Function at 0x4af108
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
pushal
mov esi, eax
mov dword [esp + 0x20], ebx
mov edi, ecx
lea eax, [esp + 0x28]
call fcn.00425dec
mov eax, 0x3014
call fcn.00467104
mov edx, eax
mov dword [esp + 0x24], edx
mov eax, edx
mov ebx, 0x5aee24
mov ecx, 0
call fcn.00423ae0
mov dword [edx], esi
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call fcn.00425f5c
call fcn.004206fb
lea eax, [edx + 4]
mov ebx, 0x1000
call fcn.00426028
lea eax, [edx + 0x1004]
mov ebx, 0x1000
mov ecx, 0x5aec8c
mov edx, 0
call fcn.004208b6
mov eax, dword [esp + 0x24]
mov dword [eax + 0x3004], 0x1000
mov dword [eax + 0x3010], 0
mov byte [edi], 0
lea ebx, [eax + 0x3004]
push ebx
push 0
lea ebx, [eax + 0x300c]
push ebx
push 0
lea ebx, [eax + 4]
push ebx
mov eax, dword [eax]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0x3008], eax
cmp dword [ecx + 0x3008], 0
jne 0x4af381
mov eax, dword [esp + 0x20]
cmp dword [ecx + 0x300c], eax
jne 0x4af408
cmp eax, 3
jne 0x4af266
lea eax, [ecx + 0x3004]
push eax
lea eax, [ecx + 0x2004]
push eax
lea eax, [ecx + 0x300c]
push eax
push 0
lea eax, [ecx + 4]
push eax
mov eax, dword [ecx]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0x3008], eax
cmp dword [ecx + 0x3008], 0
jne 0x4af408
mov eax, dword [ecx + 0x3004]
lea eax, [ecx + eax + 0x2004]
mov ecx, dword [ecx + 0x3004]
inc ecx
mov ebx, ecx
dec ecx
sub ebx, ecx
mov ecx, 0x5aec8c
mov edx, 1
call fcn.004208b6
mov byte [edi], 1
mov ecx, dword [esp + 0x24]
lea eax, [ecx + 0x2004]
mov ebx, dword [ecx + 0x3004]
call fcn.00425f5c
call fcn.00425e70
jmp 0x4af41f
cmp eax, 4
jne 0x4af31b
lea esi, [ecx + 0x2004]
mov eax, esi
mov ebx, 0x1000
mov ecx, 0
mov edx, 0xffffffff
call fcn.004208b6
mov eax, dword [esp + 0x24]
lea ebx, [eax + 0x3004]
push ebx
push esi
lea ebx, [eax + 0x300c]
push ebx
push 0
lea ebx, [eax + 4]
push ebx
mov eax, dword [eax]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0x3008], eax
cmp dword [ecx + 0x3008], 0
jne 0x4af408
mov eax, dword [ecx + 0x3004]
lea eax, [ecx + eax + 0x2004]
mov ecx, dword [ecx + 0x3004]
inc ecx
mov ebx, ecx
dec ecx
sub ebx, ecx
mov ecx, 0x5aec90
mov edx, 1
call fcn.004208b6
mov byte [edi], 1
mov eax, str.Error_returned_from_RegGetValue_
mov ebx, 0
call fcn.00425f5c
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx + 0x2004]
call fcn.00425c64
call fcn.00425618
call fcn.00425e70
jmp 0x4af41f
lea eax, [ecx + 0x3004]
push eax
lea eax, [ecx + 0x2004]
push eax
lea eax, [ecx + 0x300c]
push eax
push 0
lea eax, [ecx + 4]
push eax
mov eax, dword [ecx]
push eax
call sub.ADVAPI32.dll_RegQueryValueExA
mov ecx, dword [esp + 0x24]
mov dword [ecx + 0x3008], eax
cmp dword [ecx + 0x3008], 0
jne 0x4af408
cmp dword [ecx + 0x3004], 1
jle 0x4af408
mov byte [edi], 1
lea eax, [ecx + 0x2004]
mov ebx, dword [ecx + 0x3004]
dec ebx
call fcn.00425f5c
call fcn.00425e70
jmp 0x4af41f
cmp dword [ecx + 0x3008], 2
je 0x4af408
mov eax, str.Error_returned_from_RegGetValue_
mov ebx, 0x22
call fcn.00425f5c
mov eax, dword [ecx + 0x3008]
call fcn.00425c64
call fcn.00425618
mov eax, str._HKEY___value_
mov ebx, 8
call fcn.00425f5c
call fcn.00425618
mov eax, esi
call fcn.00425c64
call fcn.00425618
mov eax, 0x5aecc0
mov ebx, 9
call fcn.00425f5c
call fcn.00425618
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
call fcn.00425f5c
call fcn.00425618
mov eax, str.Reg_GetValueError_returned_from_RegCloseKey_
mov ebx, 0xc
call fcn.00425f5c
mov eax, 0x64
call fcn.004a7a20
mov byte [edi], 0
mov eax, 0x5aecd8
mov ebx, 0
call fcn.00425f5c
call fcn.00425e70
mov eax, ecx
call fcn.0046688c
lea eax, [esp + 0x28]
call fcn.004133a8
popal
add esp, 0x10
ret