Function at 0x44e0a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4de96d
mov eax, dword fs:[0]
push eax
sub esp, 0x948
mov eax, dword [0x51cbc0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x814]
push 0x800
push 0
push eax
mov dword [ebp - 0x938], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x93c], 0x800
call fcn.0040b000
mov ecx, eax
test ecx, ecx
je 0x44e872
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x930], eax
push str.UserProfile
push str.software360TotalSecurity
lea eax, [ebp - 0x930]
mov dword [ebp - 4], 0
push str._s_s
push eax
call fcn.00448a40
mov esi, dword [ebp - 0x930]
lea eax, [ebp - 0x93c]
add esp, 0x10
mov dword [ebp - 0x934], 0
mov bl, 1
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x934]
push eax
push str.LicPrompt
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x44e185
cmp dword [ebp - 0x934], 3
je 0x44e187
xor bl, bl
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44e1a6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x44e228
mov eax, dword [ebp - 0x93c]
test eax, eax
je 0x44e228
dec eax
mov dword [ebp - 0x8a4], 0
push eax
lea eax, [ebp - 0x814]
mov dword [ebp - 0x8a0], 0xf
push eax
lea ecx, [ebp - 0x8b4]
mov byte [ebp - 0x8b4], 0
call fcn.00417770
push str.LicPrompt
lea eax, [ebp - 0x8b4]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x89c]
push eax
call fcn.00444670
add esp, 0xc
cmp dword [ebp - 0x88c], 0
mov byte [ebp - 4], 2
jne 0x44e246
lea ecx, [ebp - 0x89c]
call fcn.00406f90
lea ecx, [ebp - 0x8b4]
call fcn.00406f90
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004d55dc
mov esp, ebp
pop ebp
ret
and dword [ebp - 0x94c], 0xfffffe00
xor bl, bl
mov byte [ebp - 0x929], bl
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x944], 0
mov dword [ebp - 0x940], 0
lea ecx, [ebp - 0x928]
mov byte [ebp - 4], 5
call fcn.00439710
cmp dword [ebp - 0x888], 0x10
lea edx, [ebp - 0x89c]
mov byte [ebp - 4], 6
jb 0x44e29e
mov edx, dword [ebp - 0x89c]
mov ecx, edx
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], 0xf
mov byte [ebp - 0x82c], 0
lea esi, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44e2c0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x82c]
call fcn.00417770
push 1
lea eax, [ebp - 0x954]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x928]
call fcn.0047c0a0
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 6
mov bh, al
call fcn.00406f90
cmp bh, 1
jne 0x44e831
push 0x4f7747
push str.license
lea ecx, [ebp - 0x954]
call fcn.0047a9e0
test eax, eax
je 0x44e831
push 0x4f7747
push str.license
lea ecx, [ebp - 0x954]
call fcn.0047e170
cmp byte [eax + 8], 6
jne 0x44e831
push 0x4f7747
push str.license
lea ecx, [ebp - 0x954]
call fcn.0047e170
mov ecx, eax
mov dword [ebp - 0x934], eax
call fcn.0047f110
xor ebx, ebx
mov dword [ebp - 0x930], eax
mov esi, ebx
jmp 0x44e380
mov dword [ebp - 0x938], esi
cmp ebx, eax
jge 0x44e82f
mov ecx, dword [ebp - 0x934]
push ebx
call fcn.0043f620
mov esi, eax
mov dword [ebp - 0x884], 0
xor eax, eax
mov dword [ebp - 0x880], 0
mov dword [ebp - 0x87c], 0
mov dword [ebp - 0x878], 0
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x870], 0
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 7
mov word [ebp - 0x864], ax
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x838], 7
mov word [ebp - 0x84c], ax
mov word [ebp - 0x834], ax
mov dword [ebp - 0x830], 0xffffffff
push str.license_key
lea eax, [ebp - 0x82c]
mov byte [ebp - 4], 8
push esi
push eax
call fcn.004508c0
add esp, 0xc
lea ecx, [ebp - 0x864]
push eax
call fcn.00407cc0
lea ecx, [ebp - 0x82c]
call fcn.00406fe0
push str.device_id
lea eax, [ebp - 0x82c]
push esi
push eax
call fcn.004508c0
add esp, 0xc
lea ecx, [ebp - 0x84c]
push eax
call fcn.00407cc0
lea ecx, [ebp - 0x82c]
call fcn.00406fe0
cmp byte [esi + 8], 7
jne 0x44e4ea
push 0x4f76ff
push str.server_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
je 0x44e4ea
push 0x4f76ff
push str.server_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
jne 0x44e4c2
mov eax, dword [0x521438]
cmp byte [eax + 8], 4
jne 0x44e4ea
push str.server_time
mov ecx, esi
call fcn.0043f790
lea ecx, [ebp - 0x82c]
push ecx
mov ecx, eax
call fcn.004765f0
mov eax, dword [ebp - 0x818]
jmp 0x44e506
