Function at 0x4111e7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4111ed
call fcn.00452e50
push dword [esp + 0x5c]
call fcn.00416640
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00416000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00416000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00416000
push dword [esp]
call fcn.00412888
push dword [esp + 8]
mov edx, 0x5002ee
pop ecx
call fcn.004165d0
je 0x41129a
cmp dword [0x846438], 0
je 0x41127e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x846450]
or ebx, 0xf003f
push ebx
push 0
push dword [0x846418]
push dword [0x846434]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x411298
lea eax, [esp + 0x10]
push eax
push dword [0x846418]
push dword [0x846434]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x4112ff
lea eax, [esp + 0x18]
push eax
push dword [0x846434]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x846438], 0
je 0x4112e7
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x846450]
or ebx, 0xf003f
push ebx
push 0
push dword [0x846418]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4112ff
lea eax, [esp + 0x10]
push eax
push dword [0x846418]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4115d8
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
push dword [esp + 0x24]
call fcn.004505e0
lea eax, [esp + 0x24]
push eax
call fcn.00452d90
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4115d8
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4113e0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4113cd
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00450ff0
lea eax, [esp + 0x30]
push eax
call fcn.00452d90
jmp 0x4113db
mov edx, 0x500028
lea ecx, [esp + 0x2c]
call fcn.00416008
jmp 0x4115d7
mov ebx, 2
cmp ebx, dword [esp]
jne 0x411455
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x411442
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00450ff0
lea eax, [esp + 0x30]
push eax
call fcn.00452d90
jmp 0x411450
mov edx, 0x500028
lea ecx, [esp + 0x2c]
call fcn.00416008
jmp 0x4115d7
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4114c7
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4114b4
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00450760
lea eax, [esp + 0x30]
push eax
call fcn.00452d90
jmp 0x4114c2
mov edx, 0x500328
lea ecx, [esp + 0x2c]
call fcn.00416008
jmp 0x4115d7
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4115d7
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00451bd0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4115d7
mov edx, 0x500028
lea ecx, [esp + 0x2c]
call fcn.00416008
mov dword [esp + 0x44], 0
jmp 0x411532
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x4115ce
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
call fcn.00451c40
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x41158b
mov edx, dword [esp + 0x2c]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
mov edx, 0x500328
push edx
call fcn.00452e00
lea eax, [esp + 0x30]
push eax
call fcn.00452d90
mov edx, dword [esp + 0x2c]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452d60
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00451650
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.00452d90
inc dword [esp + 0x44]
jno 0x411532
push dword [esp + 0x3c]
call fcn.00451b70
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00452d60
pop edx
push eax
push edx
call fcn.00452e00
pop eax
push eax
call fcn.00416610
pop edx
add eax, edx
jmp 0x411609
push dword [esp + 8]
call fcn.00452ee0
push dword [esp + 0x20]
call fcn.00452ee0
push dword [esp]
call fcn.00452ee0
push dword [esp + 4]
call fcn.00452ee0
push dword [esp + 0x28]
call fcn.00452ee0
add esp, 0x48
pop ebx
ret 0xc