Function at 0x45388e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x453894
call fcn.004d4b50
push dword [esp + 0x5c]
call fcn.00455440
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00455000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00455000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00455000
push dword [esp]
call fcn.00453f3a
push dword [esp + 8]
mov edx, 0x5ed710
pop ecx
call fcn.004553d0
je 0x453941
cmp dword [0x14a9474], 0
je 0x453925
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x14a9478]
or ebx, 0xf003f
push ebx
push 0
push dword [0x14a9468]
push dword [0x14a9470]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x45393f
lea eax, [esp + 0x10]
push eax
push dword [0x14a9468]
push dword [0x14a9470]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x4539a6
lea eax, [esp + 0x18]
push eax
push dword [0x14a9470]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x14a9474], 0
je 0x45398e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x14a9478]
or ebx, 0xf003f
push ebx
push 0
push dword [0x14a9468]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4539a6
lea eax, [esp + 0x10]
push eax
push dword [0x14a9468]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x453c7f
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a40
pop edx
push eax
push dword [esp + 0x24]
call fcn.004d2530
lea eax, [esp + 0x24]
push eax
call fcn.004d4ac0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x453c7f
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x453a87
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x453a74
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a40
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004d2ff0
lea eax, [esp + 0x30]
push eax
call fcn.004d4ac0
jmp 0x453a82
mov edx, 0x5ec0c4
lea ecx, [esp + 0x2c]
call fcn.00455008
jmp 0x453c7e
mov ebx, 2
cmp ebx, dword [esp]
jne 0x453afc
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x453ae9
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a40
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004d2ff0
lea eax, [esp + 0x30]
push eax
call fcn.004d4ac0
jmp 0x453af7
mov edx, 0x5ec0c4
lea ecx, [esp + 0x2c]
call fcn.00455008
jmp 0x453c7e
mov ebx, 4
cmp ebx, dword [esp]
jne 0x453b6e
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x453b5b
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a40
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004d22f0
lea eax, [esp + 0x30]
push eax
call fcn.004d4ac0
jmp 0x453b69
mov edx, 0x5ed8ae
lea ecx, [esp + 0x2c]
call fcn.00455008
jmp 0x453c7e
mov ebx, 3
cmp ebx, dword [esp]
jne 0x453c7e
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004d3990
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x453c7e
mov edx, 0x5ec0c4
lea ecx, [esp + 0x2c]
call fcn.00455008
mov dword [esp + 0x44], 0
jmp 0x453bd9
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x453c75
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
call fcn.004d3ce0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x453c32
mov edx, dword [esp + 0x2c]
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a70
mov edx, 0x5ed8ae
push edx
call fcn.004d4a70
lea eax, [esp + 0x30]
push eax
call fcn.004d4ac0
mov edx, dword [esp + 0x2c]
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a70
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a40
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004d2660
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004d4ac0
inc dword [esp + 0x44]
jno 0x453bd9
push dword [esp + 0x3c]
call fcn.004d3930
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004d4a40
pop edx
push eax
push edx
call fcn.004d4a70
pop eax
push eax
call fcn.00455410
pop edx
add eax, edx
jmp 0x453cb0
push dword [esp + 8]
call fcn.004d4bc0
push dword [esp + 0x20]
call fcn.004d4bc0
push dword [esp]
call fcn.004d4bc0
push dword [esp + 4]
call fcn.004d4bc0
push dword [esp + 0x28]
call fcn.004d4bc0
add esp, 0x48
pop ebx
ret 0xc