Function at 0x4411a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5052a8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x52f8b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], edi
call fcn.00440f10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x441257
call fcn.00440fb0
test eax, eax
jne 0x441257
lea eax, [ebp - 0x44]
push eax
push 0x20019
push edi
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44136b
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x48]
push eax
push edi
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], 4
push dword [ebp - 0x44]
mov dword [ebp - 0x54], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x44]
mov esi, eax
call ebx
xor ebx, ebx
test esi, esi
sete bl
jmp 0x44136d
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
cmp word [esi], ax
jne 0x441286
xor ecx, ecx
jmp 0x44129f
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x441290
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x441290
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.00402530
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
call fcn.00440860
add esp, 8
cmp dword [ebp - 0x2c], 8
mov esi, eax
jb 0x4412d0
push dword [ebp - 0x40]
call fcn.0041a777
add esp, 4
xor eax, eax
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x2001f
push eax
push esi
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
call fcn.00441050
test eax, eax
jne 0x441357
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x44], 4
mov esi, eax
mov eax, 0xd
cmovne esi, eax
test edi, edi
je 0x44133d
push edi
call ebx
xor edi, edi
xor ebx, ebx
test esi, esi
sete bl
cmp dword [ebp - 0x14], 8
jb 0x44136d
push dword [ebp - 0x28]
call fcn.0041a777
add esp, 4
jmp 0x44136d
cmp dword [ebp - 0x14], 8
jb 0x441368
push dword [ebp - 0x28]
call fcn.0041a777
add esp, 4
mov edi, dword [ebp - 0x60]
xor ebx, ebx
test edi, edi
je 0x441378
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041a77c
mov esp, ebp
pop ebp
ret

Function at 0x4413a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004414b0