Function at 0x448300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544889
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x5868f4]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x268], esi
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x448353
mov eax, dword [edi]
jmp 0x448355
mov eax, edi
xor ecx, ecx
mov dword [ebp - 0x248], edi
mov word [eax], cx
cmp byte [esi + 0x3aa], cl
je 0x448640
push 0x573ba0
push 0x58ba20
call fcn.00437400
add esp, 8
mov ecx, edi
push 0xf
push str._PATCHINSTALL1
call fcn.0040c930
cmp byte [esi + 0x3ad], 0
je 0x4483e9
push str.UPDATE
lea ecx, [esi + 0xd8]
call fcn.0040dca0
test eax, eax
jne 0x4483e9
push str.PROVIDER
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x108]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
lea ecx, [ebp - 0x260]
call fcn.004033d0
jmp 0x448972
xor ebx, ebx
mov dword [ebp - 0x228], 0
xorps xmm0, xmm0
mov dword [ebp - 0x228], ebx
movq qword [ebp - 0x230], xmm0
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x244]
mov dword [ebp - 4], 1
push eax
push 0x20119
push ebx
push 0x5626d0
push 0x80000002
mov dword [ebp - 0x244], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x44857d
mov ebx, dword [ebp - 0x244]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], 0x100
test edi, edi
jne 0x44857d
push 0x208
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.00516d20
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0x208
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push str.CloudProvider
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x448509
mov eax, dword [ebp - 0x240]
cmp eax, 1
je 0x4484bd
cmp eax, 2
jne 0x4484d8
mov eax, dword [ebp - 0x244]
test eax, eax
je 0x4484fe
test al, 1
jne 0x4484d8
shr eax, 1
cmp word [ebp + eax*2 - 0x226], 0
je 0x448507
mov eax, 0xd
mov edi, eax
push eax
push str.PatchInstall:_Failed_to_query_CloudProvider_registry_value__error:__u
push 0x58ba20
call fcn.00437490
add esp, 0xc
mov dword [ebp - 4], 1
jmp 0x448590
xor eax, eax
mov word [ebp - 0x224], ax
xor eax, eax
mov edi, eax
test eax, eax
jne 0x4484df
cmp word [ebp - 0x224], ax
jne 0x44851c
xor edx, edx
jmp 0x448534
lea edx, [ebp - 0x224]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x448525
sub edx, ecx
sar edx, 1
push edx
lea eax, [ebp - 0x224]
lea ecx, [esi + 0x108]
push eax
call fcn.00403fe0
mov dword [ebp - 4], 1
jmp 0x448590
push edi
push str.PatchInstall:_Qualys_Agent_registry_key_not_found__error:__u
push 0x58ba20
call fcn.00437490
add esp, 0xc
test edi, edi
je 0x4485b3
push edi
push str.PatchInstall:_Reading_CloudProvider_from_Config_DB__error:__u
push 0x58ba20
call fcn.00437360
add esp, 0xc
lea eax, [esi + 0x108]
push eax
call fcn.004480a0
mov eax, dword [ebp - 0x268]
cmp dword [eax + 0x118], 0
je 0x44862c
add esi, 0x108
cmp dword [esi + 0x14], 8
jb 0x4485d2
mov eax, dword [esi]
jmp 0x4485d4
mov eax, esi
push eax
push str.PatchInstall:_CloudProvider____s
push 0x58ba20
call fcn.00437400
add esp, 0xc
lea ecx, [ebp - 0x260]
push str.PROVIDER
call fcn.00407d50
push esi
lea eax, [ebp - 0x260]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x44862c
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
test ebx, ebx
je 0x448972
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x448972
cmp byte [esi + 0x3a8], cl
je 0x4486cc
cmp byte [esi + 0x3a9], cl
je 0x448660
push str._FORCE1
mov ecx, edi
call fcn.0040aff0
cmp byte [esi + 0x3ae], 0
je 0x448675
push str._REENABLESP1
mov ecx, edi
call fcn.0040aff0
push str.SPFKEY
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x128]
mov dword [ebp - 4], 5
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x448972
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
jmp 0x448972
push str.ACTIVATIONID
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x48]
mov dword [ebp - 4], 6
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x44871e
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
push str.CUSTOMERID
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x60]
mov dword [ebp - 4], 7
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x448770
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
push str.WEBSERVICEURI
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x78]
mov dword [ebp - 4], 8
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x4487c2
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
push str.WEBSERVICEPORT
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x90]
mov dword [ebp - 4], 9
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x448817
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
push str.WEBSERVICESECURE
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0xa8]
mov dword [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x44886c
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
push str.TLSOVERRIDE
lea ecx, [ebp - 0x260]
call fcn.00407d50
lea eax, [esi + 0x158]
mov dword [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24c]
cmp eax, 8
jb 0x4488c1
inc eax
lea ecx, [ebp - 0x260]
push eax
push dword [ebp - 0x260]
call fcn.00403300
cmp byte [esi + 0x3ab], 0
je 0x4488d6
push str._GOLDENIMAGE1
mov ecx, edi
call fcn.0040aff0
cmp byte [esi + 0x3ac], 0
jne 0x4488ec
cmp byte [esi + 0x3ad], 0
je 0x448972
push str.PROVIDER
lea ecx, [ebp - 0x23c]
call fcn.00407d50
lea eax, [esi + 0x108]
mov dword [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x248]
call fcn.004489a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
cmp eax, 8
jb 0x448941
inc eax
lea ecx, [ebp - 0x23c]
push eax
push dword [ebp - 0x23c]
call fcn.00403300
xor eax, eax
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], 0
mov word [ebp - 0x23c], ax
cmp byte [esi + 0x120], al
je 0x448972
push str._AZUREAUTOUPDATE1
mov ecx, edi
call fcn.0040aff0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004fdf3d
mov esp, ebp
pop ebp
ret 4