Function at 0x44a3e0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x40a5d4]
xor eax, esp
mov dword [esp + 0x10c], eax
push edi
push 0xff
lea eax, [esp + 0x15]
push 0
push eax
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x1c], 0
call fcn.0046de30
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x20007
push 0
push 0
push 0
push 0x40d138
push 0x80000001
call edi
test eax, eax
je 0x44a467
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0046db77
add esp, 0x110
ret
mov edx, dword [esp + 8]
mov al, byte [0x485f32]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d12c
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
mov edx, dword [esp + 0xc]
mov al, byte [0x485f33]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d120
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
cmp byte [0x485f31], al
jne 0x44a4ee
mov edx, dword [esp + 0xc]
mov al, byte [0x486539]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d118
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
mov edx, dword [esp + 0xc]
mov al, byte [0x4861b2]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d108
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
mov edx, dword [esp + 0xc]
mov al, byte [0x485d87]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d0f8
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
mov edx, dword [esp + 0xc]
mov al, byte [0x485d84]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d0ec
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
mov edx, dword [esp + 0xc]
mov al, byte [0x485d85]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d0d8
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
mov edx, dword [esp + 0xc]
mov al, byte [0x4861b1]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d0d0
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
jne 0x44a5d6
cmp byte [0x485f31], al
jne 0x44a5ef
mov edx, dword [esp + 0xc]
mov al, byte [0x486538]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push 0x40d0c8
push edx
mov byte [esp + 0x20], al
call esi
test eax, eax
je 0x44a5ef
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0046db77
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebp
call fcn.00449580
test al, al
je 0x44a7d1
cmp byte [0x4861b2], 0
je 0x44a783
push 0xff
lea ecx, [esp + 0x1d]
push ecx
push 0
mov byte [esp + 0x24], 0x22
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44a635
sub eax, edx
lea edx, [esp + 0x18]
push 0x40d358
push edx
mov byte [esp + eax + 0x20], 0x22
call fcn.00449c50
add esp, 8
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x40d330
push 0x80000000
call edi
test eax, eax
jne 0x44a760
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44a687
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x44a760
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x40d308
push 0x80000000
call edi
test eax, eax
jne 0x44a760
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44a6e4
sub eax, edx
mov edx, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x44a760
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x40d2e4
push 0x80000000
call edi
test eax, eax
jne 0x44a760
lea eax, [esp + 0x18]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44a740
mov ecx, dword [esp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
je 0x44a77a
pop ebp
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.0046db77
add esp, 0x110
ret
mov edx, dword [esp + 0x10]
push edx
call ebp
jmp 0x44a7d1
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x40d330
push 0x80000000
call esi
push 0x40d2c4
push 0x80000000
call esi
push 0x40d308
push 0x80000000
call esi
push 0x40d2a4
push 0x80000000
call esi
push 0x40d2e4
push 0x80000000
call esi
push 0x40d288
push 0x80000000
call esi
mov ecx, dword [esp + 0x118]
pop ebp
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.0046db77
add esp, 0x110
ret