Function at 0x4044ed
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x43e054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x438ca4
lea eax, [ebp - 0x20c]
push 0x435860
xor esi, esi
push eax
mov dword [ebp - 0x210], esi
call fcn.00417ade
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x404567
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp + 8]
push eax
push esi
push esi
push 0x4384c0
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 8], esi
jne 0x4047e3
push ebx
push edi
push 0x3e8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 0x4384dc
lea edi, [esi + 0x12]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor eax, eax
mov word [esi + 0xa], ax
mov word [esi + 0xc], ax
mov eax, 0x138
mov word [esi + 0xe], ax
mov eax, 0xb4
mov word [esi + 0x10], ax
xor eax, eax
mov dword [esi], 0x80c808d0
mov word [esi + 8], ax
mov word [edi], ax
inc edi
inc edi
mov word [edi], ax
inc edi
inc edi
push 0x4384f8
push edi
call fcn.004044cc
lea edi, [edi + eax*2]
push 8
pop eax
mov word [edi], ax
inc edi
inc edi
push 0x43851c
push edi
call fcn.004044cc
lea eax, [edi + eax*2]
call fcn.004044c5
push 7
pop ecx
mov word [eax + 8], cx
push 3
pop ecx
mov word [eax + 0xa], cx
mov ecx, 0x12a
mov word [eax + 0xc], cx
push 0xe
pop ecx
mov word [eax + 0xe], cx
mov dword [eax], 0x50000000
lea edi, [eax + 0x12]
mov ecx, 0x1f6
mov word [eax + 0x10], cx
mov ebx, 0xffff
mov eax, ebx
mov word [edi], ax
inc edi
inc edi
mov eax, 0x82
mov word [edi], ax
inc edi
inc edi
push 0x438538
push edi
call fcn.004044cc
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.004044c5
mov ecx, 0xc9
mov word [eax + 8], cx
add ecx, 0xffffffd6
push 0x32
mov word [eax + 0xa], cx
pop ecx
push 0xe
mov word [eax + 0xc], cx
pop ecx
mov word [eax + 0xe], cx
xor ecx, ecx
inc ecx
mov word [eax + 0x10], cx
mov dword [eax], 0x50010000
lea edi, [eax + 0x12]
mov eax, ebx
mov word [edi], ax
inc edi
inc edi
lea eax, [ecx + 0x7f]
mov word [edi], ax
inc edi
inc edi
push 0x4385cc
push edi
call fcn.004044cc
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.004044c5
push 0x32
mov ecx, 0xff
mov word [eax + 8], cx
add ecx, 0xffffffa0
mov word [eax + 0xa], cx
pop ecx
mov word [eax + 0xc], cx
push 0xe
pop ecx
mov word [eax + 0xe], cx
push 2
pop ecx
mov word [eax + 0x10], cx
mov dword [eax], 0x50010000
lea edi, [eax + 0x12]
mov eax, ebx
mov word [edi], ax
inc edi
inc edi
lea eax, [ecx + 0x7e]
mov word [edi], ax
inc edi
inc edi
push 0x4385dc
push edi
call fcn.004044cc
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.004044c5
push 7
pop ecx
mov word [eax + 8], cx
push 0x32
mov ecx, 0x9f
mov word [eax + 0xa], cx
pop ecx
mov word [eax + 0xc], cx
push 0xe
pop ecx
mov word [eax + 0xe], cx
lea edi, [eax + 0x12]
mov ecx, 0x1f5
mov word [eax + 0x10], cx
mov dword [eax], 0x50010000
mov word [edi], bx
inc edi
inc edi
mov eax, 0x80
mov word [edi], ax
inc edi
inc edi
push 0x4385f0
push edi
call fcn.004044cc
lea edi, [edi + eax*2]
xor eax, eax
mov word [edi], ax
inc word [esi + 8]
lea eax, [edi + 2]
call fcn.004044c5
push 7
pop ecx
mov word [eax + 8], cx
push 0xe
pop ecx
mov word [eax + 0xa], cx
mov ecx, 0x12a
mov word [eax + 0xc], cx
mov ecx, 0x8c
mov word [eax + 0xe], cx
lea edi, [eax + 0x12]
mov ecx, 0x1f4
push 0x438600
push edi
mov word [eax + 0x10], cx
mov dword [eax], 0x50a11844
call fcn.004044cc
lea edi, [edi + eax*2]
push 0x4385dc
push edi
call fcn.004044cc
add esp, 0x40
push 0x438ca4
xor ecx, ecx
mov word [edi + eax*2], cx
inc word [esi + 8]
push 0x40438a
xor edi, edi
push edi
push esi
push edi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 8], edi
pop edi
pop ebx
je 0x4047fe
push 4
lea eax, [ebp + 8]
push eax
push 4
push 0
push 0x4384c0
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp + 8], eax
pop esi
setne al
xor ecx, ebp
call fcn.004179b6
leave
ret