Function at 0x41891c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x418922
call fcn.004553e0
push dword [esp + 0x5c]
call fcn.0041e6b0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0041e000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0041e000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0041e000
push dword [esp]
call fcn.00419fbb
push dword [esp + 8]
mov edx, 0x57aaa0
pop ecx
call fcn.0041e640
je 0x4189cf
cmp dword [0x60af38], 0
je 0x4189b3
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x60af50]
or ebx, 0xf003f
push ebx
push 0
push dword [0x60af18]
push dword [0x60af34]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4189cd
lea eax, [esp + 0x10]
push eax
push dword [0x60af18]
push dword [0x60af34]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x418a34
lea eax, [esp + 0x18]
push eax
push dword [0x60af34]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x60af38], 0
je 0x418a1c
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x60af50]
or ebx, 0xf003f
push ebx
push 0
push dword [0x60af18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x418a34
lea eax, [esp + 0x10]
push eax
push dword [0x60af18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x418d0e
mov dword [esp + 0x1c], 0x400
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
push dword [esp + 0x24]
call fcn.00452d10
lea eax, [esp + 0x24]
push eax
call fcn.004552e0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x418d0e
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x418b15
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x418b02
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00453830
lea eax, [esp + 0x30]
push eax
call fcn.004552e0
jmp 0x418b10
mov edx, 0x57a126
lea ecx, [esp + 0x2c]
call fcn.0041e008
jmp 0x418d0d
mov ebx, 2
cmp ebx, dword [esp]
jne 0x418b8a
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x418b77
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00453830
lea eax, [esp + 0x30]
push eax
call fcn.004552e0
jmp 0x418b85
mov edx, 0x57a126
lea ecx, [esp + 0x2c]
call fcn.0041e008
jmp 0x418d0d
mov ebx, 4
cmp ebx, dword [esp]
jne 0x418bfc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x418be9
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004533c0
lea eax, [esp + 0x30]
push eax
call fcn.004552e0
jmp 0x418bf7
mov edx, 0x57aae2
lea ecx, [esp + 0x2c]
call fcn.0041e008
jmp 0x418d0d
mov ebx, 3
cmp ebx, dword [esp]
jne 0x418d0d
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.00454140
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x418d0d
mov edx, 0x57a126
lea ecx, [esp + 0x2c]
call fcn.0041e008
mov dword [esp + 0x44], 0
jmp 0x418c67
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x418d04
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.0041e5f0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x418cc1
mov edx, dword [esp + 0x2c]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
mov edx, 0x57aae2
push edx
call fcn.00455280
lea eax, [esp + 0x30]
push eax
call fcn.004552e0
mov edx, dword [esp + 0x2c]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455240
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00452bf0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004552e0
inc dword [esp + 0x44]
jno 0x418c67
push dword [esp + 0x3c]
call fcn.00454160
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.00455240
pop edx
push eax
push edx
call fcn.00455280
pop eax
push eax
call fcn.0041e680
pop edx
add eax, edx
jmp 0x418d3f
push dword [esp + 8]
call fcn.00455440
push dword [esp + 0x20]
call fcn.00455440
push dword [esp]
call fcn.00455440
push dword [esp + 4]
call fcn.00455440
push dword [esp + 0x28]
call fcn.00455440
add esp, 0x48
pop ebx
ret 0xc