Function at 0x410d3e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x410d44
call fcn.0042f040
push dword [esp + 0x5c]
call fcn.004176d0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00417000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00417000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00417000
push dword [esp]
call fcn.004123dd
push dword [esp + 8]
mov edx, 0x47b3cc
pop ecx
call fcn.00417660
je 0x410df1
cmp dword [0x8eedc8], 0
je 0x410dd5
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x8eede0]
or ebx, 0xf003f
push ebx
push 0
push dword [0x8eeda8]
push dword [0x8eedc4]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x410def
lea eax, [esp + 0x10]
push eax
push dword [0x8eeda8]
push dword [0x8eedc4]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x410e56
lea eax, [esp + 0x18]
push eax
push dword [0x8eedc4]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x8eedc8], 0
je 0x410e3e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x8eede0]
or ebx, 0xf003f
push ebx
push 0
push dword [0x8eeda8]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x410e56
lea eax, [esp + 0x10]
push eax
push dword [0x8eeda8]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x411130
mov dword [esp + 0x1c], 0x400
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
push dword [esp + 0x24]
call fcn.0042c710
lea eax, [esp + 0x24]
push eax
call fcn.0042ef70
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x411130
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x410f37
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x410f24
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0042d620
lea eax, [esp + 0x30]
push eax
call fcn.0042ef70
jmp 0x410f32
mov edx, 0x47b028
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x41112f
mov ebx, 2
cmp ebx, dword [esp]
jne 0x410fac
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x410f99
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.0042d620
lea eax, [esp + 0x30]
push eax
call fcn.0042ef70
jmp 0x410fa7
mov edx, 0x47b028
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x41112f
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41101e
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41100b
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.0042cc90
lea eax, [esp + 0x30]
push eax
call fcn.0042ef70
jmp 0x411019
mov edx, 0x47b40e
lea ecx, [esp + 0x2c]
call fcn.00417008
jmp 0x41112f
mov ebx, 3
cmp ebx, dword [esp]
jne 0x41112f
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.0042dd40
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41112f
mov edx, 0x47b028
lea ecx, [esp + 0x2c]
call fcn.00417008
mov dword [esp + 0x44], 0
jmp 0x411089
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x411126
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.00417610
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x4110e3
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
mov edx, 0x47b40e
push edx
call fcn.0042ef10
lea eax, [esp + 0x30]
push eax
call fcn.0042ef70
mov edx, dword [esp + 0x2c]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042eed0
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.0042cb40
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.0042ef70
inc dword [esp + 0x44]
jno 0x411089
push dword [esp + 0x3c]
call fcn.0042df20
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.0042eed0
pop edx
push eax
push edx
call fcn.0042ef10
pop eax
push eax
call fcn.004176a0
pop edx
add eax, edx
jmp 0x411161
push dword [esp + 8]
call fcn.0042f0d0
push dword [esp + 0x20]
call fcn.0042f0d0
push dword [esp]
call fcn.0042f0d0
push dword [esp + 4]
call fcn.0042f0d0
push dword [esp + 0x28]
call fcn.0042f0d0
add esp, 0x48
pop ebx
ret 0xc