Function at 0x44662c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x446632
call fcn.004a2de0
push dword [esp + 0x5c]
call fcn.00448470
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00448000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00448000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00448000
push dword [esp]
call fcn.00446cd9
push dword [esp + 8]
mov edx, 0x527f9e
pop ecx
call fcn.00448400
je 0x4466df
cmp dword [0x1df6b28], 0
je 0x4466c3
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x1df6b2c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x1df6b1c]
push dword [0x1df6b24]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x4466dd
lea eax, [esp + 0x10]
push eax
push dword [0x1df6b1c]
push dword [0x1df6b24]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x446744
lea eax, [esp + 0x18]
push eax
push dword [0x1df6b24]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x1df6b28], 0
je 0x44672c
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x1df6b2c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x1df6b1c]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x446744
lea eax, [esp + 0x10]
push eax
push dword [0x1df6b1c]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x446a1e
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
push dword [esp + 0x24]
call fcn.004a07f0
lea eax, [esp + 0x24]
push eax
call fcn.004a2c50
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x446a1e
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x446825
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x446812
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004a1170
lea eax, [esp + 0x30]
push eax
call fcn.004a2c50
jmp 0x446820
mov edx, 0x5270ba
lea ecx, [esp + 0x2c]
call fcn.00448008
jmp 0x446a1d
mov ebx, 2
cmp ebx, dword [esp]
jne 0x44689a
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x446887
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004a1170
lea eax, [esp + 0x30]
push eax
call fcn.004a2c50
jmp 0x446895
mov edx, 0x5270ba
lea ecx, [esp + 0x2c]
call fcn.00448008
jmp 0x446a1d
mov ebx, 4
cmp ebx, dword [esp]
jne 0x44690c
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x4468f9
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004a1210
lea eax, [esp + 0x30]
push eax
call fcn.004a2c50
jmp 0x446907
mov edx, 0x52804e
lea ecx, [esp + 0x2c]
call fcn.00448008
jmp 0x446a1d
mov ebx, 3
cmp ebx, dword [esp]
jne 0x446a1d
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004a1b50
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x446a1d
mov edx, 0x5270ba
lea ecx, [esp + 0x2c]
call fcn.00448008
mov dword [esp + 0x44], 0
jmp 0x446977
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x446a14
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.004483d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x4469d1
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
mov edx, 0x52804e
push edx
call fcn.004a2ce0
lea eax, [esp + 0x30]
push eax
call fcn.004a2c50
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2c10
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004a0920
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004a2c50
inc dword [esp + 0x44]
jno 0x446977
push dword [esp + 0x3c]
call fcn.004a1d30
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004a2c10
pop edx
push eax
push edx
call fcn.004a2ce0
pop eax
push eax
call fcn.00448440
pop edx
add eax, edx
jmp 0x446a4f
push dword [esp + 8]
call fcn.004a2e40
push dword [esp + 0x20]
call fcn.004a2e40
push dword [esp]
call fcn.004a2e40
push dword [esp + 4]
call fcn.004a2e40
push dword [esp + 0x28]
call fcn.004a2e40
add esp, 0x48
pop ebx
ret 0xc