Function at 0x441294
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44129a
mov eax, dword [esp + 0x64]
mov dword [0x54e9c4], eax
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.0043a610
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.0043a610
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.0043a610
push dword [esp]
call fcn.00441dbc
mov dword [esp + 0xc], eax
push dword [0x54e9c4]
push dword [esp + 4]
call fcn.00441eac
lea eax, [esp + 0x14]
push eax
call fcn.00462b10
mov edx, 0x514aa1
lea ecx, [esp + 0x18]
call fcn.0043a618
mov eax, dword [0x54e9c4]
push eax
push eax
push 1
push dword [esp + 0x1c]
call fcn.00443470
inc dword [0x54e9c4]
mov edx, str._aAb
pop ecx
mov dword [0x54e9c4], ecx
add ecx, dword [0x5148c0]
call fcn.00462bf0
je 0x441364
mov eax, dword [0x54e9c4]
push eax
push eax
push dword [esp + 0x18]
call fcn.00442430
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x1c]
call fcn.00442dd0
lea eax, [esp + 0x14]
push eax
call fcn.00462b10
push dword [esp + 8]
mov edx, 0x514c57
pop ecx
call fcn.00462bf0
je 0x44138d
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegOpenKeyA
mov dword [esp + 0x1c], eax
jmp 0x4413b9
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
call sub.ADVAPI32.DLL_RegConnectRegistryA
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegOpenKeyA
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x44165a
mov dword [esp + 0x2c], 0xff
mov eax, dword [0x54e9c4]
push eax
push eax
push 0xff
call fcn.004434e0
lea eax, [esp + 0x18]
push eax
call fcn.00462b10
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x34]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x44165a
push dword [esp + 0x30]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x441489
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x441476
mov eax, dword [0x54e9c4]
push eax
push eax
mov ebx, dword [esp + 0x38]
dec ebx
push ebx
push dword [esp + 0x24]
call fcn.00443470
lea eax, [esp + 0x20]
push eax
call fcn.00462b10
jmp 0x441484
mov edx, 0x514aa1
lea ecx, [esp + 0x1c]
call fcn.0043a618
jmp 0x441659
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4414f5
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x4414e2
mov eax, dword [0x54e9c4]
push eax
push eax
mov ebx, dword [esp + 0x38]
dec ebx
push ebx
push dword [esp + 0x24]
call fcn.00443470
lea eax, [esp + 0x20]
push eax
call fcn.00462b10
jmp 0x4414f0
mov edx, 0x514aa1
lea ecx, [esp + 0x1c]
call fcn.0043a618
jmp 0x441659
mov ebx, 4
cmp ebx, dword [esp]
jne 0x44155e
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x40]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x44154b
mov eax, dword [0x54e9c4]
push eax
push eax
mov eax, dword [esp + 0x44]
cdq
push edx
push eax
call fcn.00442150
lea eax, [esp + 0x20]
push eax
call fcn.00462b10
jmp 0x441559
mov edx, 0x514c89
lea ecx, [esp + 0x1c]
call fcn.0043a618
jmp 0x441659
mov ebx, 3
cmp ebx, dword [esp]
jne 0x441659
mov dword [esp + 0x40], 0x400
push dword [esp + 0x40]
call fcn.00454560
mov dword [esp + 0x44], eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x48]
lea eax, [esp + 0x50]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x38]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [esp + 0x20], eax
mov ebx, dword [esp + 0x20]
and ebx, ebx
jne 0x441659
mov edx, 0x514aa1
lea ecx, [esp + 0x1c]
call fcn.0043a618
mov dword [esp + 0x4c], 0
mov ebx, dword [esp + 0x40]
dec ebx
cmp ebx, dword [esp + 0x4c]
jl 0x441650
mov ebx, dword [esp + 0x44]
add ebx, dword [esp + 0x4c]
mov eax, ebx
call fcn.00454a20
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0x50]
cmp ebx, 0x10
jge 0x441619
mov edx, dword [esp + 0x1c]
push dword [0x54e9c4]
call fcn.00462b90
mov edx, 0x514c89
call fcn.00462b90
lea eax, [esp + 0x20]
push eax
call fcn.00462b10
mov edx, dword [esp + 0x1c]
push dword [0x54e9c4]
call fcn.00462b90
mov eax, dword [0x54e9c4]
push eax
push eax
mov eax, dword [esp + 0x5c]
cdq
push edx
push eax
call fcn.00442d30
pop eax
lea eax, [esp + 0x20]
push eax
call fcn.00462b10
inc dword [esp + 0x4c]
jno 0x4415c7
push dword [esp + 0x44]
call fcn.004548c0
pop eax
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [esp + 0x18]
push dword [0x54e9c4]
call fcn.00462b90
pop eax
add eax, dword [0x5148c0]
jmp 0x441689
push dword [esp]
call fcn.00462c80
push dword [esp + 4]
call fcn.00462c80
push dword [esp + 8]
call fcn.00462c80
push dword [esp + 0x10]
call fcn.00462c80
push dword [esp + 0x14]
call fcn.00462c80
push dword [esp + 0x18]
call fcn.00462c80
add esp, 0x50
pop ebx
ret 0xc