Function at 0x44c890
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x80c
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x44cc54
cmp dword [ebp + 0xc], 0
je 0x44cc54
mov dword [ebp - 0x800], 0xffffffff
xorps xmm0, xmm0
movups xmmword [ebp - 0x330], xmm0
movups xmmword [ebp - 0x340], xmm0
movups xmmword [ebp - 0x350], xmm0
movups xmmword [ebp - 0x360], xmm0
movups xmmword [ebp - 0x370], xmm0
movups xmmword [ebp - 0x380], xmm0
mov dword [ebp - 0x320], 0
lea eax, [ebp - 0x800]
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x44cc54
lea edi, [ebp - 0x588]
push 0x208
push 0xff
push edi
call fcn.0049dcc0
add esp, 0xc
lea esi, [ebp - 0x804]
jmp 0x44c963
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x804]
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [ebp - 0x588]
inc ebx
mov dword [ebp - 0x804], 0x104
mov eax, dword [ebp - 0x800]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44cbe7
mov dword [ebp - 0x808], 0xffffffff
lea eax, [ebp - 0x808]
push eax
push 1
push 0
push edi
push dword [ebp - 0x800]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44c962
push 0x208
push 0xff
lea edi, [ebp - 0x790]
push edi
call fcn.0049dcc0
add esp, 0xc
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x810], 0x208
lea eax, [ebp - 0x810]
push eax
push edi
lea eax, [ebp - 0x80c]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x808]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44c950
xorps xmm0, xmm0
movups xmmword [ebp - 0x7a4], xmm0
movups xmmword [ebp - 0x7b4], xmm0
movups xmmword [ebp - 0x7c4], xmm0
movups xmmword [ebp - 0x7d4], xmm0
movups xmmword [ebp - 0x7e4], xmm0
movups xmmword [ebp - 0x7f4], xmm0
mov dword [ebp - 0x794], 0
push 0x208
push 0xff
lea esi, [ebp - 0x218]
push esi
call fcn.0049dcc0
add esp, 0xc
lea eax, [ebp - 0x790]
push eax
push str.._s
push 0x208
push esi
call fcn.0044bf60
sub esp, 0xc
movaps xmm0, xmmword [0x4d9640]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x44c94a
mov esi, eax
mov dword [ebp - 0x7f8], 0x1010101
push 0x104
push 0xff
lea edi, [ebp - 0x31c]
push edi
call fcn.0049dcc0
add esp, 0xc
mov dword [ebp - 0x7fc], 0
push 0
lea eax, [ebp - 0x7fc]
push eax
push 0x104
push edi
push 4
lea eax, [ebp - 0x7f8]
push eax
push 0x170002
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x44c943
cmp dword [ebp - 0x7fc], 0
je 0x44c943
movzx eax, byte [ebp - 0x317]
mov dword [ebp - 0x814], eax
movzx ecx, byte [ebp - 0x318]
movzx edx, byte [ebp - 0x319]
movzx edi, byte [ebp - 0x31a]
movzx eax, byte [ebp - 0x31b]
mov dword [ebp - 0x818], eax
movzx eax, byte [ebp - 0x31c]
push dword [ebp - 0x814]
push ecx
push edx
push edi
push dword [ebp - 0x818]
push eax
push str._02X_02X_02X_02X_02X_02X
push 0x64
lea eax, [ebp - 0x7f4]
push eax
call fcn.0044ce50
add esp, 0x24
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0x380], 0
lea esi, [ebp - 0x804]
je 0x44cba6
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x7f4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x44c950
mov eax, 0x64
xor ecx, ecx
nop dword [eax]
movzx edx, byte [ebp + ecx - 0x7f4]
test dl, dl
je 0x44cbd1
mov byte [ebp + ecx - 0x380], dl
inc ecx
dec eax
cmp ecx, 0x64
jne 0x44cbb0
mov ecx, 0x64
xor eax, eax
add ecx, ebp
add ecx, 0xfffffc80
cmp eax, 1
sbb ecx, 0
mov byte [ecx], 0
jmp 0x44c950
push dword [ebp - 0x800]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, byte [ebp - 0x380]
test cl, cl
je 0x44cc48
mov ebx, dword [ebp + 0xc]
test ebx, ebx
jle 0x44cc4c
dec ebx
mov esi, 1
mov edx, ebx
mov edi, dword [ebp + 8]
mov eax, esi
mov byte [edi + esi - 1], cl
add edx, 0xffffffff
jae 0x44cc38
cmp eax, 0x7ffffffe
je 0x44cc38
movzx ecx, byte [ebp + eax - 0x380]
lea esi, [eax + 1]
mov ebx, edx
test cl, cl
jne 0x44cc10
mov ebx, 1
xor ecx, ecx
test ebx, ebx
setne bl
sete cl
sub edi, ecx
add edi, eax
jmp 0x44cc51
xor ebx, ebx
jmp 0x44cc54
xor ebx, ebx
mov edi, dword [ebp + 8]
mov byte [edi], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x80c
pop esi
pop edi
pop ebx
pop ebp
ret