Function at 0x444cf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x650
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x648], eax
mov esi, 0x57
test ebx, ebx
je 0x444d63
mov eax, dword [ebp + 0x10]
xor edi, edi
lea ecx, [esp + 0x440]
mov dword [ecx], edi
push ecx
push 1
push edi
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x444d61
mov ecx, dword [ebp + 0x14]
lea eax, [esp + 0x238]
mov dword [eax], edi
push eax
push edi
push edi
push edi
push ecx
push dword [esp + 0x454]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x444d7b
mov esi, eax
mov ecx, dword [esp + 0x648]
xor ecx, ebp
call fcn.00517c1a
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x238]
mov eax, dword [ebx]
lea edi, [eax + eax]
xor ecx, ecx
mov esi, 0
cmp edx, edi
mov edi, dword [ebp + 8]
jbe 0x444da8
shr edx, 1
mov dword [ebx], edx
test edi, edi
setne cl
mov esi, 0x7a
cmove esi, edi
mov eax, edx
test edi, edi
je 0x444de7
test cl, cl
jne 0x444de7
add eax, eax
mov dword [esp + 0x238], eax
xor eax, eax
lea ecx, [esp + 0x238]
push ecx
push edi
push eax
push eax
push dword [ebp + 0x14]
push dword [esp + 0x454]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x444de7
mov eax, dword [esp + 0x238]
shr eax, 1
mov dword [ebx], eax
push dword [esp + 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x444d63
mov esi, 0x57
test edi, edi
je 0x444d63
push edi
call fcn.006208d5
add esp, 4
mov dword [esp + 8], eax
lea edi, [eax + eax]
add edi, 2
push edi
call fcn.00517c03
add esp, 4
mov dword [esp + 4], eax
xor esi, esi
push edi
push esi
push eax
call fcn.006030b0
add esp, 0xc
push edi
call fcn.00517c03
add esp, 4
mov dword [esp], eax
push edi
push esi
push eax
call fcn.006030b0
add esp, 0xc
push esi
push esi
push edi
mov edi, dword [ebp + 8]
push dword [esp + 0xc]
push dword [esp + 0x18]
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [esp]
push dword [esp + 8]
call fcn.0044498d
add esp, 8
test eax, eax
jle 0x444e9e
xor esi, esi
push dword [ebx]
push edi
push 0xffffffffffffffff
mov eax, dword [esp + 0x10]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x444e93
mov dword [ebx], eax
jmp 0x444e9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, dword [ebp + 8]
push dword [esp]
call fcn.00517c15
add esp, 4
push dword [esp + 4]
call fcn.00517c15
add esp, 4
push edi
call fcn.006208d5
add esp, 4
test eax, eax
je 0x444d63
jle 0x445117
cmp word [edi + eax*2 - 2], 0x7d
jne 0x445117
push 0x7b
push edi
call fcn.006037aa
add esp, 8
test eax, eax
je 0x445117
mov ecx, eax
sub ecx, edi
test ecx, ecx
jle 0x445117
cmp word [ecx + edi - 2], 0x7d
jne 0x445117
mov ecx, eax
add ecx, 0xfffffffe
mov edx, ecx
sub edx, edi
jb 0x445117
cmp word [ecx], 0x7b
jne 0x444f05
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov eax, 0x208
xor ebx, ebx
push eax
push ebx
lea eax, [esp + 0x448]
push eax
mov dword [esp + 0xc], edx
call fcn.006030b0
add esp, 0xc
mov eax, 0x208
push eax
push ebx
lea eax, [esp + 0x240]
push eax
call fcn.006030b0
add esp, 0xc
lea ecx, [esp + 0x440]
lea edx, [esp + 0x238]
call fcn.00445507
lea ecx, [esp + 0xc]
push edi
call fcn.00401a6c
mov eax, dword [esp]
sar eax, 1
lea edi, [esp + 0xc]
mov ecx, edi
push 0xffffffffffffffff
mov dword [esp + 4], eax
push eax
call fcn.00469526
mov ecx, edi
lea eax, [esp + 0x238]
push eax
call fcn.00469188
xorps xmm0, xmm0
movaps xmmword [esp + 0x220], xmm0
cmp byte [edi + 0xb], 0
jns 0x444fac
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x220]
push eax
push edi
call fcn.004906c0
add esp, 8
lea edi, [esp + 0x18]
mov eax, 0x208
push eax
push ebx
push edi
call fcn.006030b0
add esp, 0xc
movzx eax, byte [esp + ebx + 0x220]
push eax
push 0x64cd90
push 3
push edi
call fcn.0042e32f
add esp, 0x10
inc ebx
add edi, 4
cmp ebx, 0x10
jne 0x444fd1
lea edi, [esp + 0xc]
mov ecx, edi
push 0x7b
call fcn.00468cd2
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.00469188
mov ecx, edi
push 0x7d
call fcn.00469298
movzx eax, byte [edi + 0xb]
test al, al
jns 0x445025
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push eax
push edi
push dword [esp + 0x10]
call fcn.0061c762
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 8]
lea edi, [esp + 0x440]
mov ebx, dword [esp + 4]
je 0x445121
lea ebx, [esp + 0xc]
mov ecx, ebx
push eax
call fcn.0046930c
mov ecx, ebx
push 0xffffffffffffffff
push dword [esp + 4]
call fcn.00469526
mov ecx, ebx
push edi
call fcn.00469188
xorps xmm0, xmm0
movaps xmmword [esp + 0x220], xmm0
cmp byte [ebx + 0xb], 0
jns 0x44507f
mov ebx, dword [esp + 0xc]
lea eax, [esp + 0x220]
push eax
push ebx
call fcn.004906c0
add esp, 8
push 0x208
push 0
lea ebx, [esp + 0x20]
push ebx
call fcn.006030b0
add esp, 0xc
xor edi, edi
movzx eax, byte [esp + edi + 0x220]
push eax
push 0x64cd90
push 3
push ebx
call fcn.0042e32f
add esp, 0x10
inc edi
add ebx, 4
cmp edi, 0x10
jne 0x4450a6
lea edi, [esp + 0xc]
mov ecx, edi
push 0x7b
call fcn.00468cd2
lea eax, [esp + 0x18]
mov ecx, edi
push eax
call fcn.00469188
mov ecx, edi
push 0x7d
call fcn.00469298
movzx eax, byte [edi + 0xb]
test al, al
jns 0x4450fa
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push eax
push edi
mov ebx, dword [esp + 0xc]
push ebx
call fcn.0061c762
add esp, 0xc
test eax, eax
mov eax, dword [ebp + 8]
je 0x445121
mov word [eax], 0
jmp 0x445126
mov word [edi], 0
jmp 0x444d63
mov word [ebx], 0
cmp byte [esp + 0x17], 0
jns 0x444d63
push dword [esp + 0xc]
call fcn.00517bd6
add esp, 4
jmp 0x444d63