Function at 0x44a030
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d917b
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x539c80]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov eax, dword [0x539c80]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x98]
xor ebx, ebx
lea esi, [eax + 4]
mov dword [esp + 0x14], ebx
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x68], ebx
lea ecx, [edi + 0xb4]
call fcn.0044b470
lea ecx, [edi + 0xbc]
call fcn.0044b470
push 1
mov ecx, edi
call fcn.0044ab20
mov dword [esp + 0x68], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x53ed90]
mov esi, 0xc
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
cmp edx, 3
jne 0x44a121
movsd xmm3, qword [0x522870]
movsd xmm6, qword [0x522898]
movsd xmm5, qword [0x522868]
movd xmm4, ecx
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x44a10b
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x44a0f1
push 0x5c
push dword [edi + 0xdc]
call fcn.004aede4
add esp, 8
test eax, eax
jne 0x44a13a
or eax, 0xffffffff
jmp 0x44a142
sub eax, dword [edi + 0xdc]
sar eax, 1
inc eax
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xdc]
call fcn.004227c0
mov dword [esp + 0x68], 1
lea eax, [esp + 0x18]
push eax
push 0x2001f
push 0
push dword [edi + 0xdc]
push dword [edi + 0x194]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x44a1d2
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push dword [edi + 0xdc]
push dword [edi + 0x194]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x44a1d2
mov edx, eax
lea ecx, [esp + 0x40]
call fcn.00440940
mov byte [esp + 0x68], 2
push eax
push ecx
lea ecx, [esp + 0x30]
call fcn.00444de0
push 0x52472c
lea eax, [esp + 0x2c]
push eax
call fcn.004b447b
or edi, 0xffffffff
cmp byte [ebp + 8], 0
je 0x44a223
push 0x52055c
lea edx, [esp + 0x20]
lea ecx, [esp + 0x24]
call fcn.00417c70
add esp, 4
mov byte [esp + 0x68], 3
push dword [eax]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov byte [esp + 0x68], 1
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44a223
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
mov dword [esp + 0x24], 0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x20], esi
mov byte [esp + 0x68], 6
jmp 0x44a250
mov dword [esp + 0x3c], 0x7ffe
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x7ffe
or eax, ecx
jge 0x44a27e
push 0x7ffe
lea ecx, [esp + 0x24]
call fcn.004026b0
mov esi, dword [esp + 0x20]
cmp dword [esi - 8], 0x7ffe
jl 0x44a5a2
xor eax, eax
push eax
push eax
push eax
push eax
mov dword [esi - 0xc], 0x7ffe
mov word [esi + 0xfffc], ax
lea eax, [esp + 0x4c]
push eax
push esi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push dword [esi - 8]
mov dword [esp + 0x2c], eax
push esi
call fcn.004ad21c
add esp, 8
test eax, eax
js 0x44a5a2
cmp eax, dword [esi - 8]
jg 0x44a5a2
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.00442a90
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x38]
call fcn.00417c70
add esp, 4
mov byte [esp + 0x68], 7
or ebx, 1
mov dword [esp + 0x14], ebx
mov eax, dword [eax]
test eax, eax
je 0x44a326
cmp dword [esi - 0xc], 0
jl 0x44a326
push eax
push esi
call fcn.004ad3c6
add esp, 8
test eax, eax
je 0x44a326
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x44a3ff
call fcn.00444b70
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x34]
call fcn.00417c70
add esp, 4
mov dword [esp + 0x68], 8
or ebx, 2
mov dword [esp + 0x14], ebx
mov eax, dword [eax]
test eax, eax
je 0x44a372
cmp dword [esi - 0xc], 0
jl 0x44a372
push eax
push esi
call fcn.004ad3c6
add esp, 8
test eax, eax
je 0x44a372
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
jne 0x44a3ff
cmp byte [0x53fb36], 0
jne 0x44a3b8
movzx eax, byte [0x53b360]
xor al, 0x49
movzx eax, al
mov word [0x53b8e4], ax
movzx eax, byte [0x53b361]
xor al, 6
movzx eax, al
mov word [0x53b8e6], ax
movzx eax, byte [0x53b362]
xor al, 7
movzx eax, al
mov word [0x53b8e8], ax
mov byte [0x53fb36], 1
push 0x53b8e4
lea edx, [esp + 0x20]
lea ecx, [esp + 0x3c]
call fcn.00417c70
add esp, 4
mov dword [esp + 0x68], 9
or ebx, 4
mov dword [esp + 0x14], ebx
mov eax, dword [eax]
test eax, eax
je 0x44a406
cmp dword [esi - 0xc], 0
jl 0x44a406
push eax
push esi
call fcn.004ad3c6
add esp, 8
test eax, eax
je 0x44a406
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x44a406
mov byte [esp + 0x13], 1
jmp 0x44a40b
mov byte [esp + 0x13], 0
mov dword [esp + 0x68], 8
test bl, 4
je 0x44a444
and ebx, 0xfffffffb
mov dword [esp + 0x14], ebx
mov dword [esp + 0x68], 8
mov edx, dword [esp + 0x38]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44a444
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x68], 7
test bl, 2
je 0x44a47d
and ebx, 0xfffffffd
mov dword [esp + 0x14], ebx
mov dword [esp + 0x68], 7
mov edx, dword [esp + 0x30]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44a47d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x68], 6
test bl, 1
je 0x44a4b3
and ebx, 0xfffffffe
mov dword [esp + 0x14], ebx
mov byte [esp + 0x68], 6
mov edx, dword [esp + 0x34]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44a4b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [esp + 0x13], 0
je 0x44a4cf
push esi
push dword [esp + 0x1c]
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x44a4d3
inc dword [esp + 0x24]
cmp dword [esp + 0x28], 0
je 0x44a250
cmp byte [ebp + 8], 0
je 0x44a535
call fcn.00441510
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.00417c70
add esp, 4
mov byte [esp + 0x68], 0xd
push 0
push 0
push 3
push 0
push dword [eax]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [esp + 0x68], 6
mov edx, dword [esp + 0x28]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44a535
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x68], 1
add esi, 0xfffffff0
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44a55d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x68], 0xffffffff
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x44a580
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00401a60
int3