Function at 0x441ba0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
mov eax, dword [0x4ff94c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x2a8], esi
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SoftwarePRONTOColor]
mov word [ebp + eax - 0x1d0], cx
add eax, 2
cmp cx, si
jne 0x441bd0
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x441c64
cmp word [eax], si
je 0x441c64
lea ecx, [ebp - 0x298]
push ecx
push eax
call fcn.00440ad0
lea edi, [ebp - 0x1d0]
add esp, 8
add edi, 0xfffffffe
lea esp, [esp]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x441c10
mov edx, dword [0x4d6a68]
lea eax, [ebp - 0x298]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x441c30
lea edi, [ebp - 0x1d0]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x441c46
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor esi, esi
lea eax, [ebp - 0x29c]
push eax
push 0x20019
push esi
lea ecx, [ebp - 0x1d0]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x441c9c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b7f56
mov esp, ebp
pop ebp
ret 4
xor edx, edx
lea eax, [ebp - 0x2a4]
push eax
mov word [ebx + 0x7c], dx
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x2b0]
push edx
mov edx, dword [ebp - 0x29c]
push esi
lea eax, [ebp - 0x2a0]
push eax
lea ecx, [ebp - 0x40]
push ecx
push esi
push edx
mov byte [ebx + 0x70], 1
mov byte [ebx + 0x73], 1
mov dword [ebp - 0x2a0], 0x3c
mov dword [ebp - 0x2a4], 0x190
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x441df6
xor eax, eax
xor ecx, ecx
mov edi, 1
mov word [ebp - 6], ax
mov word [ebp - 0x42], cx
cmp dword [ebp - 0x2b0], edi
jne 0x441da6
lea edx, [ebp - 0x1d0]
push edx
lea eax, [ebp - 0x40]
push eax
mov ecx, ebx
mov dword [ebp - 0x2a8], edi
call fcn.00441040
mov ecx, str.dataaltrow
lea eax, [ebp - 0x40]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x441d58
test dx, dx
je 0x441d54
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x441d58
add eax, 4
add ecx, 4
test dx, dx
jne 0x441d32
xor eax, eax
jmp 0x441d5d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x441d69
mov dword [ebp - 0x2ac], edi
jmp 0x441da6
mov ecx, str.grp_box
lea eax, [ebp - 0x40]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x441d97
test dx, dx
je 0x441d93
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x441d97
add eax, 4
add ecx, 4
test dx, dx
jne 0x441d71
xor eax, eax
jmp 0x441d9c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x441da6
mov dword [ebp - 0x2b4], edi
lea ecx, [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x1d0]
push edx
lea eax, [ebp - 0x2b0]
push eax
mov eax, dword [ebp - 0x29c]
push 0
lea ecx, [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x40]
push edx
add esi, edi
push esi
push eax
mov dword [ebp - 0x2a0], 0x3c
mov dword [ebp - 0x2a4], 0x190
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x441cf5
jmp 0x441dfb
mov edi, 1
mov ecx, dword [ebp - 0x29c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x2a8], 0
je 0x441e4b
cmp dword [ebp - 0x2ac], 0
jne 0x441e26
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x2c]
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], eax
cmp dword [ebp - 0x2b4], 0
jne 0x441e4b
mov eax, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
mov dword [ebx + 0x58], ecx
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], 0x808080
mov dword [ebx + 0x64], eax
mov word [ebx + 0x71], 0
mov ecx, ebx
call fcn.00440cd0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7f56
mov esp, ebp
pop ebp
ret 4