Function at 0x4017b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4017bf
call fcn.00426e20
push dword [esp + 0x50]
call fcn.00405080
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00405000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00405000
mov dword [esp + 0x10], 0x20019
cmp dword [esp + 0x48], 0
je 0x401810
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004257f0
call fcn.00426fd0
mov edx, 0x4870ba
call fcn.00405090
mov ecx, eax
call fcn.00405010
je 0x401876
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 8]
call fcn.00425860
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00425ed0
lea eax, [esp + 4]
push eax
call fcn.00426e90
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00425ed0
call fcn.00426fd0
mov edx, 0x4870ba
call fcn.00405090
mov ecx, eax
call fcn.00405010
je 0x4018dc
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 8]
call fcn.00425860
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004257f0
lea eax, [esp + 4]
push eax
call fcn.00426e90
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4018f7
push 0x48763c
push 0x24
push dword [esp + 0x54]
call fcn.00426260
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 0
push dword [esp + 0xc]
push dword [esp + 0x4c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x401980
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x40194e
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004020ac
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00426e90
cmp dword [esp + 0x14], 0
je 0x40195e
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x487028
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
pop eax
push eax
call fcn.00405050
pop edx
add eax, edx
jmp 0x40208a
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x401a08
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x4019dd
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004020ac
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00426e90
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x487028
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
pop eax
push eax
call fcn.00405050
pop edx
add eax, edx
jmp 0x40208a
cmp dword [esp + 0x20], 0
je 0x401a73
push dword [esp + 0x20]
call fcn.00426240
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x401a73
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x401a48
mov ebp, dword [esp + 0x4c]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x4c]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00405008
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, 0x487028
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
pop eax
push eax
call fcn.00405050
pop edx
add eax, edx
jmp 0x40208a
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0x20]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 8], eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 8], 0
je 0x401b03
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x401ad8
push dword [esp + 8]
mov ebp, dword [esp + 0x50]
pop dword [ebp + 8]
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0xc]
call fcn.004020ac
mov ebp, dword [esp + 0x50]
lea eax, [ebp + 0xc]
push eax
call fcn.00426e90
push dword [esp + 0x1c]
call fcn.00426270
mov edx, 0x487028
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
pop eax
push eax
call fcn.00405050
pop edx
add eax, edx
jmp 0x40208a
mov ebx, dword [esp + 0x4c]
and ebx, ebx
je 0x401b16
push dword [esp + 0x18]
mov ebp, dword [esp + 0x50]
pop dword [ebp]
push dword [esp + 0x18]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x401d05
mov ebx, dword [esp + 0x24]
cmp ebx, 0x830
jg 0x401be1
mov dword [esp + 0x30], 0
jmp 0x401b42
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, dword [esp + 0x30]
jl 0x401bdc
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
mov edx, 0x48705a
push edx
call fcn.00426dd0
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
mov eax, 0x487062
push eax
push 2
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004262c0
cdq
push edx
push eax
call fcn.00425760
call fcn.00405062
add dword [esp], edx
call fcn.00425f50
pop eax
mov edx, 0x48705e
push edx
call fcn.00426dd0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
inc dword [esp + 0x30]
jno 0x401b42
jmp 0x401c85
mov dword [esp + 0x30], 0
jmp 0x401beb
mov eax, 0x82f
cmp eax, dword [esp + 0x30]
jl 0x401c85
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
mov edx, 0x48705a
push edx
call fcn.00426dd0
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
mov eax, 0x487062
push eax
push 2
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.004262c0
cdq
push edx
push eax
call fcn.00425760
call fcn.00405062
add dword [esp], edx
call fcn.00425f50
pop eax
mov edx, 0x48705e
push edx
call fcn.00426dd0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
inc dword [esp + 0x30]
jno 0x401beb
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0x18]
call fcn.00425860
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004257f0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x401cd3
push dword [esp + 0x20]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 0x1c]
push dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
pop dword [ebp + 4]
push dword [esp + 0x54]
call fcn.00405080
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
pop eax
push eax
call fcn.00405050
pop edx
add eax, edx
add esp, 4
jmp 0x40208a
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401d62
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x401d32
push dword [esp + 0x20]
call fcn.004262d0
mov ebp, dword [esp + 0x50]
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 4
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0x28]
call fcn.004262d0
cdq
push edx
push eax
call fcn.00426090
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
jmp 0x402058
mov ebx, 2
cmp ebx, dword [esp]
jne 0x401e28
push 0
push 0
push dword [esp + 0x28]
call dword [0x4a6b90]
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x28]
and ebx, ebx
jle 0x401e23
push dword [esp + 0x28]
call fcn.00426240
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
je 0x401e21
push dword [esp + 0x28]
push dword [esp + 0x30]
push dword [esp + 0x28]
call dword [0x4a6b90]
and eax, eax
je 0x401e18
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0x34]
call fcn.004262f0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x401e18
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00426e90
push dword [esp + 0x10]
call fcn.00425860
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
push dword [esp + 0x2c]
call fcn.00426270
jmp 0x401e23
jmp 0x402058
mov ebx, 7
cmp ebx, dword [esp]
jne 0x401f94
mov ebx, dword [esp + 0x30]
cmp ebx, dword [esp + 0x24]
jge 0x401ef2
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x2c]
add ebx, dword [esp + 0x3c]
push ebx
call fcn.00426340
call fcn.00426fd0
mov edx, 0x487028
call fcn.00405090
mov ecx, eax
call fcn.00405010
je 0x401ea8
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
mov edx, 0x48702a
push edx
call fcn.00426dd0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
jmp 0x401ee8
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push 1
mov ebx, dword [esp + 0x30]
add ebx, dword [esp + 0x40]
push ebx
call fcn.00426340
pop eax
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
add dword [esp + 0x30], 2
jmp 0x401e36
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.00425ed0
call fcn.00426fd0
mov edx, 0x48702a
call fcn.00405090
mov ecx, eax
call fcn.00405010
je 0x401f58
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0x18]
call fcn.00425860
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.004257f0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x401f8f
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00426e90
push dword [esp + 0x10]
call fcn.00425860
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
jmp 0x402058
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x401ff4
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x401fc8
push dword [esp + 0x20]
call fcn.004262e0
push edx
push eax
mov ebp, dword [esp + 0x58]
lea eax, [ebp + 0x14]
pop dword [eax]
pop dword [eax + 4]
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], 8
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0x28]
call fcn.004262e0
push edx
push eax
call fcn.00426090
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
jmp 0x402058
mov ebx, 1
cmp ebx, dword [esp]
jne 0x402058
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426fa0
pop edx
push eax
push dword [esp + 0x28]
call fcn.004262f0
lea eax, [esp + 0x14]
push eax
call fcn.00426e90
mov ebx, dword [esp + 0x50]
and ebx, ebx
je 0x402058
mov edx, dword [esp + 0x10]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
mov ebp, dword [esp + 0x54]
lea eax, [ebp + 0x20]
push eax
call fcn.00426e90
push dword [esp + 0x10]
call fcn.00425860
mov ebp, dword [esp + 0x50]
mov dword [ebp + 4], eax
pop eax
push dword [esp + 0x1c]
call fcn.00426270
mov edx, dword [esp + 0xc]
push edx
call fcn.00426fa0
pop edx
push eax
push edx
call fcn.00426dd0
pop eax
push eax
call fcn.00405050
pop edx
add eax, edx
jmp 0x40208a
push dword [esp]
call fcn.00426f00
push dword [esp + 0xc]
call fcn.00426f00
push dword [esp + 4]
call fcn.00426f00
add esp, 0x30
pop ebx
pop ebp
ret 0x14