Function at 0x451c7b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x451c81
call fcn.004ae590
push dword [esp + 0x5c]
call fcn.004543a0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00454000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00454000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00454000
push dword [esp]
call fcn.00452328
push dword [esp + 8]
mov edx, 0x539664
pop ecx
call fcn.00454330
je 0x451d2e
cmp dword [0x15e8bf0], 0
je 0x451d12
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x15e8bf4]
or ebx, 0xf003f
push ebx
push 0
push dword [0x15e8be4]
push dword [0x15e8bec]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x451d2c
lea eax, [esp + 0x10]
push eax
push dword [0x15e8be4]
push dword [0x15e8bec]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x451d93
lea eax, [esp + 0x18]
push eax
push dword [0x15e8bec]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x15e8bf0], 0
je 0x451d7b
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x15e8bf4]
or ebx, 0xf003f
push ebx
push 0
push dword [0x15e8be4]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x451d93
lea eax, [esp + 0x10]
push eax
push dword [0x15e8be4]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x45206d
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae3f0
pop edx
push eax
push dword [esp + 0x24]
call fcn.004abe40
lea eax, [esp + 0x24]
push eax
call fcn.004ae430
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x45206d
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x451e74
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x451e61
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae3f0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004ac920
lea eax, [esp + 0x30]
push eax
call fcn.004ae430
jmp 0x451e6f
mov edx, 0x5380c4
lea ecx, [esp + 0x2c]
call fcn.00454008
jmp 0x45206c
mov ebx, 2
cmp ebx, dword [esp]
jne 0x451ee9
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x451ed6
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae3f0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004ac920
lea eax, [esp + 0x30]
push eax
call fcn.004ae430
jmp 0x451ee4
mov edx, 0x5380c4
lea ecx, [esp + 0x2c]
call fcn.00454008
jmp 0x45206c
mov ebx, 4
cmp ebx, dword [esp]
jne 0x451f5b
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x451f48
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae3f0
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004ac730
lea eax, [esp + 0x30]
push eax
call fcn.004ae430
jmp 0x451f56
mov edx, 0x5397f8
lea ecx, [esp + 0x2c]
call fcn.00454008
jmp 0x45206c
mov ebx, 3
cmp ebx, dword [esp]
jne 0x45206c
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004ad270
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x45206c
mov edx, 0x5380c4
lea ecx, [esp + 0x2c]
call fcn.00454008
mov dword [esp + 0x44], 0
jmp 0x451fc6
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x452063
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.00454300
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x452020
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae4c0
mov edx, 0x5397f8
push edx
call fcn.004ae4c0
lea eax, [esp + 0x30]
push eax
call fcn.004ae430
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae4c0
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae3f0
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004ac0c0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004ae430
inc dword [esp + 0x44]
jno 0x451fc6
push dword [esp + 0x3c]
call fcn.004ad210
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004ae3f0
pop edx
push eax
push edx
call fcn.004ae4c0
pop eax
push eax
call fcn.00454370
pop edx
add eax, edx
jmp 0x45209e
push dword [esp + 8]
call fcn.004ae5f0
push dword [esp + 0x20]
call fcn.004ae5f0
push dword [esp]
call fcn.004ae5f0
push dword [esp + 4]
call fcn.004ae5f0
push dword [esp + 0x28]
call fcn.004ae5f0
add esp, 0x48
pop ebx
ret 0xc