Function at 0x449c1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x449c22
call fcn.004a65d0
push dword [esp + 0x5c]
call fcn.0044c3a0
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0044c000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0044c000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0044c000
push dword [esp]
call fcn.0044a2c9
push dword [esp + 8]
mov edx, 0x531018
pop ecx
call fcn.0044c330
je 0x449ccf
cmp dword [0xec94a4], 0
je 0x449cb3
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0xec94a8]
or ebx, 0xf003f
push ebx
push 0
push dword [0xec9498]
push dword [0xec94a0]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x449ccd
lea eax, [esp + 0x10]
push eax
push dword [0xec9498]
push dword [0xec94a0]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x449d34
lea eax, [esp + 0x18]
push eax
push dword [0xec94a0]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0xec94a4], 0
je 0x449d1c
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0xec94a8]
or ebx, 0xf003f
push ebx
push 0
push dword [0xec9498]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x449d34
lea eax, [esp + 0x10]
push eax
push dword [0xec9498]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44a00e
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
push dword [esp + 0x24]
call fcn.004a3e10
lea eax, [esp + 0x24]
push eax
call fcn.004a6470
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44a00e
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x449e15
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x449e02
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004a48f0
lea eax, [esp + 0x30]
push eax
call fcn.004a6470
jmp 0x449e10
mov edx, 0x5300ba
lea ecx, [esp + 0x2c]
call fcn.0044c008
jmp 0x44a00d
mov ebx, 2
cmp ebx, dword [esp]
jne 0x449e8a
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x449e77
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004a48f0
lea eax, [esp + 0x30]
push eax
call fcn.004a6470
jmp 0x449e85
mov edx, 0x5300ba
lea ecx, [esp + 0x2c]
call fcn.0044c008
jmp 0x44a00d
mov ebx, 4
cmp ebx, dword [esp]
jne 0x449efc
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x449ee9
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004a3e60
lea eax, [esp + 0x30]
push eax
call fcn.004a6470
jmp 0x449ef7
mov edx, 0x5310c8
lea ecx, [esp + 0x2c]
call fcn.0044c008
jmp 0x44a00d
mov ebx, 3
cmp ebx, dword [esp]
jne 0x44a00d
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004a5340
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44a00d
mov edx, 0x5300ba
lea ecx, [esp + 0x2c]
call fcn.0044c008
mov dword [esp + 0x44], 0
jmp 0x449f67
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x44a004
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.0044c300
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x449fc1
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
mov edx, 0x5310c8
push edx
call fcn.004a6500
lea eax, [esp + 0x30]
push eax
call fcn.004a6470
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6430
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004a40a0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004a6470
inc dword [esp + 0x44]
jno 0x449f67
push dword [esp + 0x3c]
call fcn.004a52e0
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004a6430
pop edx
push eax
push edx
call fcn.004a6500
pop eax
push eax
call fcn.0044c370
pop edx
add eax, edx
jmp 0x44a03f
push dword [esp + 8]
call fcn.004a6630
push dword [esp + 0x20]
call fcn.004a6630
push dword [esp]
call fcn.004a6630
push dword [esp + 4]
call fcn.004a6630
push dword [esp + 0x28]
call fcn.004a6630
add esp, 0x48
pop ebx
ret 0xc