Function at 0x44af72
Capabilities:
Query or enumerate registry value

Disassembly:
enter 0x45c, 2
push ebx
push ecx
push edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x4ca901
push 0x12
push 8
push 0x3f
push 0x12
push 0x4e
push 0
push 0
call fcn.0040cba0
mov edi, dword [0x4d91ad]
mov dword [ebp - 0x13c], edi
push 1
push 0x12
push 8
sub esp, 8
mov esi, 0x4ca907
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4ca90d
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x23c]
call fcn.00401b30
mov esi, 0x4ca913
call fcn.00401af0
mov eax, edi
push eax
push 0x4ca921
push 0x11
mov eax, dword [ebp - 0x13c]
call fcn.0041f502
push 2
push 0x16
push 8
sub esp, 8
mov esi, 0x4ca927
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
sub esp, 8
mov esi, 0x4ca92d
mov edi, esp
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, 0x4d90ad
lea edi, [ebp - 0x23c]
call fcn.00401b30
mov esi, 0x4ca933
call fcn.00401af0
mov eax, edi
push eax
push 0x4ca942
push 0x12
mov eax, dword [ebp - 0x13c]
call fcn.0041f502
push 1
push 0x13
push 0xa
push dword [0x4ca94a]
push 8
push 0x4ca94e
mov eax, dword [ebp - 0x13c]
call fcn.0041f962
push 1
push 0x14
push 0xb
push 0x29
push 7
push 1
mov eax, dword [ebp - 0x13c]
call fcn.00428372
mov eax, dword [ebp - 0x13c]
call fcn.00409192
mov eax, dword [0x4d91ad]
call fcn.00414112
mov eax, dword [ebp - 4]
call fcn.00428062
mov eax, dword [ebp - 4]
call fcn.00427f72
mov edi, dword [ebp - 4]
cmp dword [edi + 0xbe], 0
jbe 0x44b567
mov byte [ebp - 0x12c], 0
mov word [edi + 0x9a], 0
lea eax, [ebp - 0x24]
push eax
push 1
push 0
push 0x4ca955
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
lea ebx, [ebp - 0x128]
push ebx
push 0
push 0
push 0
push 0x4ca98a
push dword [ebp - 0x24]
call sub.advapi32.dll_RegQueryValueExA
lea eax, [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0x128]
inc ebx
push ebx
call fcn.004039f0
lea ebx, [ebp - 0x128]
push ebx
push dword [ebp - 0x20]
push 0
push 0
push 0x4ca991
push dword [ebp - 0x24]
call sub.advapi32.dll_RegQueryValueExA
cmp dword [ebp - 0x128], 0
jle 0x44b144
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x20]
call fcn.004039a0
lea edi, [ebp - 0x124]
lea esi, [ebp - 0x23c]
call fcn.00401940
jmp 0x44b154
lea edi, [ebp - 0x124]
mov esi, 0x4ca998
call fcn.00401940
push 0x4ca999
lea eax, [ebp - 0x124]
push eax
call fcn.0040cb40
mov word [ebp - 0x134], ax
cmp ax, 1
jle 0x44b1a2
lea ebx, [ebp - 0x23c]
push ebx
lea eax, [ebp - 0x124]
push eax
push 1
movsx ecx, word [ebp - 0x134]
dec ecx
push ecx
call fcn.00401cd0
lea edi, [ebp - 0x124]
lea esi, [ebp - 0x23c]
call fcn.00401940
lea eax, [ebp - 0x20]
push eax
mov ebx, dword [ebp - 0x128]
inc ebx
push ebx
call fcn.004031c0
push dword [ebp - 0x24]
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 4]
movsx ebx, word [eax + 0xbe]
test ebx, ebx
jle 0x44b2b3
mov word [ebp - 0x140], bx
mov word [ebp - 0x134], 0
inc word [ebp - 0x134]
movsx eax, word [ebp - 0x134]
imul ebx, eax, 0x54
mov edi, dword [ebp - 4]
mov esi, dword [edi]
lea ebx, [esi + ebx - 0x54]
mov dword [ebp - 0x144], ebx
push 1
push 0xffffffffffffffff
movsx eax, word [ebp - 0x134]
push eax
mov esi, dword [ebp - 0x144]
push dword [esi + 4]
mov eax, dword [0x4d91ad]
call fcn.00427ea2
mov word [ebp - 0x138], ax
lea ebx, [ebp - 0x244]
push ebx
lea eax, [ebp - 0x124]
push eax
call fcn.0041a8a0
lea ecx, [ebp - 0x344]
push ecx
lea eax, [ebp - 0x444]
push eax
mov edi, dword [ebp - 0x144]
push dword [edi + 4]
call fcn.004039a0
lea ebx, [ebp - 0x444]
push ebx
call fcn.0041a8a0
lea esi, [ebp - 0x344]
lea edi, [ebp - 0x244]
call fcn.00414a20
test al, al
