Function at 0x44e580
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x2cc
mov eax, 0x4aed27
call fcn.004803aa
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x2d8], edi
xor eax, eax
mov dword [ebp - 0x2d0], esi
mov dword [edi], vtable.Cmm::CStringT_wchar_t_.0
mov dword [edi + 4], esi
mov dword [edi + 0x14], esi
mov dword [edi + 0x18], 7
mov word [edi + 4], ax
push 0x1b0
lea eax, [ebp - 0x2c0]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x2d0], 1
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2c4], esi
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
pop ebx
test eax, eax
jne 0x44e7ab
lea eax, [ebp - 0x2c8]
mov dword [ebp - 0x2c8], esi
push eax
push 0x20019
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44e65f
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CStringT_wchar_t_::Assign_wchar_t_const__
push dword [ebp - 0x2c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44e79f
push 0x80
lea eax, [ebp - 0x90]
mov ebx, esi
push esi
push eax
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0x2cc]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x90]
push eax
push esi
jmp 0x44e76b
lea eax, [ebp - 0x2c8]
inc ebx
push eax
push 0x20019
push esi
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44e743
push 0x80
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.004821f0
add esp, 0xc
mov dword [ebp - 0x2d4], 0x80
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push 0xffff
push 0x4d23d8
push esi
push dword [ebp - 0x2c8]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push dword [ebp - 0x2c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x214]
lea eax, [ebp - 0x110]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e73a
test dx, dx
je 0x44e736
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e73a
add eax, 4
add ecx, 4
test dx, dx
jne 0x44e714
mov eax, esi
jmp 0x44e73f
sbb eax, eax
or eax, 1
test eax, eax
je 0x44e78e
push 0x80
lea eax, [ebp - 0x90]
push esi
push eax
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0x2cc]
push esi
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push dword [ebp - 0x2c4]
mov dword [ebp - 0x2cc], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x44e68e
jmp 0x44e79c
lea eax, [ebp - 0x90]
mov ecx, edi
push eax
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CStringT_wchar_t_::Assign_wchar_t_const__
push 4
pop ebx
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 0x14], esi
jne 0x44ead4
cmp dword [ebp + 0xc], 0
jne 0x44eac8
mov ecx, str.Russia_TZ_1_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e7ed
test dx, dx
je 0x44e7e9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e7ed
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e7c9
mov eax, esi
jmp 0x44e7f2
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e800
push str.Kaliningrad_Standard_Time
jmp 0x44eacd
mov ecx, str.Russia_TZ_2_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e82f
test dx, dx
je 0x44e82b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e82f
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e80b
mov eax, esi
jmp 0x44e834
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e842
push str.Russian_Standard_Time
jmp 0x44eacd
mov ecx, str.Russia_TZ_4_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e871
test dx, dx
je 0x44e86d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e871
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e84d
mov eax, esi
jmp 0x44e876
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e884
push str.Ekaterinburg_Standard_Time
jmp 0x44eacd
mov ecx, str.Russia_TZ_6_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e8b3
test dx, dx
je 0x44e8af
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e8b3
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e88f
mov eax, esi
jmp 0x44e8b8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e8c6
push str.North_Asia_Standard_Time
jmp 0x44eacd
mov ecx, str.Russia_TZ_7_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e8f5
test dx, dx
je 0x44e8f1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e8f5
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e8d1
mov eax, esi
jmp 0x44e8fa
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e908
push str.North_Asia_East_Standard_Time
jmp 0x44eacd
mov ecx, str.Russia_TZ_8_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e937
test dx, dx
je 0x44e933
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e937
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e913
mov eax, esi
jmp 0x44e93c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e94a
push str.Yakutsk_Standard_Time
jmp 0x44eacd
mov ecx, str.Russia_TZ_9_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e979
test dx, dx
je 0x44e975
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e979
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e955
mov eax, esi
jmp 0x44e97e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44e98c
push str.Vladivostok_Standard_Time
jmp 0x44eacd
mov ecx, str.Coordinated_Universal_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e9bb
test dx, dx
je 0x44e9b7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e9bb
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e997
mov eax, esi
jmp 0x44e9c0
sbb eax, eax
or eax, 1
test eax, eax
je 0x44eac8
mov ecx, str.Cabo_Verde_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44e9f7
test dx, dx
je 0x44e9f3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44e9f7
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44e9d3
mov eax, esi
jmp 0x44e9fc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44ea0a
push str.Cape_Verde_Standard_Time
jmp 0x44eacd
mov ecx, str.Jerusalem_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44ea39
test dx, dx
je 0x44ea35
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44ea39
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44ea15
mov eax, esi
jmp 0x44ea3e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44ea4c
push str.Israel_Standard_Time
jmp 0x44eacd
mov ecx, str.Novosibirsk_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44ea7b
test dx, dx
je 0x44ea77
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44ea7b
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44ea57
mov eax, esi
jmp 0x44ea80
sbb eax, eax
or eax, 1
test eax, eax
jne 0x44ea8b
push str.N._Central_Asia_Standard_Time
jmp 0x44eacd
mov ecx, str.Malay_Peninsula_Standard_Time
lea eax, [ebp - 0x214]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44eab8
test dx, dx
je 0x44eabd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44eab8
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x44ea96
jmp 0x44eabd
sbb esi, esi
or esi, 1
test esi, esi
jne 0x44ead4
push str.Singapore_Standard_Time
jmp 0x44eacd
push 0x4d23e0
mov ecx, edi
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CStringT_wchar_t_::Assign_wchar_t_const__
mov eax, edi
call fcn.00480359
ret