Function at 0x443cfc
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x47c1f0
lea edi, [ebp - 0x218]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], esi
xor edi, edi
call fcn.00443a55
test eax, eax
jne 0x443d43
xor eax, eax
jmp 0x443eff
mov eax, dword [0x4d5334]
cmp eax, esi
je 0x443d3c
add ebx, 0xa574
push ebx
call eax
cmp eax, esi
jge 0x443d75
push eax
push str.pCreateVssBackupComponents_m_VssObject_
push str._s_failed_with_errorcode_0x_x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x118
jmp 0x443eea
lea eax, [ebp - 0x21c]
push eax
push str.SoftwareSnapShot
push Ordinal_2
call dword [sym.imp.ical_size__lu_MB_RegCreateKeyA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov dword [ebp - 0x220], esi
push esi
jmp 0x443e8f
lea eax, [ebp - 0x1f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443db3
push 0x10
sub eax, edx
pop edi
cmp eax, edi
jb 0x443dc5
mov eax, edi
push eax
lea eax, [ebp - 0x1f8]
push eax
push str.Outstanding_VSS_
call fcn.00450c23
add esp, 0xc
test eax, eax
jne 0x443e71
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
push esi
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x230], edi
call dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x218]
push edx
lea edx, [ebp - 0x22c]
push edx
push 1
push 3
sub esp, 0x10
cmp dword [eax + 0x28], esi
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edi, esp
lea esi, [ebp - 0x208]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
je 0x443e44
call dword [ecx + 0x9c]
jmp 0x443e4a
call dword [ecx + 0x90]
test eax, eax
jns 0x443e55
cmp eax, 0x80042308
jne 0x443e6f
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ical_size__lu_MB_RegDeleteValueA]
and dword [ebp - 0x220], 0
xor esi, esi
inc dword [ebp - 0x220]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x220]
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], 0x1f4
call dword [sym.imp.ical_size__lu_MB_RegEnumValueA]
test eax, eax
je 0x443daa
push dword [ebp - 0x21c]
call dword [sym.imp.ical_size__lu_MB_RegCloseKey]
xor edi, edi
inc edi
jmp 0x443ef7
mov eax, dword [ebp - 0x228]
cmp dword [eax + 0x28], esi
mov eax, dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp eax, esi
jge 0x443efb
push eax
push str.VSS_Release___
push str._s_failed_with_errorcode_0x_x_n
call dword [sym.imp.___total_physical_size__lu_MB_GetLastError]
push eax
push 0x134
push str.VSS_UTIL
call fcn.0044dc85
add esp, 0x18
cmp dword [ebx], esi
jne 0x443ebe
mov dword [ebx], esi
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00450b32
leave
ret