Function at 0x418880
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5428
call fcn.00430ae0
mov eax, dword [0x448034]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [0x44cc88]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x5424], eax
test esi, esi
jne 0x4188de
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4188d8
push str.RegLoadMUIStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x44cc88], esi
jmp 0x4188de
mov esi, dword [0x44cc88]
xor eax, eax
push 0x4ffe
push eax
mov word [ebp - 0x5414], ax
lea eax, [ebp - 0x5412]
push eax
mov dword [ebp - 0x5418], 0x2800
call sub.MSVCR110.dll_memset
add esp, 0xc
test esi, esi
je 0x418998
push 0
push 1
push 0
push 0x5000
lea eax, [ebp - 0x5414]
push eax
push dword [ebp - 0x5424]
push ebx
call esi
test eax, eax
jne 0x418998
mov eax, dword [ebp - 0x5418]
lea eax, [eax*2 - 2]
cmp eax, 0x5000
jae 0x418bb4
xor ecx, ecx
mov word [ebp + eax - 0x5414], cx
cmp word [ebp - 0x5414], cx
jne 0x41896c
push ecx
lea eax, [ebp - 0x5414]
push eax
mov ecx, edi
call fcn.00402fc0
jmp 0x418b9f
lea ecx, [ebp - 0x5414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418975
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x5414]
push eax
mov ecx, edi
call fcn.00402fc0
jmp 0x418b9f
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x541c]
push eax
push 0
push dword [ebp - 0x5424]
mov dword [ebp - 0x5418], 0x410
push ebx
mov dword [ebp - 0x541c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418a07
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [ebp - 0x414]
cmp ax, 0x40
je 0x418a63
test ax, ax
jne 0x418a2f
xor ecx, ecx
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.00402fc0
jmp 0x418b9f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
jmp 0x418a40
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418a40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.00402fc0
jmp 0x418b9f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418a70
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x412]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.MSVCR110.dll_memmove]
lea eax, [ebp - 0x414]
push 0x2d
push eax
call dword [sym.imp.MSVCR110.dll_wcsrchr]
add esp, 0x14
test eax, eax
je 0x418b55
add eax, 2
push eax
call dword [sym.imp.MSVCR110.dll__wtoi]
mov dword [ebp - 0x5428], eax
lea eax, [ebp - 0x414]
push 0x2c
push eax
call dword [sym.imp.MSVCR110.dll_wcschr]
add esp, 0xc
test eax, eax
je 0x418adc
xor ecx, ecx
mov word [eax], cx
push 0x22
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
je 0x418b55
push 0x2800
lea eax, [ebp - 0x5414]
push eax
push dword [ebp - 0x5428]
push esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
push esi
setg byte [ebp - 0x541d]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [ebp - 0x541d], 0
je 0x418b55
xor eax, eax
mov word [ebp - 0x416], ax
lea eax, [ebp - 0x5414]
push eax
mov ecx, edi
call fcn.00406450
mov al, byte [ebp - 0x541d]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp - 0x5418]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x541c]
push eax
push 0
push dword [ebp - 0x5424]
mov dword [ebp - 0x5418], 0x410
push ebx
mov dword [ebp - 0x541c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418b9f
lea eax, [ebp - 0x414]
push eax
mov ecx, edi
call fcn.00406450
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0042ef5e
mov esp, ebp
pop ebp
ret 0xc
call fcn.0042f1f4
int3