Function at 0x41148c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x411492
call fcn.00431250
push dword [esp + 0x5c]
call fcn.004176d0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00417000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00417000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00417000
push dword [esp]
call fcn.00412b2b
push dword [esp + 8]
mov edx, 0x4bd3cc
pop ecx
call fcn.00417660
je 0x41153f
cmp dword [0x934118], 0
je 0x411523
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x934130]
or ebx, 0xf003f
push ebx
push 0
push dword [0x9340f8]
push dword [0x934114]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41153d
lea eax, [esp + 0x10]
push eax
push dword [0x9340f8]
push dword [0x934114]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x4115a4
lea eax, [esp + 0x18]
push eax
push dword [0x934114]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x934118], 0
je 0x41158c
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x934130]
or ebx, 0xf003f
push ebx
push 0
push dword [0x9340f8]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4115a4
lea eax, [esp + 0x10]
push eax
push dword [0x9340f8]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41187e
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
push dword [esp + 0x24]
call fcn.0042e920
lea eax, [esp + 0x24]
push eax
call fcn.00431180
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41187e
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x411685
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411672
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0042f8a0
lea eax, [esp + 0x30]
push eax
call fcn.00431180
jmp 0x411680
mov edx, 0x4bd028
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x41187d
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4116fa
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4116e7
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0042f8a0
lea eax, [esp + 0x30]
push eax
call fcn.00431180
jmp 0x4116f5
mov edx, 0x4bd028
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x41187d
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41176c
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411759
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0042ef10
lea eax, [esp + 0x30]
push eax
call fcn.00431180
jmp 0x411767
mov edx, 0x4bd40e
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x41187d
mov ebx, 3
cmp ebx, dword [esp]
jne 0x41187d
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.0042ff50
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41187d
mov edx, 0x4bd028
lea ecx, [esp + 0x2c]
call fcn.00417008
mov dword [esp + 0x44], 0
jmp 0x4117d7
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x411874
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.00417610
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x411831
mov edx, dword [esp + 0x2c]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
mov edx, 0x4bd40e
push edx
call fcn.00431120
lea eax, [esp + 0x30]
push eax
call fcn.00431180
mov edx, dword [esp + 0x2c]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.004310e0
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0042ed50
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.00431180
inc dword [esp + 0x44]
jno 0x4117d7
push dword [esp + 0x3c]
call fcn.00430130
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004310e0
pop edx
push eax
push edx
call fcn.00431120
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x4118af
push dword [esp + 8]
call fcn.004312e0
push dword [esp + 0x20]
call fcn.004312e0
push dword [esp]
call fcn.004312e0
push dword [esp + 4]
call fcn.004312e0
push dword [esp + 0x28]
call fcn.004312e0
add esp, 0x48
pop ebx
ret 0xc