Function at 0x413552
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x90
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x413558
call fcn.004310a0
push dword [esp + 0x25c]
call fcn.00430f40
mov edx, dword [esp + 0x24c]
lea ecx, [esp]
call fcn.0041e000
mov edx, dword [esp + 0x250]
lea ecx, [esp + 4]
call fcn.0041e000
mov edx, dword [esp + 0x258]
lea ecx, [esp + 8]
call fcn.0041e000
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov edx, 0x434032
lea ecx, [esp + 0x1c]
call fcn.0041e008
mov edx, 0x434032
lea ecx, [esp + 0x20]
call fcn.0041e008
mov dword [esp + 0x24], 0
call fcn.00430e40
push eax
push eax
push dword [esp + 8]
call fcn.0041e3c0
call fcn.00430ff0
mov edx, str.hklm
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x413613
mov dword [esp + 0x18], 0x80000002
jmp 0x4136f3
mov edx, str.hkcr
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x413638
mov dword [esp + 0x18], 0x80000000
jmp 0x4136f3
mov edx, str.hkcu
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41365d
mov dword [esp + 0x18], 0x80000001
jmp 0x4136f3
mov edx, 0x437e94
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41367f
mov dword [esp + 0x18], 0x80000003
jmp 0x4136f3
mov edx, str.hkcc
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x4136a1
mov dword [esp + 0x18], 0x80000005
jmp 0x4136f3
mov edx, str.hklm64
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x4136cb
mov dword [esp + 0x18], 0x80000002
mov dword [esp + 0x28], 0x100
jmp 0x4136f3
mov edx, str.hkcu64
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x4136f3
mov dword [esp + 0x18], 0x80000001
mov dword [esp + 0x28], 0x100
call fcn.00430f40
call fcn.00430e40
push eax
push eax
push 1
push dword [esp + 0x10]
call fcn.0041e7e0
call fcn.00430ff0
mov edx, 0x434770
call fcn.00431060
mov ecx, eax
call fcn.00431020
je 0x41374c
call fcn.00430e40
push eax
push eax
push dword [esp + 0xc]
call fcn.0041f200
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x10]
call fcn.0041e550
lea eax, [esp + 8]
push eax
call fcn.00430eb0
push dword [esp + 8]
mov edx, 0x434032
pop ecx
call fcn.00431020
je 0x41378b
lea eax, [esp + 0xc]
push eax
mov ebx, dword [esp + 0x28]
or ebx, 0x20019
push ebx
push 0
push dword [esp + 0x10]
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0x23c], eax
jmp 0x413810
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x18]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x23c], eax
mov ebx, dword [esp + 0x23c]
and ebx, ebx
je 0x4137f0
mov dword [esp + 0x18], 4
cmp dword [esp + 0x248], 0
je 0x4137d1
push dword [esp + 0x18]
mov eax, dword [esp + 0x24c]
call fcn.00430100
mov edx, 0x434032
call fcn.00430e40
push eax
call fcn.00430f90
pop eax
push eax
call fcn.00430e80
pop edx
add eax, edx
jmp 0x41391f
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push dword [esp + 0x10]
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x23c]
and ebx, ebx
jne 0x4138bf
mov dword [esp + 0x230], 0xff
lea eax, [esp + 0x234]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x240]
push eax
lea eax, [esp + 0x44]
push eax
mov ebx, dword [esp + 0x26c]
dec ebx
push ebx
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegEnumValueW
mov dword [esp + 0x23c], eax
mov ebx, dword [esp + 0x23c]
and ebx, ebx
jne 0x4138b5
mov dword [esp + 0x18], 0
call fcn.00430e40
push eax
push eax
push dword [esp + 0x238]
lea edx, [esp + 0x3c]
call fcn.00430e40
push eax
push 0x100
call fcn.004311a0
call fcn.00430e92
add dword [esp], edx
call fcn.0041e7e0
lea eax, [esp + 0x20]
push eax
call fcn.00430eb0
jmp 0x4138bd
mov dword [esp + 0x18], 2
jmp 0x4138c7
mov dword [esp + 0x18], 1
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x10], 0
je 0x4138e0
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x248], 0
je 0x4138fa
push dword [esp + 0x18]
mov eax, dword [esp + 0x24c]
call fcn.00430100
mov edx, dword [esp + 0x1c]
call fcn.00430e40
push eax
call fcn.00430f90
pop eax
push eax
call fcn.00430e80
pop edx
add eax, edx
jmp 0x41391f
push dword [esp + 8]
call fcn.00431170
push dword [esp + 0x20]
call fcn.00431170
push dword [esp + 0x1c]
call fcn.00431170
push dword [esp]
call fcn.00431170
push dword [esp + 4]
call fcn.00431170
add esp, 0x240
pop ebx
ret 0x14