Function at 0x41378f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x4424f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x21c]
xor esi, esi
push eax
push 0x20019
push esi
push 0x402760
xor ebx, ebx
mov dword [ebp - 0x21c], esi
push reloc.OLEAUT32.dll_SysReAllocString
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413a92
push 3
pop edi
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x224], esi
push eax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], esi
push eax
lea eax, [ebp - 0x228]
mov dword [ebp - 0x228], edi
push eax
push esi
push 0x401aec
push dword [ebp - 0x21c]
mov dword [ebp - 0x22c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413a86
cmp dword [ebp - 0x228], edi
jne 0x413a86
mov edx, 0x100
lea ecx, [ebp - 0x208]
call fcn.00422817
test eax, eax
je 0x413a86
movzx eax, word [ebp - 0x222]
cdq
mov ecx, eax
mov dword [ebp - 0x20c], esi
movzx eax, word [ebp - 0x224]
mov ebx, edx
shld ebx, ecx, 0x10
cdq
shl ecx, 0x10
or ebx, edx
or ecx, eax
mov dword [ebp - 0x210], esi
movzx eax, word [ebp - 0x21e]
shld ebx, ecx, 0x10
cdq
shl ecx, 0x10
or ebx, edx
or ecx, eax
mov dword [ebp - 0x214], esi
movzx eax, word [ebp - 0x220]
shld ebx, ecx, 0x10
cdq
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0x218], esi
or ebx, edx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ebx
lea eax, [ebp - 0x208]
jmp 0x4138be
inc esi
add eax, 2
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x4138ba
mov eax, esi
sub eax, 1
je 0x4139f5
sub eax, 1
je 0x4139c9
sub eax, 1
je 0x413996
lea eax, [ebp - 0x208]
test esi, esi
je 0x41390b
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x214], eax
jmp 0x413a18
inc esi
add eax, 2
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x413907
sub esi, 1
je 0x413981
sub esi, 1
je 0x413965
sub esi, 1
je 0x413942
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
mov dword [ebp - 0x20c], eax
jmp 0x413a18
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x404350
jmp 0x4139b7
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x404370
jmp 0x4139e3
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x404388
jmp 0x413a08
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x404308
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x18
jmp 0x413a18
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x404328
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
jmp 0x413a18
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x404340
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
mov eax, dword [ebp - 0x20c]
xor edi, edi
mov ecx, dword [ebp - 0x210]
mov esi, dword [ebp - 0x218]
shl eax, 0x10
add ecx, eax
mov eax, dword [ebp - 0x214]
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
add esi, eax
shld edi, ebx, 0x10
movzx eax, cx
shl ebx, 0x10
cdq
or ebx, eax
or edi, edx
shld edi, ebx, 0x10
mov eax, esi
shl ebx, 0x10
shr eax, 0x10
or ebx, eax
movzx eax, si
shld edi, ebx, 0x10
cdq
shl ebx, 0x10
or edi, edx
or ebx, eax
cmp edi, dword [ebp - 0x230]
ja 0x413a83
jb 0x413a7f
cmp ebx, dword [ebp - 0x234]
jae 0x413a83
xor ebx, ebx
jmp 0x413a86
xor ebx, ebx
inc ebx
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, ebx
ret
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441130
leave
ret