Function at 0x409a4d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x409a53
mov eax, dword [esp + 0x50]
mov dword [0x41d82c], eax
mov edx, dword [esp + 0x44]
lea ecx, [esp]
call fcn.0040f000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 4]
call fcn.0040f000
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 8]
call fcn.0040f000
push dword [0x41d82c]
push dword [0x41d82c]
push 0xff
call fcn.0040f920
lea eax, [esp + 0x10]
push eax
call fcn.00415fa0
mov edx, str.REG_SZ
lea ecx, [esp + 0x34]
call fcn.0040f008
push dword [0x41d82c]
push dword [0x41d82c]
push 1
push dword [esp + 0xc]
call fcn.0040f1b0
add dword [0x41d82c], 2
mov edx, 0x418476
pop ecx
mov dword [0x41d82c], ecx
add ecx, dword [0x41c28c]
call fcn.00416080
je 0x409b23
push dword [0x41d82c]
push dword [0x41d82c]
push dword [esp + 8]
call fcn.0040f180
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0040f970
lea eax, [esp + 4]
push eax
call fcn.00415fa0
push dword [esp + 8]
mov edx, 0x418052
pop ecx
call fcn.00416080
je 0x409b56
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x50]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0x14], eax
jmp 0x409b8c
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x44]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x409cad
mov dword [esp + 0x24], 0xff
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x409cad
push dword [esp + 0x28]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x409c43
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x14]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x409c33
push dword [0x41d82c]
push dword [0x41d82c]
mov ebx, dword [esp + 0x30]
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.0040f1b0
lea eax, [esp + 0x18]
push eax
call fcn.00415fa0
jmp 0x409c41
mov edx, 0x418052
lea ecx, [esp + 0x14]
call fcn.0040f008
jmp 0x409cac
mov ebx, 4
cmp ebx, dword [esp]
jne 0x409cac
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
and ebx, ebx
jne 0x409c9e
push dword [0x41d82c]
push dword [0x41d82c]
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00410300
lea eax, [esp + 0x18]
push eax
call fcn.00415fa0
jmp 0x409cac
mov edx, 0x4182ca
lea ecx, [esp + 0x14]
call fcn.0040f008
pop eax
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegCloseKey
mov ebx, dword [esp + 0x28]
cmp ebx, 4
jne 0x409ccd
mov edx, str.REG_DWORD
lea ecx, [esp + 0x34]
call fcn.0040f008
mov edx, dword [esp + 0x10]
push dword [0x41d82c]
call fcn.00416020
mov edx, str._::
call fcn.00416020
mov edx, dword [esp + 0x38]
call fcn.00416020
pop eax
add eax, dword [0x41c28c]
jmp 0x409d08
push dword [esp + 8]
call fcn.004160c0
push dword [esp + 0xc]
call fcn.004160c0
push dword [esp + 0x34]
call fcn.004160c0
push dword [esp + 4]
call fcn.004160c0
push dword [esp]
call fcn.004160c0
push dword [esp + 0x10]
call fcn.004160c0
add esp, 0x38
pop ebx
ret 0x10