Function at 0x7141f417
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x714bc80f
call fcn.71401d81
xor esi, esi
mov dword [ebp - 0x18], esi
mov byte [ebp - 0xd], 0
mov dword [ebp - 0x14], 5
call sub.DDRAW.dll_AcquireDDThreadLock
push dword [ebp + 8]
mov dword [ebp - 4], esi
call fcn.7141ff75
pop ecx
test eax, eax
jne 0x7141f45a
call sub.DDRAW.dll_ReleaseDDThreadLock
mov eax, 0x80070057
call fcn.71401ef4
ret 0x14
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov esi, dword [ebp + 8]
push 4
pop ebx
mov dword [ebp - 0x24], eax
mov ecx, ebx
mov edi, 0x7141bec8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x7141f492
call fcn.71401724
test eax, eax
jne 0x7141f492
mov edi, 0x80070057
call sub.DDRAW.dll_ReleaseDDThreadLock
mov eax, edi
jmp 0x7141f452
lea eax, [ebp - 0x18]
push eax
push 0x714014c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x7141f522
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
xor edi, edi
push edi
push 0x7141f724
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
call esi
test eax, eax
jne 0x7141f4ed
cmp dword [ebp - 0x20], ebx
jne 0x7141f4ed
cmp dword [ebp + 0xc], edi
je 0x7141f4ed
movzx eax, word [ebp + 0xc]
push 5
mov dword [ebp - 0x14], eax
pop eax
cmp word [ebp + 0xc], ax
jbe 0x7141f4ed
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0x7141f718
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
call esi
test eax, eax
jne 0x7141f519
cmp dword [ebp - 0x20], ebx
jne 0x7141f519
cmp dword [ebp + 0xc], edi
je 0x7141f519
mov byte [ebp - 0xd], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
mov ecx, ebx
mov edi, 0x7141bef8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x7141f55e
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x478]
test eax, eax
je 0x7141f555
test dword [eax + 0x10], 0x10000
jne 0x7141f5f0
and dword [ebp - 0x14], 0
jmp 0x7141f600
mov esi, dword [ebp + 8]
mov ecx, ebx
mov edi, 0x7141beb8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x7141f5d2
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x170]
xor edi, edi
xor edx, edx
xor esi, esi
cmp ecx, edi
je 0x7141f597
cmp dword [ecx + 0x37c], edi
je 0x7141f597
push 0x10
pop edx
mov esi, ebx
mov eax, dword [eax + 0x638]
cmp eax, edi
je 0x7141f5b1
cmp dword [eax + 0x14], edi
je 0x7141f5b1
or edx, 8
cmp si, di
jne 0x7141f5b1
push 3
pop esi
cmp dx, di
jne 0x7141f5bb
mov dword [ebp - 0x14], edi
jmp 0x7141f600
mov cl, byte [ebp - 0x14]
xor eax, eax
inc eax
shl eax, cl
movzx ecx, dx
test ecx, eax
jne 0x7141f600
movzx eax, si
mov dword [ebp - 0x14], eax
jmp 0x7141f600
mov esi, dword [ebp + 8]
mov ecx, ebx
mov edi, 0x7141bed8
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x7141f5f9
cmp word [ebp - 0x14], 2
jb 0x7141f5f0
cmp word [ebp - 0x14], 5
jbe 0x7141f600
mov dword [ebp - 0x14], 5
jmp 0x7141f600
mov dword [ebp - 0x14], 3
movzx eax, word [ebp - 0x14]
sub eax, 3
je 0x7141f657
dec eax
je 0x7141f638
dec eax
je 0x7141f619
mov edi, 0x8007000e
jmp 0x7141f489
push 0x33c8
call fcn.71401f0d
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x7141f676
mov ecx, eax
call fcn.714296dc
jmp 0x7141f678
push 0x33c8
call fcn.71401f0d
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x7141f676
mov ecx, eax
call fcn.7141f380
jmp 0x7141f678
push 0x33c8
call fcn.71401f0d
pop ecx
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x7141f676
mov ecx, eax
call fcn.7141f330
jmp 0x7141f678
xor eax, eax
mov esi, eax
mov byte [ebp - 4], 0
test esi, esi
je 0x7141f60f
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebx + 0x2c]
call fcn.71425929
test eax, eax
je 0x7141f699
mov ecx, dword [ebx + 0x2c]
call fcn.714258d8
cmp byte [ebp - 0xd], 0
je 0x7141f6a6
or dword [esi + 0x2270], 2
push dword [ebp + 0x14]
mov eax, dword [esi]
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [eax + 0xc8]
mov edi, eax
test edi, edi
je 0x7141f6d4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xc4]
jmp 0x7141f489
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 4]
test dword [eax + 0xc], 0x80000
jne 0x7141f70e
cmp dword [esi + 0x2284], 3
jl 0x7141f70e
or dword [esi + 0x2270], 8
wait
fnstcw word [ebp + 8]
mov ax, word [ebp + 8]
and ax, 0xfcff
or ax, 0x3f
and ax, 0xf3ff
mov word [ebp + 0x14], ax
fldcw word [ebp + 0x14]
xor edi, edi
jmp 0x7141f489