jne 0x44b281
cmp word [ebp - 0x134], 1
jne 0x44b2a6
mov eax, dword [ebp - 4]
mov bx, word [ebp - 0x134]
mov word [eax + 0x9a], bx
push 1
mov bx, word [ebp - 0x138]
push ebx
mov eax, dword [0x4d91ad]
call fcn.00427e52
dec word [ebp - 0x140]
jne 0x44b1de
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x12c], al
test al, al
je 0x44b55d
push 1
mov eax, dword [0x4d91ad]
call fcn.00427de2
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x138], ax
mov ax, word [ebp + 8]
mov word [0x4d8869], ax
push 5
mov eax, edi
call fcn.00427cc2
mov byte [ebp - 0x130], 1
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x4d91ad]
call fcn.00413a22
mov byte [ebp - 0x18], al
cmp al, 0x12
jne 0x44b368
mov eax, dword [ebp - 4]
call fcn.00427d72
mov eax, dword [ebp - 4]
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x12c], al
mov bx, word [ebp + 8]
mov word [0x4d8869], bx
push 5
mov eax, dword [ebp - 4]
call fcn.00427cc2
mov bl, byte [ebp - 0x12c]
test bl, bl
je 0x44b363
mov eax, dword [ebp - 4]
mov cx, word [eax + 0x9a]
mov word [ebp - 0x138], cx
jmp 0x44b467
cmp al, 0x22
jne 0x44b467
push 1
mov eax, dword [0x4d91ad]
call fcn.00427012
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], ax
movsx ebx, ax
push 0
mov al, byte [edi + 0xbe]
push eax
push 1
push 1
push 0x4ca99b
lea edi, [ebp - 0x464]
call fcn.00401403
lea esi, [ebp - 0x464]
mov eax, ebx
push 0xff0000
call fcn.0040148e
mov byte [ebp - 0x130], al
test al, al
je 0x44b3de
mov edi, dword [ebp - 4]
mov ax, word [ebp - 0x138]
cmp word [edi + 0x9a], ax
setne bl
mov byte [ebp - 0x130], bl
jmp 0x44b414
movzx ebx, byte [0x4d8cf7]
mov ax, bx
cmp ax, 0x54
jne 0x44b3ff
push 0x4ca9bb
push 0x4ca9d3
call fcn.004135d0
jmp 0x44b414
cmp ax, 0x45
jne 0x44b414
push 0x4ca9d4
push 0x4ca9e5
call fcn.004135d0
mov al, byte [ebp - 0x130]
test al, al
je 0x44b467
mov bx, word [ebp + 8]
mov word [0x4d8869], bx
mov eax, dword [ebp - 4]
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x12c], al
test al, al
je 0x44b467
mov edi, dword [ebp - 4]
mov ax, word [edi + 0x9a]
mov word [ebp - 0x138], ax
mov ax, word [ebp + 8]
mov word [0x4d8869], ax
push 5
mov eax, edi
call fcn.00427cc2
mov al, byte [ebp - 0x130]
test al, al
je 0x44b488
mov esi, 0x4ca9e6
movzx eax, byte [ebp - 0x18]
push 0x1f0010
call fcn.0040148e
test al, al
jne 0x44b496
mov al, byte [ebp - 0x12c]
test al, al
jne 0x44b2f9
mov al, byte [ebp - 0x12c]
test al, al
je 0x44b54c
cmp byte [ebp - 0x18], 0x2b
je 0x44b54c
push 1
mov eax, dword [0x4d91ad]
call fcn.00427012
mov edi, dword [ebp - 4]
mov word [edi + 0x9a], ax
mov bx, word [ebp - 0x138]
cmp word [edi + 0x9a], bx
sete al
mov byte [ebp - 0x12c], al
test al, al
jne 0x44b50b
mov bx, word [ebp + 8]
mov word [0x4d8869], bx
mov eax, edi
call fcn.00421072
mov eax, dword [ebp - 4]
call fcn.00426eb2
mov byte [ebp - 0x12c], al
test al, al
jne 0x44b50b
mov eax, dword [ebp - 4]
call fcn.00420fe2
mov al, byte [ebp - 0x12c]
test al, al
je 0x44b54a
mov edi, dword [ebp - 4]
mov esi, edi
mov bx, word [edi + 0xc9]
mov word [esi + 0xa2], bx
mov eax, esi
mov bx, word [esi + 0xcb]
mov word [eax + 0xa4], bx
mov bx, word [ebp + 8]
mov word [0x4d8869], bx
push 5
call fcn.00427cc2
jmp 0x44b55b
mov byte [ebp - 0x12c], 0
mov eax, dword [ebp - 4]
call fcn.00420fe2
jmp 0x44b565
mov eax, dword [ebp - 4]
call fcn.00420fe2
jmp 0x44b59a
movzx eax, byte [0x4d8cf7]
cmp ax, 0x54
jne 0x44b585
push 0x4ca9ea
push 0x4ca9fe
call fcn.004135d0
jmp 0x44b59a
cmp ax, 0x45
jne 0x44b59a
push 0x4caa0e
push 0x4caa21
call fcn.004135d0
mov eax, dword [0x4d91ad]
call fcn.004139f2
mov al, byte [ebp - 0x12c]
pop edx
pop ecx
pop ebx
leave
ret 4