Function at 0x449ce0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov eax, str.28d78fad_5a12_11d1_ae5b_0000f803a8c2
xor esi, esi
call fcn.004354e0
mov edi, eax
mov eax, str.SYSTEMCurrentControlSetControlDeviceClasses
call fcn.004354e0
lea edi, [edi + eax + 2]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455056
add esp, 4
cmp edi, 0x7fffffff
mov ebx, eax
mov dword [esp + 0x14], ebx
ja 0x449d3e
mov eax, str.SYSTEMCurrentControlSetControlDeviceClasses
mov edx, edi
mov ecx, ebx
call fcn.00402840
push str.28d78fad_5a12_11d1_ae5b_0000f803a8c2
mov eax, ebx
call fcn.00430470
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x449f90
xor edi, edi
nop
mov ebx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
xor eax, eax
push edx
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
call fcn.0044a230
mov ebx, dword [esp + 0x24]
add esp, 0xc
test eax, eax
je 0x449dc3
push ebx
call fcn.00449fb0
xor ecx, ecx
add esp, 4
cmp eax, ebp
sete cl
mov esi, ecx
test esi, esi
jne 0x449dbc
test ebx, ebx
je 0x449dbc
push ebx
call fcn.0045505b
add esp, 4
add edi, 1
test esi, esi
je 0x449d70
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x449f8c
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x449e3d
mov ecx, SysReAllocString
mov eax, ebp
xor edx, edx
cmp word [eax], dx
je 0x449df6
add eax, 2
sub ecx, 1
jne 0x449de7
jmp 0x449dfa
test ecx, ecx
jne 0x449e34
mov edx, 0x80070057
xor eax, eax
test edx, edx
mov ecx, edx
jge 0x449e09
xor eax, eax
xor edx, edx
test ecx, ecx
setl dl
sub edx, 1
and edx, eax
test ebx, ebx
mov edi, edx
je 0x449e8a
mov ecx, SysReAllocString
mov eax, ebx
xor edx, edx
cmp word [eax], 0
je 0x449e44
add eax, 2
sub ecx, 1
jne 0x449e24
jmp 0x449e48
mov eax, SysReAllocString
sub eax, ecx
jmp 0x449e01
mov ecx, 0x80070057
jmp 0x449e07
test ecx, ecx
jne 0x449e81
mov edx, 0x80070057
xor eax, eax
test edx, edx
mov ecx, edx
jge 0x449e57
xor eax, eax
xor edx, edx
test ecx, ecx
setl dl
mov ecx, SysReAllocString
sub edx, 1
and edx, eax
mov esi, edx
mov eax, 0x4aad98
xor edx, edx
cmp word [eax], 0
je 0x449e91
add eax, 2
sub ecx, 1
jne 0x449e71
jmp 0x449e99
mov eax, SysReAllocString
sub eax, ecx
jmp 0x449e4f
mov ecx, 0x80070057
jmp 0x449e55
test ecx, ecx
jne 0x449f80
mov edx, 0x80070057
xor eax, eax
xor ecx, ecx
test edx, edx
setl cl
mov edx, 2
sub ecx, 1
and ecx, eax
add ecx, esi
lea esi, [ecx + edi + 0x107]
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455056
add esp, 4
cmp esi, 0x7fffffff
mov edi, eax
ja 0x449ee5
mov eax, ebp
mov edx, esi
mov ecx, edi
call fcn.00402840
push ebx
mov eax, edi
call fcn.00430470
push 0x4aad98
mov eax, edi
call fcn.00430470
add esp, 8
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x18]
push edx
push edi
lea eax, [esp + 0x24]
push eax
lea ecx, [esi + esi]
push 0
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x20]
push 0x4aad9c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x449f57
mov edx, 0x208
cmp dword [esp + 0x18], edx
jae 0x449f57
mov ecx, dword [esp + 0x28]
mov eax, edi
call fcn.00402840
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x449f6f
push edi
call fcn.0045505b
add esp, 4
test ebx, ebx
je 0x449f8c
push ebx
call fcn.0045505b
add esp, 4
mov ebx, ebp
jmp 0x449f90
mov eax, SysReAllocString
sub eax, ecx
jmp 0x449ea0
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x449f9d
push ebx
call fcn.0045505b
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret