Function at 0x401a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x6c]
mov dword [esp], eax
call fcn.00443940
sub esp, 4
call fcn.004438e0
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
lea eax, [esp + 0x64]
mov dword [esp], eax
call fcn.00443d50
sub esp, 8
mov eax, dword [esp + 0x68]
mov dword [esp + 4], eax
lea eax, [esp + 0x68]
mov dword [esp], eax
call fcn.00443d50
sub esp, 8
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], 0xff
call fcn.00440f50
sub esp, 8
call fcn.004439d0
mov dword [esp + 4], eax
lea esi, [esp + 0x2c]
mov dword [esp], esi
call fcn.00443b80
sub esp, 8
mov dword [esp + 0x30], 0xff
lea eax, [esp + 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov eax, dword [esp + 0x64]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x401bf0
mov eax, dword [esp + 0x34]
lea ebp, [esp + 0x30]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0
lea edi, [esp + 0x38]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov edx, dword [esp + 0x68]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegQueryValueExW
sub esp, 0x18
mov ebx, eax
test eax, eax
je 0x401c78
mov dword [esp + 4], 0x45a954
mov dword [esp], esi
call fcn.00443ca0
sub esp, 8
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegCloseKey
sub esp, 4
jmp 0x401c03
mov dword [esp + 4], 0x45a954
mov dword [esp], esi
call fcn.00443ca0
sub esp, 8
call fcn.00443980
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00443c10
sub esp, 4
call fcn.00443ad0
mov ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, dword [esp + 0x64]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.00443c70
sub esp, 4
mov eax, ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov edx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00440f50
sub esp, 8
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00443b80
sub esp, 8
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov edx, dword [esp + 0x68]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegQueryValueExW
sub esp, 0x18
mov eax, dword [esp + 0x38]
cmp eax, 7
jne 0x401bda
mov dword [esp + 4], 0x45a954
lea edi, [esp + 0x28]
mov dword [esp], edi
call fcn.00443ca0
sub esp, 8
mov dword [esp + 4], 0x45a954
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00443ca0
sub esp, 8
mov eax, dword [esp + 0x30]
test eax, eax
jg 0x401d83
lea esi, [esi]
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.004411a0
sub esp, 8
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00443b80
sub esp, 8
jmp 0x401bda
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004411c0
sub esp, 4
lea ebx, [ebx + eax + 2]
mov eax, dword [esp + 0x30]
cmp eax, ebx
jle 0x401d28
call fcn.00443980
call fcn.00443980
mov ebp, dword [esp + 0x2c]
add ebp, ebx
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.00443440
sub esp, 8
call fcn.004439d0
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00443b80
sub esp, 8
call fcn.00443980
call fcn.00443980
call fcn.004439d0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00441280
sub esp, 8
call fcn.00443b50
call fcn.00443a80
mov dword [esp + 4], eax
mov dword [esp], 0x45a954
call fcn.00443da0
test eax, eax
jne 0x401d68
call fcn.00443980
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call fcn.00443c10
sub esp, 4
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.00443c10
sub esp, 4
mov dword [esp], 0x4580d4
call fcn.00443c10
sub esp, 4
call fcn.004439d0
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.00443b80
sub esp, 8
jmp 0x401d68