Function at 0x4163e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x51e7ec
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x56a338]
xor eax, esp
mov dword [esp + 0x4a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x56a338]
xor eax, esp
push eax
lea eax, [esp + 0x4c0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4d0]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4d4]
mov esi, ecx
mov edi, edx
xor ebp, ebp
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebp
call fcn.0040d240
mov ebx, 8
add esp, 4
cmp dword [eax + 0x18], ebx
jb 0x416457
mov eax, dword [eax + 4]
jmp 0x41645a
add eax, 4
lea ecx, [esp + 0x1c]
push ecx
push 0x109
push ebp
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [esp + 0x48], ebx
mov esi, eax
jb 0x416482
mov edx, dword [esp + 0x34]
push edx
call fcn.0042eca7
add esp, 4
cmp esi, ebp
je 0x41648d
xor eax, eax
jmp 0x416868
mov ecx, edi
mov dword [esp + 0x24], ebp
call fcn.00421490
test eax, eax
jbe 0x416858
mov eax, dword [esp + 0x24]
push eax
mov eax, edi
call fcn.00421730
mov esi, eax
mov al, byte [esi + 8]
test al, al
je 0x416858
cmp al, 7
jne 0x416858
push 0x561cf4
mov eax, esi
call fcn.00421980
mov edi, eax
push str.type
mov eax, esi
call fcn.00421980
mov ebp, eax
push str.value
mov eax, esi
call fcn.00421980
mov ebx, eax
mov al, byte [edi + 8]
test al, al
je 0x416858
cmp al, 4
jne 0x416858
mov al, byte [ebp + 8]
test al, al
je 0x416509
cmp al, 4
je 0x416518
mov al, byte [ebx + 8]
test al, al
je 0x416518
cmp al, 4
je 0x416858
lea esi, [esp + 0x30]
mov ecx, edi
call fcn.00420e10
xor esi, esi
push eax
lea ecx, [esp + 0x88]
mov dword [esp + 0x4cc], esi
call fcn.0040d240
add esp, 4
mov byte [esp + 0x4c8], 2
cmp dword [esp + 0x48], 0x10
jb 0x416558
mov ecx, dword [esp + 0x34]
push ecx
call fcn.0042eca7
add esp, 4
mov al, byte [ebp + 8]
test al, al
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], esi
mov byte [esp + 0x34], 0
je 0x41657f
cmp al, 4
jne 0x41657f
mov al, byte [ebx + 8]
test al, al
je 0x41657f
cmp al, 4
je 0x4165b6
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x416597
lea eax, [esp + 0x88]
mov edx, dword [esp + 0x1c]
push esi
push esi
push esi
push esi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41684c
mov eax, dword [esp + 0x20]
add dword [eax], 1
mov dword [esp + 0x18], esi
lea esi, [esp + 0x68]
mov ecx, ebp
call fcn.00420e10
mov ecx, str.REG_SZ
mov edi, esi
mov byte [esp + 0x4c8], 3
call fcn.00408510
test al, al
je 0x4165ea
mov dword [esp + 0x18], 1
jmp 0x41673f
mov ecx, str.REG_EXPAND_SZ
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x416609
mov dword [esp + 0x18], 2
jmp 0x41673f
mov ecx, str.REG_BINARY
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x416628
mov dword [esp + 0x18], 3
jmp 0x41673f
mov ecx, str.REG_DWORD
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x416647
mov dword [esp + 0x18], 4
jmp 0x41673f
mov ecx, str.REG_DWORD_LITTLE_ENDIAN
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x416666
mov dword [esp + 0x18], 4
jmp 0x41673f
mov ecx, str.REG_DWORD_BIG_ENDIAN
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x416685
mov dword [esp + 0x18], 5
jmp 0x41673f
mov ecx, str.REG_LINK
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x4166a4
mov dword [esp + 0x18], 6
jmp 0x41673f
mov ecx, str.REG_MULTI_SZ
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x4166c3
mov dword [esp + 0x18], 7
jmp 0x41673f
mov ecx, str.REG_RESOURCE_LIST
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x4166df
mov dword [esp + 0x18], 8
jmp 0x41673f
mov ecx, str.REG_FULL_RESOURCE_DESCRIPTOR
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x4166fb
mov dword [esp + 0x18], 9
jmp 0x41673f
mov ecx, str.REG_RESOURCE_REQUIREMENTS_LIST
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
je 0x416717
mov dword [esp + 0x18], 0xa
jmp 0x41673f
mov ecx, str.REG_QWORD
lea edi, [esp + 0x68]
call fcn.00408510
test al, al
jne 0x416737
mov ecx, str.REG_QWORD_LITTLE_ENDIAN
call fcn.00408510
test al, al
je 0x41673f
mov dword [esp + 0x18], 0xb
push 0x3fe
lea eax, [esp + 0xc2]
push 0
push eax
mov word [esp + 0xc8], 0
call fcn.00435740
add esp, 0xc
lea esi, [esp + 0x4c]
mov ecx, ebx
mov dword [esp + 0x2c], 0x200
call fcn.00420e10
push eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x4cc], 4
call fcn.0040d240
add esp, 4
mov ecx, esi
mov byte [esp + 0x4c8], 3
call fcn.004058a0
mov eax, dword [esp + 0x18]
cmp eax, 2
je 0x416892
cmp eax, 1
je 0x416892
cmp eax, 7
je 0x416892
cmp eax, 4
je 0x4167c3
cmp eax, 3
jne 0x416837
mov eax, dword [esp + 0x88]
mov edi, 8
cmp dword [esp + 0x9c], edi
jae 0x4167df
lea eax, [esp + 0x88]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416909
cmp dword [esp + 0xb8], edi
movsx esi, word [esp + 0xbc]
mov eax, dword [esp + 0xa4]
jae 0x416826
lea eax, [esp + 0xa4]
push eax
call fcn.0042f042
add esp, 4
cmp eax, esi
je 0x416902
lea ecx, [esp + 0xa0]
call fcn.004022c0
lea ecx, [esp + 0x68]
call fcn.004058a0
lea ecx, [esp + 0x84]
call fcn.004022c0
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x4c0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4a8]
xor ecx, esp
call fcn.0042eb95
add esp, 0x4b8
ret 8
mov eax, dword [esp + 0x88]
mov esi, 8
cmp dword [esp + 0x9c], esi
jae 0x4168ae
lea eax, [esp + 0x88]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0xc0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x416909
cmp dword [esp + 0xb8], esi
mov eax, dword [esp + 0xa4]
jae 0x4168e9
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0xc0]
push eax
call fcn.0042ecac
add esp, 8
test eax, eax
je 0x416837
mov eax, dword [esp + 0x20]
add dword [eax], 1
lea ecx, [esp + 0xa0]
call fcn.004022c0
lea ecx, [esp + 0x68]
call fcn.004058a0
lea ecx, [esp + 0x84]
mov dword [esp + 0x4c8], 0xffffffff
call fcn.004022c0
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esi, 1
mov dword [esp + 0x24], esi
call fcn.00421490
cmp esi, eax
jae 0x416858
mov edi, dword [esp + 0x28]
jmp 0x4164a0