Function at 0x444790
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x109
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x444796
call fcn.005873a0
push dword [esp + 0x438]
call fcn.004fc320
mov edx, dword [esp + 0x430]
lea ecx, [esp]
call fcn.004fc000
mov edx, dword [esp + 0x434]
lea ecx, [esp + 4]
call fcn.004fc000
mov dword [section..data], 0x1300051
mov dword [section..data], 0x1300061
mov dword [0x6f9ea8], 0
mov dword [section..data], 0x1300062
mov edx, 0x6bb5f6
lea ecx, [esp + 0x414]
call fcn.004fc008
mov dword [section..data], 0x1300066
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.005752e0
call fcn.00587380
mov edx, 0x6c0ebe
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x444888
mov dword [section..data], 0x1300066
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 8]
call fcn.00575080
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00575cb0
lea eax, [esp + 4]
push eax
call fcn.005872c0
mov dword [section..data], 0x1300066
mov dword [section..data], 0x1300067
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00575cb0
call fcn.00587380
mov edx, 0x6c0ebe
pop ecx
push ecx
call fcn.004fc330
mov ecx, eax
call fcn.004fc340
je 0x44490e
mov dword [section..data], 0x1300067
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
push dword [esp + 8]
call fcn.00575080
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.005752e0
lea eax, [esp + 4]
push eax
call fcn.005872c0
mov dword [section..data], 0x1300067
mov dword [section..data], 0x1300069
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x43c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
mov dword [section..data], 0x130006b
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x444caf
mov dword [section..data], 0x130006d
mov dword [esp + 0x41c], 0x1ff
mov dword [section..data], 0x130006e
lea eax, [esp + 0x41c]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x420]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov dword [section..data], 0x130006f
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x444c52
mov dword [section..data], 0x1300071
push dword [esp + 0x418]
mov dword [section..data], 0x1300072
mov ebx, 1
cmp ebx, dword [esp]
jne 0x444ad5
mov dword [section..data], 0x1300073
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x424]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov dword [section..data], 0x1300074
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x444a97
mov dword [section..data], 0x1300075
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov ebx, dword [esp + 0x428]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
dec ebx
push ebx
lea edx, [esp + 0x24]
push edx
call fcn.00587290
pop edx
push eax
push 0x200
push edx
call fcn.00587460
call fcn.004fc302
add dword [esp], edx
call fcn.005752e0
lea eax, [esp + 0x41c]
push eax
call fcn.005872c0
mov dword [section..data], 0x1300076
jmp 0x444abc
mov dword [section..data], 0x1300076
mov dword [section..data], 0x1300077
mov edx, 0x6bb5f6
lea ecx, [esp + 0x418]
call fcn.004fc008
mov dword [section..data], 0x1300078
mov dword [section..data], 0x1300079
jmp 0x444ba8
mov dword [section..data], 0x1300079
mov ebx, 4
cmp ebx, dword [esp]
jne 0x444ba8
mov dword [section..data], 0x130007a
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x424]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov dword [section..data], 0x130007b
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x444b79
mov dword [section..data], 0x130007c
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587290
pop edx
push eax
mov eax, dword [esp + 0x42c]
cdq
push edx
push eax
call fcn.00574cc0
lea eax, [esp + 0x41c]
push eax
call fcn.005872c0
mov dword [section..data], 0x130007d
jmp 0x444b9e
mov dword [section..data], 0x130007d
mov dword [section..data], 0x130007e
mov edx, 0x6bb5f6
lea ecx, [esp + 0x418]
call fcn.004fc008
mov dword [section..data], 0x130007f
mov dword [section..data], 0x1300080
pop eax
mov dword [section..data], 0x1300081
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x444be3
mov dword [section..data], 0x1300082
mov dword [esp + 0x10], 1
mov dword [section..data], 0x1300083
jmp 0x444c3c
mov dword [section..data], 0x1300083
mov dword [section..data], 0x1300084
push dword [esp + 0xc]
pop eax
mov dword [0x6f9ea8], eax
mov dword [section..data], 0x1300085
push edx
call fcn.00587290
pop edx
push eax
push dword [0x6f9ea8]
call fcn.00444633
lea eax, [0x6f9eac]
push eax
call fcn.005872c0
mov dword [section..data], 0x1300086
mov dword [esp + 0x10], 0
mov dword [section..data], 0x1300087
mov dword [section..data], 0x1300088
jmp 0x444c99
mov dword [section..data], 0x1300088
mov dword [section..data], 0x1300089
push dword [esp + 0xc]
pop eax
mov dword [0x6f9ea8], eax
mov dword [section..data], 0x130008a
push edx
call fcn.00587290
pop edx
push eax
push dword [0x6f9ea8]
call fcn.00444633
lea eax, [0x6f9eac]
push eax
call fcn.005872c0
mov dword [section..data], 0x130008b
mov dword [section..data], 0x130008c
jmp 0x444cf6
mov dword [section..data], 0x130008c
mov dword [section..data], 0x130008d
push dword [esp + 0xc]
pop eax
mov dword [0x6f9ea8], eax
mov dword [section..data], 0x130008e
push edx
call fcn.00587290
pop edx
push eax
push dword [0x6f9ea8]
call fcn.00444633
lea eax, [0x6f9eac]
push eax
call fcn.005872c0
mov dword [section..data], 0x130008f
mov dword [section..data], 0x1300092
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [section..data], 0x1300094
mov edx, dword [esp + 0x414]
push edx
call fcn.00587290
pop edx
push eax
push edx
call fcn.00587330
pop eax
push eax
call fcn.004fc2f0
pop edx
add eax, edx
jmp 0x444d52
push dword [esp + 4]
call fcn.00587410
push dword [esp]
call fcn.00587410
push dword [esp + 0x414]
call fcn.00587410
add esp, 0x424
pop ebx
ret 0xc