Function at 0x40555c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405562
call fcn.0041f3e0
push dword [esp + 0x5c]
call fcn.0040b5d0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0040b000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0040b000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0040b000
push dword [esp]
call fcn.00406bfb
push dword [esp + 8]
mov edx, 0x4ac374
pop ecx
call fcn.0040b5e0
je 0x40560f
cmp dword [0x52c968], 0
je 0x4055f3
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x52c980]
or ebx, 0xf003f
push ebx
push 0
push dword [0x52c948]
push dword [0x52c964]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x40560d
lea eax, [esp + 0x10]
push eax
push dword [0x52c948]
push dword [0x52c964]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x405674
lea eax, [esp + 0x18]
push eax
push dword [0x52c964]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x52c968], 0
je 0x40565c
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x52c980]
or ebx, 0xf003f
push ebx
push 0
push dword [0x52c948]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x405674
lea eax, [esp + 0x10]
push eax
push dword [0x52c948]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40594e
mov dword [esp + 0x1c], 0x400
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
push dword [esp + 0x24]
call fcn.0041cd10
lea eax, [esp + 0x24]
push eax
call fcn.0041f2e0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x40594e
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405755
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x405742
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0041d690
lea eax, [esp + 0x30]
push eax
call fcn.0041f2e0
jmp 0x405750
mov edx, 0x4ac028
lea ecx, [esp + 0x2c]
call fcn.0040b008
jmp 0x40594d
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4057ca
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4057b7
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0041d690
lea eax, [esp + 0x30]
push eax
call fcn.0041f2e0
jmp 0x4057c5
mov edx, 0x4ac028
lea ecx, [esp + 0x2c]
call fcn.0040b008
jmp 0x40594d
mov ebx, 4
cmp ebx, dword [esp]
jne 0x40583c
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x405829
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0041cfb0
lea eax, [esp + 0x30]
push eax
call fcn.0041f2e0
jmp 0x405837
mov edx, 0x4ac3ae
lea ecx, [esp + 0x2c]
call fcn.0040b008
jmp 0x40594d
mov ebx, 3
cmp ebx, dword [esp]
jne 0x40594d
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.0041e1f0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x40594d
mov edx, 0x4ac028
lea ecx, [esp + 0x2c]
call fcn.0040b008
mov dword [esp + 0x44], 0
jmp 0x4058a7
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x405944
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.0040b550
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x405901
mov edx, dword [esp + 0x2c]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
mov edx, 0x4ac3ae
push edx
call fcn.0041f280
lea eax, [esp + 0x30]
push eax
call fcn.0041f2e0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f240
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0041db50
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.0041f2e0
inc dword [esp + 0x44]
jno 0x4058a7
push dword [esp + 0x3c]
call fcn.0041e3d0
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.0041f240
pop edx
push eax
push edx
call fcn.0041f280
pop eax
push eax
call fcn.0040b5a0
pop edx
add eax, edx
jmp 0x40597f
push dword [esp + 8]
call fcn.0041f470
push dword [esp + 0x20]
call fcn.0041f470
push dword [esp]
call fcn.0041f470
push dword [esp + 4]
call fcn.0041f470
push dword [esp + 0x28]
call fcn.0041f470
add esp, 0x48
pop ebx
ret 0xc