Function at 0x441edb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x109
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x441ee1
call fcn.0055ab90
push dword [esp + 0x438]
call fcn.004f4350
mov edx, dword [esp + 0x430]
lea ecx, [esp]
call fcn.004f4000
mov edx, dword [esp + 0x434]
lea ecx, [esp + 4]
call fcn.004f4000
mov dword [section..data], 0x1700051
mov dword [section..data], 0x1700061
mov dword [0x6720ec], 0
mov dword [section..data], 0x1700062
mov edx, 0x6355da
lea ecx, [esp + 0x414]
call fcn.004f4008
mov dword [section..data], 0x1700066
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00549920
call fcn.0055ab20
mov edx, 0x63abd4
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x441fd3
mov dword [section..data], 0x1700066
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 8]
call fcn.00548f60
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00549830
lea eax, [esp + 4]
push eax
call fcn.0055aa30
mov dword [section..data], 0x1700066
mov dword [section..data], 0x1700067
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00549830
call fcn.0055ab20
mov edx, 0x63abd4
pop ecx
push ecx
call fcn.004f4360
mov ecx, eax
call fcn.004f4370
je 0x442059
mov dword [section..data], 0x1700067
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [esp + 8]
call fcn.00548f60
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00549920
lea eax, [esp + 4]
push eax
call fcn.0055aa30
mov dword [section..data], 0x1700067
mov dword [section..data], 0x1700069
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x43c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
mov dword [section..data], 0x170006b
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x4423fa
mov dword [section..data], 0x170006d
mov dword [esp + 0x41c], 0x1ff
mov dword [section..data], 0x170006e
lea eax, [esp + 0x41c]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x420]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov dword [section..data], 0x170006f
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44239d
mov dword [section..data], 0x1700071
push dword [esp + 0x418]
mov dword [section..data], 0x1700072
mov ebx, 1
cmp ebx, dword [esp]
jne 0x442220
mov dword [section..data], 0x1700073
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x424]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov dword [section..data], 0x1700074
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4421e2
mov dword [section..data], 0x1700075
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov ebx, dword [esp + 0x428]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
dec ebx
push ebx
lea edx, [esp + 0x24]
push edx
call fcn.0055a9f0
pop edx
push eax
push 0x200
push edx
call fcn.0055ac50
call fcn.004f4332
add dword [esp], edx
call fcn.00549920
lea eax, [esp + 0x41c]
push eax
call fcn.0055aa30
mov dword [section..data], 0x1700076
jmp 0x442207
mov dword [section..data], 0x1700076
mov dword [section..data], 0x1700077
mov edx, 0x6355da
lea ecx, [esp + 0x418]
call fcn.004f4008
mov dword [section..data], 0x1700078
mov dword [section..data], 0x1700079
jmp 0x4422f3
mov dword [section..data], 0x1700079
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4422f3
mov dword [section..data], 0x170007a
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x424]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov dword [section..data], 0x170007b
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4422c4
mov dword [section..data], 0x170007c
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055a9f0
pop edx
push eax
mov eax, dword [esp + 0x42c]
cdq
push edx
push eax
call fcn.00548d10
lea eax, [esp + 0x41c]
push eax
call fcn.0055aa30
mov dword [section..data], 0x170007d
jmp 0x4422e9
mov dword [section..data], 0x170007d
mov dword [section..data], 0x170007e
mov edx, 0x6355da
lea ecx, [esp + 0x418]
call fcn.004f4008
mov dword [section..data], 0x170007f
mov dword [section..data], 0x1700080
pop eax
mov dword [section..data], 0x1700081
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44232e
mov dword [section..data], 0x1700082
mov dword [esp + 0x10], 1
mov dword [section..data], 0x1700083
jmp 0x442387
mov dword [section..data], 0x1700083
mov dword [section..data], 0x1700084
push dword [esp + 0xc]
pop eax
mov dword [0x6720ec], eax
mov dword [section..data], 0x1700085
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [0x6720ec]
call fcn.00441d7e
lea eax, [0x6720f0]
push eax
call fcn.0055aa30
mov dword [section..data], 0x1700086
mov dword [esp + 0x10], 0
mov dword [section..data], 0x1700087
mov dword [section..data], 0x1700088
jmp 0x4423e4
mov dword [section..data], 0x1700088
mov dword [section..data], 0x1700089
push dword [esp + 0xc]
pop eax
mov dword [0x6720ec], eax
mov dword [section..data], 0x170008a
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [0x6720ec]
call fcn.00441d7e
lea eax, [0x6720f0]
push eax
call fcn.0055aa30
mov dword [section..data], 0x170008b
mov dword [section..data], 0x170008c
jmp 0x442441
mov dword [section..data], 0x170008c
mov dword [section..data], 0x170008d
push dword [esp + 0xc]
pop eax
mov dword [0x6720ec], eax
mov dword [section..data], 0x170008e
push edx
call fcn.0055a9f0
pop edx
push eax
push dword [0x6720ec]
call fcn.00441d7e
lea eax, [0x6720f0]
push eax
call fcn.0055aa30
mov dword [section..data], 0x170008f
mov dword [section..data], 0x1700092
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [section..data], 0x1700094
mov edx, dword [esp + 0x414]
push edx
call fcn.0055a9f0
pop edx
push eax
push edx
call fcn.0055aac0
pop eax
push eax
call fcn.004f4320
pop edx
add eax, edx
jmp 0x44249d
push dword [esp + 4]
call fcn.0055abf0
push dword [esp]
call fcn.0055abf0
push dword [esp + 0x414]
call fcn.0055abf0
add esp, 0x424
pop ebx
ret 0xc