Function at 0x44d3aa
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc8
mov eax, 0x49de3b
call fcn.00459b85
mov dword [ebp - 0xcc], ecx
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 0x40]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xb8], eax
xor eax, eax
mov dword [ebp - 0xb4], eax
push eax
lea eax, [ebp - 0xa1]
mov dword [ebp - 0x40], 0x4b6748
push eax
mov dword [ebp - 0x18], 0x4b6750
call fcn.004060a0
mov dword [ebp - 4], 1
lea ecx, [ebx + 4]
push 0
push 0x4a6f30
call fcn.0041f269
mov dword [ebp - 0xb0], eax
mov ecx, esi
push 0xa
lea eax, [ebp - 0xac]
xor edi, edi
push eax
call fcn.004435e9
call fcn.0045e4c1
test al, al
je 0x44d453
test byte [ebp - 0xac], 1
je 0x44d444
mov edi, 0x200
jmp 0x44d453
test byte [ebp - 0xac], 2
mov eax, 0x100
cmovne edi, eax
mov eax, dword [ebp - 0xb0]
lea ecx, [eax + 1]
mov dword [ebp - 0xb0], ecx
cmp ecx, dword [ebx + 0x14]
jae 0x44d895
push eax
push 0
lea eax, [ebp - 0xa0]
mov ecx, ebx
push eax
call fcn.00407460
mov byte [ebp - 4], 3
add eax, 4
push eax
lea ecx, [ebp - 0x3c]
call fcn.00407b80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.00404cc0
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d4b6
mov esi, SysReAllocStringLen
jmp 0x44d548
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d4ce
mov esi, SysReAllocStringLen
jmp 0x44d548
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d4e6
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x44d548
push str.HKEY_USERS
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d4fe
mov esi, SysReAllocStringLen
jmp 0x44d548
push str.HKEY_PERFORMANCE_DATA
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d516
mov esi, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x44d548
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d52e
mov esi, reloc.OLEAUT32.dll_SysFreeString
jmp 0x44d548
push str.HKEY_DYN_DATA
lea ecx, [ebp - 0x3c]
call fcn.004526fc
test eax, eax
jne 0x44d895
mov esi, reloc.OLEAUT32.dll_SysStringLen
push 0xffffffffffffffff
push dword [ebp - 0xb0]
lea eax, [ebp - 0xa0]
mov ecx, ebx
push eax
call fcn.00407460
mov byte [ebp - 4], 6
add eax, 4
push eax
lea ecx, [ebp - 0x3c]
call fcn.00407b80
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa0]
call fcn.00404cc0
and dword [ebp - 0xc4], 0
and dword [ebp - 0xc0], 0
and dword [ebp - 0xbc], 0
mov byte [ebp - 4], 8
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0xc4]
cmovae eax, dword [ebp - 0x3c]
or edi, 0x20019
push edi
push eax
push esi
call fcn.00404b50
test eax, eax
jne 0x44d84b
cmp dword [ebp + 8], 1
jne 0x44d5cc
cmp dword [ebp + 0xc], 1
jmp 0x44d855
mov ebx, dword [ebp - 0xa8]
add ebx, 4
mov dword [ebp - 0xb0], 4
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x44d5e9
mov eax, dword [ebx]
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xc8]
push ecx
push 0
push eax
push dword [ebp - 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44d6bf
cmp dword [ebp - 0xc8], 4
jne 0x44d6c8
cmp dword [ebp - 0xb0], 4
jne 0x44d6c8
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xa8]
push 0xa
push eax
call fcn.004435e9
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x44d6ae
sub eax, 1
je 0x44d69a
dec eax
sub eax, 1
je 0x44d686
sub eax, 0xc
je 0x44d678
sub eax, 0x10
jne 0x44d86a
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setne bl
jmp 0x44d86c
mov eax, dword [ebp - 0xa8]
and eax, dword [ebp - 0xac]
jmp 0x44d6b4
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
seta bl
jmp 0x44d86c
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
setb bl
jmp 0x44d86c
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xa8]
jmp 0x44d855
cmp eax, 2
je 0x44d85a
push edi
sub esp, 0x30
lea eax, [ebp - 0xa1]
mov ecx, esp
mov dword [ebp - 0xa8], esp
push 1
push eax
push 0x4b65d4
call fcn.0041099e
mov byte [ebp - 4], 0x10
cmp dword [ebx + 0x14], 8
jb 0x44d6f3
mov ebx, dword [ebx]
sub esp, 0x30
lea eax, [ebp - 0xa1]
mov ecx, esp
mov dword [ebp - 0xd0], esp
push 1
push eax
push ebx
call fcn.0041099e
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x3c]
cmp dword [ebp - 0x28], 8
lea edx, [ebp - 0xa1]
cmovae eax, dword [ebp - 0x3c]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xd4], esp
push 1
push edx
push eax
call fcn.0041099e
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x70]
push esi
push eax
mov byte [ebp - 4], 8
call fcn.0045f954
add esp, 0x9c
mov byte [ebp - 4], 0x13
mov ebx, dword [ebp - 0xb8]
lea esi, [ebx + 4]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x44d765
mov eax, dword [esi]
push 0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00413fa5
cmp dword [ebp + 8], 0x20
mov edi, eax
jne 0x44d7ba
cmp dword [ebp - 0x58], 8
lea eax, [ebp - 0xa1]
push 1
lea ecx, [ebp - 0x6c]
cmovae ecx, dword [ebp - 0x6c]
push eax
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00406b40
mov byte [ebp - 4], 0x14
xor eax, eax
mov ecx, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xa0]
push ebx
push eax
call fcn.0044c7fe
jmp 0x44d7cb
cmp dword [esi + 0x14], 8
jb 0x44d7c2
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x6c]
call fcn.00452759
mov ebx, eax
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 0xb4]
test al, 1
je 0x44d7f6
and eax, 0xfffffffe
mov dword [ebp - 0xb4], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa0]
call fcn.00404cc0
mov eax, dword [ebp + 0xc]
sub eax, 1
je 0x44d838
sub eax, 1
je 0x44d833
dec eax
sub eax, 1
je 0x44d82c
sub eax, 4
je 0x44d828
sub eax, 8
je 0x44d820
sub eax, 0x10
je 0x44d81c
mov bl, 1
jmp 0x44d83d
test ebx, ebx
jmp 0x44d823
cmp edi, 0xffffffff
setne bl
jmp 0x44d83d
test edi, edi
jmp 0x44d83a
test ebx, ebx
setg bl
jmp 0x44d83d
shr ebx, 0x1f
jmp 0x44d83d
test ebx, ebx
sete bl
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x70]
call fcn.00404cc0
jmp 0x44d86c
cmp dword [ebp + 8], 1
jne 0x44d85a
cmp dword [ebp + 0xc], 2
sete bl
jmp 0x44d86c
cmp dword [ebp + 0xc], 2
je 0x44d86a
cmp dword [ebp + 0xc], 0x20
je 0x44d86a
xor bl, bl
jmp 0x44d86c
mov bl, 1
mov byte [ebp - 4], 1
cmp dword [ebp - 0xc4], 0
je 0x44d88c
push dword [ebp - 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0xc4], 0
and dword [ebp - 0xc0], 0
jmp 0x44d897
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404cc0
mov al, bl
call fcn.00459b34
ret 0x18