Function at 0x448447
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x109
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44844d
call fcn.0057b2e0
push dword [esp + 0x438]
call fcn.0050d240
mov edx, dword [esp + 0x430]
lea ecx, [esp]
call fcn.0050d0f0
mov edx, dword [esp + 0x434]
lea ecx, [esp + 4]
call fcn.0050d0f0
mov dword [section..data], 0x1300051
mov dword [section..data], 0x1300061
mov dword [0x6b78c8], 0
mov dword [section..data], 0x1300062
mov edx, 0x67a5ae
lea ecx, [esp + 0x414]
call fcn.0050d0f8
mov dword [section..data], 0x1300066
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.005698f0
call fcn.0057b490
mov edx, 0x67fef4
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x44853f
mov dword [section..data], 0x1300066
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 8]
call fcn.00569960
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0056a070
lea eax, [esp + 4]
push eax
call fcn.0057b350
mov dword [section..data], 0x1300066
mov dword [section..data], 0x1300067
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0056a070
call fcn.0057b490
mov edx, 0x67fef4
pop ecx
push ecx
call fcn.0050d250
mov ecx, eax
call fcn.0050d1d0
je 0x4485c5
mov dword [section..data], 0x1300067
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
push dword [esp + 8]
call fcn.00569960
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.005698f0
lea eax, [esp + 4]
push eax
call fcn.0057b350
mov dword [section..data], 0x1300067
mov dword [section..data], 0x1300069
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push dword [esp + 0xc]
push dword [esp + 0x43c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
mov dword [section..data], 0x130006b
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x448966
mov dword [section..data], 0x130006d
mov dword [esp + 0x41c], 0x1ff
mov dword [section..data], 0x130006e
lea eax, [esp + 0x41c]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x420]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x1c]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov dword [section..data], 0x130006f
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x448909
mov dword [section..data], 0x1300071
push dword [esp + 0x418]
mov dword [section..data], 0x1300072
mov ebx, 1
cmp ebx, dword [esp]
jne 0x44878c
mov dword [section..data], 0x1300073
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x424]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov dword [section..data], 0x1300074
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44874e
mov dword [section..data], 0x1300075
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov ebx, dword [esp + 0x428]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
dec ebx
push ebx
lea edx, [esp + 0x24]
push edx
call fcn.0057b460
pop edx
push eax
push 0x200
push edx
call fcn.0057b280
call fcn.0050d222
add dword [esp], edx
call fcn.005698f0
lea eax, [esp + 0x41c]
push eax
call fcn.0057b350
mov dword [section..data], 0x1300076
jmp 0x448773
mov dword [section..data], 0x1300076
mov dword [section..data], 0x1300077
mov edx, 0x67a5ae
lea ecx, [esp + 0x418]
call fcn.0050d0f8
mov dword [section..data], 0x1300078
mov dword [section..data], 0x1300079
jmp 0x44885f
mov dword [section..data], 0x1300079
mov ebx, 4
cmp ebx, dword [esp]
jne 0x44885f
mov dword [section..data], 0x130007a
lea eax, [esp + 0x420]
push eax
lea eax, [esp + 0x428]
push eax
lea eax, [esp + 0x424]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov dword [section..data], 0x130007b
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x448830
mov dword [section..data], 0x130007c
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b460
pop edx
push eax
mov eax, dword [esp + 0x42c]
cdq
push edx
push eax
call fcn.0056a320
lea eax, [esp + 0x41c]
push eax
call fcn.0057b350
mov dword [section..data], 0x130007d
jmp 0x448855
mov dword [section..data], 0x130007d
mov dword [section..data], 0x130007e
mov edx, 0x67a5ae
lea ecx, [esp + 0x418]
call fcn.0050d0f8
mov dword [section..data], 0x130007f
mov dword [section..data], 0x1300080
pop eax
mov dword [section..data], 0x1300081
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44889a
mov dword [section..data], 0x1300082
mov dword [esp + 0x10], 1
mov dword [section..data], 0x1300083
jmp 0x4488f3
mov dword [section..data], 0x1300083
mov dword [section..data], 0x1300084
push dword [esp + 0xc]
pop eax
mov dword [0x6b78c8], eax
mov dword [section..data], 0x1300085
push edx
call fcn.0057b460
pop edx
push eax
push dword [0x6b78c8]
call fcn.004482ea
lea eax, [0x6b78cc]
push eax
call fcn.0057b350
mov dword [section..data], 0x1300086
mov dword [esp + 0x10], 0
mov dword [section..data], 0x1300087
mov dword [section..data], 0x1300088
jmp 0x448950
mov dword [section..data], 0x1300088
mov dword [section..data], 0x1300089
push dword [esp + 0xc]
pop eax
mov dword [0x6b78c8], eax
mov dword [section..data], 0x130008a
push edx
call fcn.0057b460
pop edx
push eax
push dword [0x6b78c8]
call fcn.004482ea
lea eax, [0x6b78cc]
push eax
call fcn.0057b350
mov dword [section..data], 0x130008b
mov dword [section..data], 0x130008c
jmp 0x4489ad
mov dword [section..data], 0x130008c
mov dword [section..data], 0x130008d
push dword [esp + 0xc]
pop eax
mov dword [0x6b78c8], eax
mov dword [section..data], 0x130008e
push edx
call fcn.0057b460
pop edx
push eax
push dword [0x6b78c8]
call fcn.004482ea
lea eax, [0x6b78cc]
push eax
call fcn.0057b350
mov dword [section..data], 0x130008f
mov dword [section..data], 0x1300092
push dword [esp + 8]
call sub.ADVAPI32.dll_RegCloseKey
mov dword [section..data], 0x1300094
mov edx, dword [esp + 0x414]
push edx
call fcn.0057b460
pop edx
push eax
push edx
call fcn.0057b230
pop eax
push eax
call fcn.0050d210
pop edx
add eax, edx
jmp 0x448a09
push dword [esp + 4]
call fcn.0057b3c0
push dword [esp]
call fcn.0057b3c0
push dword [esp + 0x414]
call fcn.0057b3c0
add esp, 0x424
pop ebx
ret 0xc