Function at 0x44e6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x5f8800]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x100]
mov dword [ebp - 0x10c], ecx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareHB_Nemesis
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44e998
push 0x79
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x108], 0x79
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push str.SavedAccounts
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44e799
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0x10
xor ebx, ebx
mov byte [esi], 0
mov dword [ebp - 0x104], ebx
lea ecx, [ebp - 0x80]
add ecx, ebx
mov esi, ecx
lea edx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x44e7b0
sub esi, edx
je 0x44e852
lea eax, [esi + 1]
test eax, eax
je 0x44e821
test edi, edi
jne 0x44e7d7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x16
jmp 0x44e81c
test ecx, ecx
je 0x44e7ed
cmp eax, 0xc
ja 0x44e7ed
push eax
push ecx
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x44e821
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
test ecx, ecx
jne 0x44e80c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x16
jmp 0x44e81c
cmp eax, 0xc
jbe 0x44e821
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x22
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo
mov ecx, dword [ebp - 0x10c]
push esi
push edi
call fcn.0047d0a0
mov eax, dword [ebp - 0x110]
inc ebx
add ebx, esi
add edi, 0xc
inc byte [eax]
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp eax, 0xa
jl 0x44e7a4
push 0x79
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x108], 0x79
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xfc]
push eax
push 0
push 0
push str.SavedPasswords
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, dword [ebp - 0x114]
test eax, eax
jne 0x44e77a
xor eax, eax
xor edi, edi
mov dword [ebp - 0x104], eax
nop word [eax + eax]
lea ecx, [ebp - 0xfc]
add ecx, eax
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x44e8c0
sub esi, edx
je 0x44e95a
lea eax, [esi + 1]
test eax, eax
je 0x44e931
test ebx, ebx
jne 0x44e8e7
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x16
jmp 0x44e92c
test ecx, ecx
je 0x44e8fd
cmp eax, 0xc
ja 0x44e8fd
push eax
push ecx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x44e931
xorps xmm0, xmm0
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
test ecx, ecx
jne 0x44e91c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x16
jmp 0x44e92c
cmp eax, 0xc
jbe 0x44e931
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [eax], 0x22
call sub.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo
mov ecx, dword [ebp - 0x10c]
push esi
push ebx
call fcn.0047d0a0
mov eax, dword [ebp - 0x104]
inc edi
inc eax
add ebx, 0xc
add eax, esi
mov dword [ebp - 0x104], eax
cmp edi, 0xa
jl 0x44e8b0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0
push str.LastUsedAccIdx
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44e77a
mov eax, dword [ebp - 0x118]
cmp eax, 0xa
jae 0x44e998
mov ecx, dword [ebp - 0x11c]
mov byte [ecx], al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005aa550
mov esp, ebp
pop ebp
ret 0x10