Function at 0x440ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fc22b
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x5466b0]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
cmp eax, 2
jne 0x440fa4
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x260], ebx
cmp edi, ebx
je 0x440f88
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push ebx
push ebx
mov ecx, esi
call edx
cdq
push edx
push eax
mov esi, edi
mov dword [edi], ebx
call fcn.0040c130
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x264], 0xffffffff
call fcn.0040ed50
jmp 0x44156d
xor edi, edi
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x264], 0xffffffff
call fcn.0040ed50
jmp 0x44156d
cmp eax, 3
jne 0x440fe4
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x260], 1
cmp edi, ebx
je 0x440f88
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
mov ecx, esi
call edx
cdq
push edx
push eax
mov esi, edi
mov dword [edi], ebx
call fcn.0040c130
jmp 0x440f8a
cmp eax, 4
jne 0x441026
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
call edx
push 0x54cfe0
push 0x10
call fcn.004cba2a
add esp, 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x260], 2
cmp eax, ebx
je 0x44101f
push ebx
push 1
call fcn.00431050
jmp 0x441410
xor eax, eax
jmp 0x441410
cmp eax, 9
jne 0x4410a7
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x260], 3
cmp edi, ebx
je 0x44107c
mov eax, dword [esi]
mov edx, dword [eax + 0x64]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x260], 4
mov eax, dword [eax]
mov dword [edi], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x1c], 1
call fcn.0040c040
jmp 0x44107e
xor edi, edi
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x264], 5
call fcn.0040ed50
test byte [esp + 0x1c], 1
je 0x44156d
lea eax, [esp + 0x20]
jmp 0x441568
cmp eax, 0x16
jne 0x4410fe
push 0x54cfe0
push 0x10
call fcn.004cba2a
add esp, 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x260], 6
cmp eax, ebx
je 0x4410d8
push ebx
push 1
call fcn.00431050
jmp 0x4410da
xor eax, eax
push eax
mov ecx, edi
mov dword [esp + 0x264], 0xffffffff
call fcn.0040ed50
mov eax, dword [esi]
mov edx, dword [eax + 0x9c]
mov ecx, esi
call edx
jmp 0x44156d
cmp eax, 0x1a
jne 0x441146
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x260], 7
cmp edi, ebx
je 0x4414dc
mov eax, dword [esi]
mov edx, dword [eax + 0xb0]
mov ecx, esi
call edx
cdq
push edx
push eax
mov eax, edi
call fcn.00431050
jmp 0x4414de
cmp eax, 0xd
je 0x4414f5
cmp eax, 0x1e
je 0x4414f5
cmp eax, 0x34
jne 0x441314
lea eax, [esp + 0x24]
push eax
call fcn.00446b20
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
mov dword [esp + 0x270], 0xb
push SysReAllocString
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4412c3
push 0x105
lea edx, [esp + 0x148]
push ebx
push edx
mov dword [esp + 0x44], 4
call fcn.004d7710
add esp, 0xc
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x148]
push ecx
lea edx, [esp + 0x40]
push edx
push ebx
push 0x514d70
push eax
mov dword [esp + 0x54], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4412b8
push 3
lea edx, [esp + 0x148]
lea ecx, [esp + 0x48]
push edx
lea eax, [esp + 0x48]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], ecx
call fcn.004180d0
lea eax, [esp + 0x14]
mov byte [esp + 0x260], 0xc
mov ecx, dword [esp + 0x40]
push eax
call fcn.004085e0
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x30]
push edx
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov byte [esp + 0x274], 0xd
call fcn.0045bbe4
mov esi, dword [eax]
add esp, 0x14
lea ecx, [esp + 0x34]
call fcn.004087f0
lea ecx, [esp + 0x14]
call fcn.004087f0
mov byte [esp + 0x260], 0xb
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x44128b
push eax
call fcn.004cc15e
add esp, 4
cmp esi, ebx
je 0x4412b8
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
push ecx
push edx
push eax
push str._d._d._d._d
lea edi, [esp + 0x38]
call fcn.00404c30
mov edi, dword [esp + 0x2c]
add esp, 0x14
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov esi, eax
add esp, 8
mov dword [esp + 0x14], esi
mov byte [esp + 0x260], 0xe
cmp esi, ebx
je 0x4412f9
mov eax, dword [esp + 0x24]
mov dword [esi], ebx
mov ebx, eax
mov eax, esi
call fcn.0040c040
mov edi, dword [esp + 0x18]
jmp 0x4412fb
xor esi, esi
push esi
mov ecx, edi
mov byte [esp + 0x264], 0xb
call fcn.0040ed50
lea eax, [esp + 0x24]
jmp 0x441568
cmp eax, 0x39
jne 0x441386
mov edx, dword [esi]
mov eax, dword [edx + 0xb0]
call eax
cmp eax, ebx
je 0x441364
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x441364
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov ecx, eax
add esp, 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0x260], 0xf
cmp ecx, ebx
je 0x44101f
mov eax, 1
jmp 0x44140b
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov ecx, eax
add esp, 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0x260], 0x10
jmp 0x441405
cmp eax, 0x3a
jne 0x441428
mov edx, dword [esi]
mov eax, dword [edx + 0xb0]
call eax
mov esi, eax
cmp esi, ebx
je 0x4413e5
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4413e5
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
mov dword [esp + 0x260], 0x11
cmp edi, ebx
je 0x4414dc
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ecx, edi
call fcn.0040c000
jmp 0x4414de
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov ecx, eax
add esp, 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0x260], 0x12
xor eax, eax
cmp ecx, ebx
je 0x441410
call fcn.0040c000
push eax
mov ecx, edi
mov dword [esp + 0x264], 0xffffffff
call fcn.0040ed50
jmp 0x44156d
cmp eax, 0x59
jne 0x441480
mov edx, dword [esi]
mov eax, dword [edx + 0xb0]
xor edi, edi
call eax
mov esi, eax
cmp esi, ebx
je 0x441453
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x441453
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edi, eax
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov ecx, eax
add esp, 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0x260], 0x13
cmp ecx, ebx
je 0x4414dc
mov eax, edi
call fcn.0041a750
jmp 0x4414de
cmp eax, 0x5a
jne 0x44156d
mov edx, dword [esi]
mov eax, dword [edx + 0xb0]
xor edi, edi
call eax
mov esi, eax
cmp esi, ebx
je 0x4414af
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4414af
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edi, eax
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov ecx, eax
add esp, 8
mov dword [esp + 0x14], ecx
mov dword [esp + 0x260], 0x14
cmp ecx, ebx
je 0x4414dc
mov eax, edi
call fcn.0040c000
jmp 0x4414de
xor eax, eax
mov ecx, dword [esp + 0x18]
push eax
mov dword [esp + 0x264], 0xffffffff
call fcn.0040ed50
jmp 0x44156d
push 0x54cfe0
push 0x10
call fcn.004cba2a
mov edi, eax
add esp, 8
mov dword [esp + 0x34], edi
mov dword [esp + 0x260], 8
cmp edi, ebx
je 0x441546
mov edx, dword [esi]
mov edx, dword [edx + 0x7c]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call edx
mov byte [esp + 0x260], 9
mov eax, dword [eax]
mov dword [edi], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x1c], 2
call fcn.0040c040
jmp 0x441548
xor edi, edi
mov ecx, dword [esp + 0x18]
push edi
mov dword [esp + 0x264], 0xa
call fcn.0040ed50
test byte [esp + 0x1c], 2
je 0x44156d
lea eax, [esp + 0x14]
call fcn.0042afc0
mov eax, 1
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004cb38b
mov esp, ebp
pop ebp
ret 8