Function at 0x41d534
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41d53a
call fcn.004644e0
push dword [esp + 0x5c]
call fcn.00423790
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00423000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00423000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00423000
push dword [esp]
call fcn.0041ebd3
push dword [esp + 8]
mov edx, 0x4bdc72
pop ecx
call fcn.00423720
je 0x41d5e7
cmp dword [0x62c640], 0
je 0x41d5cb
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x62c658]
or ebx, 0xf003f
push ebx
push 0
push dword [0x62c620]
push dword [0x62c63c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41d5e5
lea eax, [esp + 0x10]
push eax
push dword [0x62c620]
push dword [0x62c63c]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x41d64c
lea eax, [esp + 0x18]
push eax
push dword [0x62c63c]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x62c640], 0
je 0x41d634
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x62c658]
or ebx, 0xf003f
push ebx
push 0
push dword [0x62c620]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x41d64c
lea eax, [esp + 0x10]
push eax
push dword [0x62c620]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41d926
mov dword [esp + 0x1c], 0x400
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push dword [esp + 0x24]
call fcn.00461d60
lea eax, [esp + 0x24]
push eax
call fcn.004643e0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x41d926
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x41d72d
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d71a
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00462b80
lea eax, [esp + 0x30]
push eax
call fcn.004643e0
jmp 0x41d728
mov edx, 0x4bd050
lea ecx, [esp + 0x2c]
call fcn.00423008
jmp 0x41d925
mov ebx, 2
cmp ebx, dword [esp]
jne 0x41d7a2
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d78f
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.00462b80
lea eax, [esp + 0x30]
push eax
call fcn.004643e0
jmp 0x41d79d
mov edx, 0x4bd050
lea ecx, [esp + 0x2c]
call fcn.00423008
jmp 0x41d925
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41d814
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d801
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.00462480
lea eax, [esp + 0x30]
push eax
call fcn.004643e0
jmp 0x41d80f
mov edx, 0x4bdd0c
lea ecx, [esp + 0x2c]
call fcn.00423008
jmp 0x41d925
mov ebx, 3
cmp ebx, dword [esp]
jne 0x41d925
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004631b0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41d925
mov edx, 0x4bd050
lea ecx, [esp + 0x2c]
call fcn.00423008
mov dword [esp + 0x44], 0
jmp 0x41d87f
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x41d91c
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.004236d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x41d8d9
mov edx, dword [esp + 0x2c]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, 0x4bdd0c
push edx
call fcn.00464380
lea eax, [esp + 0x30]
push eax
call fcn.004643e0
mov edx, dword [esp + 0x2c]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.00461c40
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004643e0
inc dword [esp + 0x44]
jno 0x41d87f
push dword [esp + 0x3c]
call fcn.00463390
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
pop eax
push eax
call fcn.00423760
pop edx
add eax, edx
jmp 0x41d957
push dword [esp + 8]
call fcn.00464570
push dword [esp + 0x20]
call fcn.00464570
push dword [esp]
call fcn.00464570
push dword [esp + 4]
call fcn.00464570
push dword [esp + 0x28]
call fcn.00464570
add esp, 0x48
pop ebx
ret 0xc