Function at 0x1b41c174
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x1b44b010]
xor eax, esp
mov dword [esp + 0x43c], eax
mov ecx, dword [esp + 0x450]
mov edx, dword [esp + 0x454]
mov eax, dword [esp + 0x448]
push ebx
mov ebx, dword [esp + 0x448]
push ebp
mov ebp, dword [esp + 0x454]
push esi
xor esi, esi
cmp dword [0x1b44b540], esi
push edi
mov edi, dword [esp + 0x468]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
je 0x1b4235b8
push edi
push edx
push ecx
push ebp
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov ecx, dword [esp + 0x44c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1b41133e
add esp, 0x440
ret 0x18
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x240]
mov dword [esp + 0x240], esi
mov dword [esp + 0x244], esi
call fcn.1b43cfe7
mov edx, dword [esp + 0x23c]
lea eax, [esp + 0x10]
push eax
push esi
lea ecx, [esp + 0x24]
push ecx
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x1b42373b
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x1b42371e
cmp eax, 2
jbe 0x1b42369e
cmp eax, 7
jne 0x1b42371e
mov eax, dword [edi]
mov ecx, dword [esp + 0x18]
shr eax, 1
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.1b43d2b4
mov edx, dword [esp + 0x234]
lea eax, [edx + edx]
mov edx, dword [esp + 0x24]
shr eax, 1
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x240]
push edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push eax
push ebp
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
lea edx, [eax + eax]
mov dword [edi], edx
je 0x1b423677
lea ecx, [esp + 0x20]
call fcn.1b43d32a
jmp 0x1b42373b
cmp dword [esp + 0x24], 0
je 0x1b42368c
push eax
lea ecx, [esp + 0x24]
call fcn.1b43d156
mov dword [esp + 0x10], eax
add eax, eax
lea ecx, [esp + 0x20]
mov dword [edi], eax
call fcn.1b43d32a
jmp 0x1b42373b
mov ecx, dword [edi]
mov edx, dword [esp + 0x18]
shr ecx, 1
push ecx
push edx
lea ecx, [esp + 0x28]
call fcn.1b43d2b4
mov eax, dword [esp + 0x234]
lea ecx, [eax + eax]
mov eax, dword [esp + 0x24]
shr ecx, 1
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x240]
push eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
push ecx
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
lea ecx, [eax + eax]
mov dword [edi], ecx
je 0x1b4236fa
lea ecx, [esp + 0x20]
call fcn.1b43d32a
jmp 0x1b42373b
cmp dword [esp + 0x24], 0
je 0x1b42370e
lea ecx, [esp + 0x20]
call fcn.1b43d0ed
mov dword [esp + 0x10], eax
lea edx, [eax + eax]
lea ecx, [esp + 0x20]
mov dword [edi], edx
call fcn.1b43d32a
jmp 0x1b42373b
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x23c]
push edi
push eax
push ecx
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x23c]
lea ecx, [esp + 0x240]
cmp eax, ecx
je 0x1b41c1da
mov edx, eax
shr edx, 0x10
je 0x1b41c1da
cmp dword [esp + 0x238], 0xffffffff
je 0x1b41c1da
push eax
call fcn.1b41b03d
add esp, 4
jmp 0x1b41c1da