Function at 0x446660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d188
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4aa6e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 4], edi
call fcn.004463d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x446717
call fcn.00446470
test eax, eax
jne 0x446717
lea eax, [ebp - 0x44]
push eax
push 0x20019
push edi
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44682b
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x48]
push eax
push edi
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], 4
push dword [ebp - 0x44]
mov dword [ebp - 0x54], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x44]
mov esi, eax
call ebx
xor ebx, ebx
test esi, esi
sete bl
jmp 0x44682d
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], eax
mov word [ebp - 0x40], ax
cmp word [esi], ax
jne 0x446746
xor ecx, ecx
jmp 0x44675f
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x446750
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x446750
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x40]
call fcn.0040d830
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 2
call fcn.004461f0
add esp, 8
cmp dword [ebp - 0x2c], 8
mov esi, eax
jb 0x446790
push dword [ebp - 0x40]
call fcn.00421634
add esp, 4
xor eax, eax
cmp dword [ebp - 0x14], 8
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0x2001f
push eax
push esi
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
call fcn.00446510
test eax, eax
jne 0x446817
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
push eax
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x48], 4
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x44], 4
mov esi, eax
mov eax, 0xd
cmovne esi, eax
test edi, edi
je 0x4467fd
push edi
call ebx
xor edi, edi
xor ebx, ebx
test esi, esi
sete bl
cmp dword [ebp - 0x14], 8
jb 0x44682d
push dword [ebp - 0x28]
call fcn.00421634
add esp, 4
jmp 0x44682d
cmp dword [ebp - 0x14], 8
jb 0x446828
push dword [ebp - 0x28]
call fcn.00421634
add esp, 4
mov edi, dword [ebp - 0x60]
xor ebx, ebx
test edi, edi
je 0x446838
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421639
mov esp, ebp
pop ebp
ret

Function at 0x446860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446870