Function at 0x4541be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4541c4
call fcn.004d5b50
push dword [esp + 0x5c]
call fcn.00456440
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00456000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00456000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00456000
push dword [esp]
call fcn.0045486a
push dword [esp + 8]
mov edx, 0x5ee70c
pop ecx
call fcn.004563d0
je 0x454271
cmp dword [0x14c673c], 0
je 0x454255
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x14c6740]
or ebx, 0xf003f
push ebx
push 0
push dword [0x14c6730]
push dword [0x14c6738]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x45426f
lea eax, [esp + 0x10]
push eax
push dword [0x14c6730]
push dword [0x14c6738]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x4542d6
lea eax, [esp + 0x18]
push eax
push dword [0x14c6738]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x14c673c], 0
je 0x4542be
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x14c6740]
or ebx, 0xf003f
push ebx
push 0
push dword [0x14c6730]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4542d6
lea eax, [esp + 0x10]
push eax
push dword [0x14c6730]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4545af
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a40
pop edx
push eax
push dword [esp + 0x24]
call fcn.004d3530
lea eax, [esp + 0x24]
push eax
call fcn.004d5ac0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4545af
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x4543b7
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4543a4
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a40
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004d3ff0
lea eax, [esp + 0x30]
push eax
call fcn.004d5ac0
jmp 0x4543b2
mov edx, 0x5ed0c4
lea ecx, [esp + 0x2c]
call fcn.00456008
jmp 0x4545ae
mov ebx, 2
cmp ebx, dword [esp]
jne 0x45442c
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x454419
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a40
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004d3ff0
lea eax, [esp + 0x30]
push eax
call fcn.004d5ac0
jmp 0x454427
mov edx, 0x5ed0c4
lea ecx, [esp + 0x2c]
call fcn.00456008
jmp 0x4545ae
mov ebx, 4
cmp ebx, dword [esp]
jne 0x45449e
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x45448b
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a40
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004d32f0
lea eax, [esp + 0x30]
push eax
call fcn.004d5ac0
jmp 0x454499
mov edx, 0x5ee8a0
lea ecx, [esp + 0x2c]
call fcn.00456008
jmp 0x4545ae
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4545ae
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004d4990
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4545ae
mov edx, 0x5ed0c4
lea ecx, [esp + 0x2c]
call fcn.00456008
mov dword [esp + 0x44], 0
jmp 0x454509
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x4545a5
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
call fcn.004d4ce0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x454562
mov edx, dword [esp + 0x2c]
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a70
mov edx, 0x5ee8a0
push edx
call fcn.004d5a70
lea eax, [esp + 0x30]
push eax
call fcn.004d5ac0
mov edx, dword [esp + 0x2c]
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a70
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a40
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004d3660
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004d5ac0
inc dword [esp + 0x44]
jno 0x454509
push dword [esp + 0x3c]
call fcn.004d4930
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004d5a40
pop edx
push eax
push edx
call fcn.004d5a70
pop eax
push eax
call fcn.00456410
pop edx
add eax, edx
jmp 0x4545e0
push dword [esp + 8]
call fcn.004d5bc0
push dword [esp + 0x20]
call fcn.004d5bc0
push dword [esp]
call fcn.004d5bc0
push dword [esp + 4]
call fcn.004d5bc0
push dword [esp + 0x28]
call fcn.004d5bc0
add esp, 0x48
pop ebx
ret 0xc