mov eax, 0xf
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], eax
mov byte [ebp - 0x82c], 0
lea ecx, [ebp - 0x82c]
cmp eax, 0x10
jb 0x44e517
mov ecx, dword [ebp - 0x82c]
push ecx
call sub.msvcrt.dll__atoi64
add esp, 4
mov dword [ebp - 0x884], eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x880], edx
call fcn.00406f90
cmp byte [esi + 8], 7
jne 0x44e594
push 0x4f7717
push str.license_expiration_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
je 0x44e594
push 0x4f7717
push str.license_expiration_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
jne 0x44e56c
mov eax, dword [0x521438]
cmp byte [eax + 8], 4
jne 0x44e594
push str.license_expiration_time
mov ecx, esi
call fcn.0043f790
lea ecx, [ebp - 0x82c]
push ecx
mov ecx, eax
call fcn.004765f0
mov eax, dword [ebp - 0x818]
jmp 0x44e5b0
mov eax, 0xf
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], eax
mov byte [ebp - 0x82c], 0
lea ecx, [ebp - 0x82c]
cmp eax, 0x10
jb 0x44e5c1
mov ecx, dword [ebp - 0x82c]
push ecx
call sub.msvcrt.dll__atoi64
add esp, 4
mov dword [ebp - 0x87c], eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x878], edx
call fcn.00406f90
cmp byte [esi + 8], 7
jne 0x44e63e
push 0x4f776c
push str.renewal_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
je 0x44e63e
push 0x4f776c
push str.renewal_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
jne 0x44e616
mov eax, dword [0x521438]
cmp byte [eax + 8], 4
jne 0x44e63e
push str.renewal_time
mov ecx, esi
call fcn.0043f790
lea ecx, [ebp - 0x82c]
push ecx
mov ecx, eax
call fcn.004765f0
mov eax, dword [ebp - 0x818]
jmp 0x44e65a
mov eax, 0xf
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], eax
mov byte [ebp - 0x82c], 0
lea ecx, [ebp - 0x82c]
cmp eax, 0x10
jb 0x44e66b
mov ecx, dword [ebp - 0x82c]
push ecx
call sub.msvcrt.dll__atoi64
add esp, 4
mov dword [ebp - 0x86c], eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x868], edx
call fcn.00406f90
cmp byte [esi + 8], 7
jne 0x44e6db
push 0x4f7721
push str.trial_key
mov ecx, esi
call fcn.0047a9e0
test eax, eax
je 0x44e6db
push 0x4f7721
push str.trial_key
mov ecx, esi
call fcn.0047a9e0
test eax, eax
jne 0x44e6c0
mov eax, dword [0x521438]
cmp byte [eax + 8], 5
jne 0x44e6db
push str.trial_key
mov ecx, esi
call fcn.0043f790
mov ecx, eax
call fcn.00475dc0
jmp 0x44e6dd
xor al, al
cmp byte [esi + 8], 7
mov byte [ebp - 0x834], al
jne 0x44e733
push 0x4f772e
push str.auto_renew
mov ecx, esi
call fcn.0047a9e0
test eax, eax
je 0x44e733
push 0x4f772e
push str.auto_renew
mov ecx, esi
call fcn.0047a9e0
test eax, eax
jne 0x44e718
mov eax, dword [0x521438]
cmp byte [eax + 8], 5
jne 0x44e733
push str.auto_renew
mov ecx, esi
call fcn.0043f790
mov ecx, eax
call fcn.00475dc0
jmp 0x44e735
xor al, al
cmp byte [esi + 8], 7
mov byte [ebp - 0x833], al
jne 0x44e798
push 0x4f7783
push str.expired_prompt_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
je 0x44e798
push 0x4f7783
push str.expired_prompt_time
mov ecx, esi
call fcn.0047a9e0
test eax, eax
jne 0x44e770
mov eax, dword [0x521438]
cmp byte [eax + 8], 4
jne 0x44e798
push str.expired_prompt_time
mov ecx, esi
call fcn.0043f790
lea ecx, [ebp - 0x82c]
push ecx
mov ecx, eax
call fcn.004765f0
mov eax, dword [ebp - 0x818]
jmp 0x44e7b4
mov eax, 0xf
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], eax
mov byte [ebp - 0x82c], 0
mov esi, dword [ebp - 0x938]
lea ecx, [ebp - 0x82c]
or esi, 0xf
cmp eax, 0x10
jb 0x44e7ce
mov ecx, dword [ebp - 0x82c]
push ecx
call sub.msvcrt.dll__atoi64
add esp, 4
mov dword [ebp - 0x874], eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x870], edx
call fcn.00406f90
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x884]
push ecx
push eax
cmp dword [edi + 8], eax
je 0x44e80d
push edi
call fcn.004369f0
add esp, 0xc
add dword [edi + 4], 0x58
jmp 0x44e814
mov ecx, edi
call fcn.004295f0
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], 6
call fcn.0043d6d0
mov eax, dword [ebp - 0x930]
inc ebx
jmp 0x44e380
mov bl, 1
lea ecx, [ebp - 0x928]
call fcn.004075b0
lea ecx, [ebp - 0x954]
call fcn.0043e4c0
jmp 0x44e855
lea ecx, [ebp - 0x89c]
call fcn.00406f90
lea ecx, [ebp - 0x8b4]
call fcn.00406f90
mov al, bl
jmp 0x44e22a
push 0x80004005
call fcn.00409110
int3