Function at 0x401680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x10], 0
jmp 0x401698
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
push ecx
call 0x400000
add esp, 4
cmp dword [ebp - 0x10], eax
jae 0x4016f4
mov edx, dword [ebp - 0x10]
push edx
push 0x42829c
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4016f2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + eax*4], edx
jmp 0x40168f
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x4282bc
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401725
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x48], edx
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x4282d4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401756
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x4c], edx
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x4282f0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401787
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x7c], edx
mov dword [ebp - 8], 0xc8
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x88
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x428308
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x42831c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4017e5
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x42833c
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40186c
mov edx, dword [ebp - 4]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x14], 0
je 0x40184d
push 0x60
call dword [sym.imp.USER32.dll_GetDpiForSystem]
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x44], eax
cmp dword [ebp - 0x18], 0
je 0x40186c
push 0x60
call dword [sym.imp.USER32.dll_GetDpiForSystem]
push eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x40], eax
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x428350
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4018a0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x84], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x428368
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4018d1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x58], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x42838c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401902
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x5c], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push str.wszInsertMode
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401933
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x60], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x4283c4
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401964
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x64], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x4283d8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401995
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x54], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x4283f0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4019c6
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x68], ecx
mov dword [ebp - 8], 4
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x428404
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a13
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x70], ecx
mov eax, dword [ebp - 4]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x6c], ecx
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x428428
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a44
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x50], edx
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
push 0x428444
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401a93
mov ecx, dword [ebp - 4]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x78], edx
mov ecx, dword [ebp - 4]
and ecx, 0xffff
movzx edx, cx
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x74], edx
mov esp, ebp
pop ebp
ret