Function at 0x419e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x42c080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x4291bc
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x419eac
jmp 0x41a10a
mov dword [ebp - 4], 3
mov dword [ebp - 0x21c], 0x208
mov byte [ebp - 0x218], 0
push 0x207
push 0
lea ecx, [ebp - 0x217]
push ecx
call fcn.00409050
add esp, 0xc
mov dword [ebp - 0x224], 0
jmp 0x419ef5
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
cmp dword [ebp - 0x224], 5
jge 0x419fd9
mov dword [ebp - 4], 3
mov dword [ebp - 0x21c], 0x208
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00409050
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0x224]
imul ecx, ecx, 0x22
add ecx, str.Rectangle
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419fb5
cmp dword [ebp - 4], 3
jne 0x419fb5
cmp dword [ebp - 0x21c], 0xc
jne 0x419fb5
mov eax, dword [ebp - 0x224]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x218]
mov dword [ecx + eax + 0x14], edx
mov eax, dword [ebp - 0x224]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x214]
mov dword [ecx + eax + 0x18], edx
mov eax, dword [ebp - 0x224]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x22c]
mov edx, dword [ebp - 0x210]
mov dword [ecx + eax + 0x1c], edx
mov eax, dword [ebp - 0x224]
imul eax, eax, 0xc
mov ecx, dword [ebp - 0x22c]
lea edx, [ecx + eax + 0x14]
push edx
mov ecx, dword [ebp - 0x22c]
call fcn.00418340
jmp 0x419ee6
mov dword [ebp - 4], 4
mov dword [ebp - 0x21c], 0x208
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00409050
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.LastSavedFormat
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a055
cmp dword [ebp - 4], 4
jne 0x41a055
mov edx, dword [ebp - 0x218]
mov dword [0x42e294], edx
cmp dword [0x42e294], 0
jl 0x41a04b
cmp dword [0x42e294], 2
jle 0x41a055
mov dword [0x42e294], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x21c], 0x208
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.00409050
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.LastSavedDir
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a100
cmp dword [ebp - 4], 1
jne 0x41a100
lea edx, [ebp - 0x218]
push edx
push 0x42e298
call fcn.00406780
add esp, 8
push 0
push 0x2000010
push 3
push 0
push 0
push 0x40000000
push 0x42e298
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffff
jne 0x41a0f3
xor eax, eax
mov word [0x42e298], ax
jmp 0x41a100
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00407e44
mov esp, ebp
pop ebp
ret