Function at 0x10004f31
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
sub edx, 1
jne 0x10004f37
call fcn.1004faf0
push dword [esp + 0x64]
call fcn.1000f300
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.1000f000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.1000f000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.1000f000
push dword [esp]
call fcn.1000c276
mov dword [esp + 0xc], eax
push edx
call fcn.1004fb60
pop edx
push eax
push dword [esp + 4]
call fcn.100081e3
lea eax, [esp + 0x14]
push eax
call fcn.1004fb90
lea edx, [0x101d7028]
lea ecx, [esp + 0x18]
call fcn.1000f008
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
push 1
push dword [esp + 0x1c]
call fcn.1004d4b0
call fcn.1004fca0
lea edx, [0x101d71b2]
pop ecx
push ecx
call fcn.1000f310
mov ecx, eax
call fcn.1000f320
je 0x1000501b
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
push dword [esp + 0x18]
call fcn.1004d520
mov ebx, eax
sub ebx, 1
push ebx
push dword [esp + 0x1c]
call fcn.1004d550
lea eax, [esp + 0x14]
push eax
call fcn.1004fb90
push dword [esp + 8]
lea edx, [0x101d70c0]
pop ecx
call fcn.1000f320
je 0x10005045
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0x1c], eax
jmp 0x10005071
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push dword [esp + 0x30]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x10005357
mov dword [esp + 0x2c], 0xff
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
push 0xff
call fcn.1004d3f0
lea eax, [esp + 0x18]
push eax
call fcn.1004fb90
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x34]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x10005357
push dword [esp + 0x30]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x10005156
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x10005142
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
mov ebx, dword [esp + 0x38]
sub ebx, 1
push ebx
push dword [esp + 0x24]
call fcn.1004d4b0
lea eax, [esp + 0x20]
push eax
call fcn.1004fb90
jmp 0x10005151
lea edx, [0x101d7028]
lea ecx, [esp + 0x1c]
call fcn.1000f008
jmp 0x10005356
mov ebx, 2
cmp ebx, dword [esp]
jne 0x100051ce
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x100051ba
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
mov ebx, dword [esp + 0x38]
sub ebx, 1
push ebx
push dword [esp + 0x24]
call fcn.1004d4b0
lea eax, [esp + 0x20]
push eax
call fcn.1004fb90
jmp 0x100051c9
lea edx, [0x101d7028]
lea ecx, [esp + 0x1c]
call fcn.1000f008
jmp 0x10005356
mov ebx, 4
cmp ebx, dword [esp]
jne 0x10005241
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x40]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x1000522d
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
mov eax, dword [esp + 0x44]
cdq
push edx
push eax
call fcn.1004d5c0
lea eax, [esp + 0x20]
push eax
call fcn.1004fb90
jmp 0x1000523c
lea edx, [0x101d70c4]
lea ecx, [esp + 0x1c]
call fcn.1000f008
jmp 0x10005356
mov ebx, 3
cmp ebx, dword [esp]
jne 0x10005356
mov dword [esp + 0x40], 0x400
push dword [esp + 0x40]
call fcn.1004eaa0
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x48]
lea eax, [esp + 0x50]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x10005356
lea edx, [0x101d7028]
lea ecx, [esp + 0x1c]
call fcn.1000f008
mov dword [esp + 0x4c], 0
jmp 0x100052ad
mov ebx, dword [esp + 0x40]
sub ebx, 1
cmp ebx, dword [esp + 0x4c]
jl 0x1000534d
mov ebx, dword [esp + 0x44]
add ebx, dword [esp + 0x4c]
push ebx
call fcn.1004eb60
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0x50]
cmp ebx, 0x10
jge 0x10005309
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fc50
lea edx, [0x101d70c4]
push edx
call fcn.1004fc50
lea eax, [esp + 0x20]
push eax
call fcn.1004fb90
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fc50
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fb60
pop edx
push eax
mov eax, dword [esp + 0x5c]
cdq
push edx
push eax
call fcn.1004d270
pop eax
lea eax, [esp + 0x20]
push eax
call fcn.1004fb90
sub dword [esp + 0x4c], 0xffffffff
jno 0x100052ad
push dword [esp + 0x44]
call fcn.1004eb10
pop eax
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x18]
push edx
call fcn.1004fb60
pop edx
push eax
push edx
call fcn.1004fc50
pop eax
push eax
call fcn.1000f2d0
pop edx
add eax, edx
jmp 0x10005388
push dword [esp + 8]
call fcn.1004fc20
push dword [esp + 0x14]
call fcn.1004fc20
push dword [esp + 0x10]
call fcn.1004fc20
push dword [esp]
call fcn.1004fc20
push dword [esp + 4]
call fcn.1004fc20
push dword [esp + 0x18]
call fcn.1004fc20
add esp, 0x50
pop ebx
ret 0xc