Function at 0x4017ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 1
pop edi
xor ebx, ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
xor esi, esi
mov dword [ebp - 8], ebx
push edi
push 0x401364
push dword [ebp + 0x10]
call fcn.004014d6
test eax, eax
je 0x401820
mov esi, edi
mov dword [ebp - 8], edi
jmp 0x401807
push edi
push 0x40135c
push dword [ebp + 0x10]
call fcn.004014d6
test eax, eax
je 0x401836
mov esi, edi
jmp 0x401807
push edi
push 0x401354
push dword [ebp + 0x10]
call fcn.004014d6
test eax, eax
je 0x40184d
mov dword [ebp - 4], edi
jmp 0x401807
push 0x401344
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401861
mov esi, edi
mov dword [ebp - 8], edi
cmp esi, ebx
jne 0x4019eb
push ebx
push ebx
push 0x401198
push 0x401150
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueA]
test eax, eax
jne 0x4019eb
call dword [sym.imp.SHLWAPI.dll_WhichPlatform]
cmp eax, 2
jne 0x4019eb
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x4019eb
mov eax, dword [ebp + 0x14]
push 0x109c
push 0x40
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x401a49
mov esi, dword [ebp + 0x10]
push 0x824
push edi
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00401460
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x4019de
cmp byte [esi], bl
mov dword [ebp + 0x10], ebx
jne 0x401909
call fcn.00401531
test eax, eax
je 0x40191a
cmp dword [ebp - 4], ebx
jne 0x40191a
lea eax, [ebp - 0x1c]
push eax
call fcn.00401460
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], ebx
jne 0x40192c
cmp byte [esi], bl
je 0x40192c
cmp dword [ebp - 4], ebx
je 0x4019c9
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
push 0x4a
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, ebx
mov dword [ebp + 0x14], ebx
je 0x4019c6
push 0x2710
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], ebx
je 0x4019c6
push dword [ebp + 8]
call fcn.0040156e
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 8], eax
push 0xff
push 0xffffffffffffffff
lea eax, [ebp + 0x10]
push ebx
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, eax
cmp edi, ebx
jne 0x401995
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push ebx
push ebx
lea eax, [ebp - 0x38]
push ebx
push eax
call esi
test eax, eax
je 0x4019c2
cmp dword [ebp - 0x34], 0x12
je 0x4019c0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401995
xor edi, edi
cmp edi, ebx
jne 0x401972
mov edi, dword [ebp + 0x14]
cmp dword [ebp + 0x10], ebx
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4019d9
push dword [ebp + 0x10]
call esi
push dword [ebp - 8]
call esi
cmp edi, ebx
je 0x401a49
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x401a49
call fcn.0040168c
cmp dword [ebp - 8], ebx
je 0x401a3b
push dword [ebp + 8]
call fcn.004015e7
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x401334
call esi
push 0x401324
call esi
push 0x401318
call esi
push 0x40130c
call esi
push 0x401300
call esi
push 0x4012f4
call esi
push 0x4012e8
call esi
push 0x4012dc
call esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0040136c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10