Function at 0x41d3eb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41d3f1
call fcn.004634e0
push dword [esp + 0x5c]
call fcn.00422790
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00422000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00422000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00422000
push dword [esp]
call fcn.0041ea8a
push dword [esp + 8]
mov edx, 0x4bcc72
pop ecx
call fcn.00422720
je 0x41d49e
cmp dword [0x62bdb4], 0
je 0x41d482
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x62bdcc]
or ebx, 0xf003f
push ebx
push 0
push dword [0x62bd94]
push dword [0x62bdb0]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41d49c
lea eax, [esp + 0x10]
push eax
push dword [0x62bd94]
push dword [0x62bdb0]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x41d503
lea eax, [esp + 0x18]
push eax
push dword [0x62bdb0]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x62bdb4], 0
je 0x41d4eb
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x62bdcc]
or ebx, 0xf003f
push ebx
push 0
push dword [0x62bd94]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41d503
lea eax, [esp + 0x10]
push eax
push dword [0x62bd94]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41d7dd
mov dword [esp + 0x1c], 0x400
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push dword [esp + 0x24]
call fcn.00460d60
lea eax, [esp + 0x24]
push eax
call fcn.004633e0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41d7dd
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x41d5e4
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d5d1
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00461b80
lea eax, [esp + 0x30]
push eax
call fcn.004633e0
jmp 0x41d5df
mov edx, 0x4bc050
lea ecx, [esp + 0x2c]
call fcn.00422008
jmp 0x41d7dc
mov ebx, 2
cmp ebx, dword [esp]
jne 0x41d659
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d646
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00461b80
lea eax, [esp + 0x30]
push eax
call fcn.004633e0
jmp 0x41d654
mov edx, 0x4bc050
lea ecx, [esp + 0x2c]
call fcn.00422008
jmp 0x41d7dc
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41d6cb
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d6b8
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00461480
lea eax, [esp + 0x30]
push eax
call fcn.004633e0
jmp 0x41d6c6
mov edx, 0x4bcd0c
lea ecx, [esp + 0x2c]
call fcn.00422008
jmp 0x41d7dc
mov ebx, 3
cmp ebx, dword [esp]
jne 0x41d7dc
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004621b0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d7dc
mov edx, 0x4bc050
lea ecx, [esp + 0x2c]
call fcn.00422008
mov dword [esp + 0x44], 0
jmp 0x41d736
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x41d7d3
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.004226d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x41d790
mov edx, dword [esp + 0x2c]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, 0x4bcd0c
push edx
call fcn.00463380
lea eax, [esp + 0x30]
push eax
call fcn.004633e0
mov edx, dword [esp + 0x2c]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00460c40
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004633e0
inc dword [esp + 0x44]
jno 0x41d736
push dword [esp + 0x3c]
call fcn.00462390
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
pop eax
push eax
call fcn.00422760
pop edx
add eax, edx
jmp 0x41d80e
push dword [esp + 8]
call fcn.00463570
push dword [esp + 0x20]
call fcn.00463570
push dword [esp]
call fcn.00463570
push dword [esp + 4]
call fcn.00463570
push dword [esp + 0x28]
call fcn.00463570
add esp, 0x48
pop ebx
ret 0xc