Function at 0x100400eb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x100400f1
call fcn.100b8f80
push dword [esp + 0x48]
call fcn.10044410
mov edx, dword [esp + 0x3c]
lea ecx, [esp]
call fcn.10044060
mov edx, dword [esp + 0x40]
lea ecx, [esp + 4]
call fcn.10044060
mov edx, dword [esp + 0x44]
lea ecx, [esp + 8]
call fcn.10044060
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.100b6e90
call fcn.100b8f10
lea edx, [0x101f4b4c]
pop ecx
push ecx
call fcn.10044460
mov ecx, eax
call fcn.10044420
je 0x1004019b
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
push dword [esp + 8]
call fcn.100b6b00
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.100b6f00
lea eax, [esp + 4]
push eax
call fcn.100b9010
push dword [esp + 8]
lea edx, [0x101f40a8]
pop ecx
call fcn.10044420
je 0x100401cf
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x48]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x10040205
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push dword [esp + 0xc]
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x10040354
mov dword [esp + 0x1c], 0xff
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
push 0xff
call fcn.100b65d0
lea eax, [esp + 0x18]
push eax
call fcn.100b9010
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x10040354
push dword [esp + 0x20]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x100402e5
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x100402d4
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x24]
call fcn.100b6e90
lea eax, [esp + 0x34]
push eax
call fcn.100b9010
jmp 0x100402e3
lea edx, [0x101f40a8]
lea ecx, [esp + 0x30]
call fcn.10044068
jmp 0x10040353
mov ebx, 4
cmp ebx, dword [esp]
jne 0x10040353
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.DLL_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x10040344
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8e70
pop edx
push eax
mov eax, dword [esp + 0x24]
cdq
push edx
push eax
call fcn.100b69a0
lea eax, [esp + 0x34]
push eax
call fcn.100b9010
jmp 0x10040353
lea edx, [0x101f46b2]
lea ecx, [esp + 0x30]
call fcn.10044068
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0x2c]
push edx
call fcn.100b8e70
pop edx
push eax
push edx
call fcn.100b8eb0
pop eax
push eax
call fcn.100443e0
pop edx
add eax, edx
jmp 0x10040385
push dword [esp + 8]
call fcn.100b8fe0
push dword [esp + 0x14]
call fcn.100b8fe0
push dword [esp + 4]
call fcn.100b8fe0
push dword [esp]
call fcn.100b8fe0
push dword [esp + 0x2c]
call fcn.100b8fe0
add esp, 0x30
pop ebx
ret 0x10