415558
mov ecx, 0x80070057
mov ebx, ecx
call fcn.00419094
jmp 0x415756
cmp dword [ebp + 0xc], ebx
je 0x415547
lea eax, [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
push eax
push 0x20019
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x28], ebx
push 0x80000002
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x14]
mov ecx, eax
call fcn.00418e0f
test eax, eax
jne 0x41559f
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
jmp 0x41554e
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea edx, [ebp - 0x14]
mov ecx, eax
call fcn.00418e0f
test eax, eax
je 0x415598
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
xor edx, edx
push eax
inc edx
call fcn.004225ae
mov ebx, eax
test ebx, ebx
js 0x41559b
mov ecx, dword [ebp - 4]
xor ebx, ebx
test ecx, ecx
je 0x415606
lea edx, [ecx + ecx]
mov eax, edx
shr eax, 1
cmp eax, ecx
je 0x415601
mov ebx, 0x80070216
mov ecx, ebx
call fcn.00419094
jmp 0x41560b
mov dword [ebp - 4], edx
jmp 0x41560b
and dword [ebp - 4], ebx
xor ebx, ebx
mov ecx, ebx
call fcn.004190b1
test ebx, ebx
js 0x41559b
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x415638
mov ecx, 0x8007000e
jmp 0x41554c
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x41562e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
and dword [ebp - 0x1c], 0
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push esi
push ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x41571a
mov ecx, dword [ebp - 0x1c]
dec ecx
je 0x4156c3
dec ecx
je 0x4156c3
dec ecx
dec ecx
jne 0x41571a
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00418e2d
mov ebx, eax
test ebx, ebx
js 0x41559b
push dword [edi]
lea eax, [ebp - 8]
push 0x40687c
push eax
call fcn.00414b49
add esp, 0xc
jmp 0x4156e1
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00418e2d
mov ebx, eax
test ebx, ebx
js 0x41559b
lea edx, [ebp - 8]
mov ecx, edi
call fcn.00418e2d
mov ebx, eax
test ebx, ebx
js 0x41559b
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ecx + 4]
call fcn.0041a3cf
test eax, eax
jne 0x415717
push dword [ebp - 8]
push dword [ebp - 0xc]
push 2
push 0x406720
call fcn.0041a171
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
test eax, eax
je 0x415653
cmp eax, 0x103
je 0x415749
test eax, eax
jg 0x41573b
mov ebx, eax
jmp 0x41559b
movzx ebx, ax
or ebx, 0x80070000
jmp 0x41559b
xor edx, edx
mov ecx, 0x406884
inc edx
call fcn.0041a268
mov ecx, ebx
call fcn.004190b1
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x415769
call fcn.00418f57
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x415775
call fcn.00418f57
test edi, edi
je 0x415789
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x41579d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x10], 0
je 0x4157ac
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8