Function at 0x44a7e6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor ecx, ecx
push 0x2001f
push ecx
push 0x404210
mov edi, ecx
push 0x80000000
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
jne 0x44a92e
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x2001f
push edi
push 0x41d358
push dword [ebp - 0x544]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x44a92e
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
mov ebx, eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push eax
push eax
push eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ebx
push dword [ebp - 0x53c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x44a91a
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x2001f
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x53c]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x44a91a
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, edi
call fcn.0044a40a
test eax, eax
jns 0x44a907
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x41fa3c
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
push dword [ebp - 0x530]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x44a88a
push dword [ebp - 0x53c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x44a93f
push dword [ebp - 0x544]
call ebx
test esi, esi
je 0x44a963
cmp esi, 0x103
je 0x44a963
mov edi, esi
test esi, esi
jle 0x44a95d
and edi, 0xffff
or edi, 0x80070000
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
cmp dword [eax + 0x1c], 3
jne 0x44ab03
push 0x41fa6c
push 0x404210
push 0x401c94
mov eax, 0x105
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
add esp, 0xc
test eax, eax
js 0x44ab3c
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x2001f
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ab3c
xor edi, edi
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
push 0
push 0
push 0
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push dword [ebp - 0x530]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x44aaf5
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x2001f
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x530]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x80
inc edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x44aaf5
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x4044c0
push dword [ebp - 0x534]
inc esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44aae8
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
jne 0x44aae8
lea eax, reloc.ADVAPI32.dll_TraceMessage
test eax, eax
je 0x44aabd
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov esi, dword [edx + 4]
jmp 0x44aab9
mov eax, dword [esi]
test eax, eax
je 0x44aab6
push dword [eax + 0x24]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x44aae8
mov esi, dword [esi + 4]
test esi, esi
jne 0x44aa9a
mov edx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
call fcn.0044a40a
test eax, eax
jns 0x44aae8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x41fa88
push 4
pop esi
call fcn.00440126
pop ecx
pop ecx
push dword [ebp - 0x534]
call ebx
jmp 0x44a9de
push dword [ebp - 0x530]
call ebx
mov edi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
test esi, esi
je 0x44ab3c
cmp esi, 0x103
je 0x44ab3c
test esi, esi
jle 0x44ab21
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jns 0x44ab3c
test edi, edi
jns 0x44ab29
mov esi, edi
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4
test edi, edi
js 0x44ab27
xor esi, esi
jmp 0x44ab29