Function at 0x44b320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push esi
push edi
push ebx
lea esi, [0x45667c]
mov ecx, 4
xor eax, eax
movzx edx, word [esi + 8]
add eax, edx
add esi, 0xc
dec ecx
jne 0x44b336
mov dword [ebp - 0x14], eax
imul eax, eax, 0x60
add eax, 0xa8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00403940
or eax, eax
je 0x44b555
mov esi, eax
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0xa4], ecx
lea edi, [esi + 0xa8]
lea edx, [0x47d34c]
push 0xa0
push edx
lea eax, [esi]
push eax
call sub.KERNEL32.dll_RtlMoveMemory
call fcn.00404b23
or eax, eax
je 0x44b398
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
call fcn.00404b45
push 0x208
lea eax, [esi + 0xa0]
push eax
call fcn.00403940
push dword [0x47d334]
push dword [esi + 0xa0]
call sub.KERNEL32.dll_lstrcpyW
push 0x208
lea eax, [ebp - 0x24]
push eax
call fcn.00403940
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SOFTWAREClasses
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x44b54a
mov dword [ebp - 0x18], 4
lea esi, [0x45667c]
push esi
movzx ebx, word [esi + 8]
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov esi, dword [esi + 4]
mov edx, dword [ebp - 0x1c]
mov dword [edi + 0xc], edx
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push edx
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x44b50a
mov dword [ebp - 0x10], 0x208
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
push 0
push 0
push 0
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegQueryValueExW
or eax, eax
jne 0x44b502
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push dword [ebp - 0x24]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x44b4ad
mov dword [ebp - 0x10], 0x50
mov eax, dword [0x47d0f4]
or eax, eax
je 0x44b48d
lea edx, [edi + 0x10]
push 0
push 1
push 0
push dword [ebp - 0x10]
push edx
push str.FriendlyTypeName
push dword [ebp - 0xc]
call eax
or eax, eax
jne 0x44b4a5
lea eax, [ebp - 0x10]
push eax
lea eax, [edi + 0x10]
push eax
push 0
push 0
push 0
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
push str._shellPEAnatomistcommand
push dword [ebp - 0x24]
call sub.KERNEL32.dll_lstrcatW
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push dword [ebp - 0x24]
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegOpenKeyExW
or eax, eax
jne 0x44b502
mov dword [ebp - 0x10], 0x208
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
push 0
push 0
push 0
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
or eax, eax
jne 0x44b4fa
inc eax
mov dword [edi], eax
mov dword [edi + 4], eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 8]
call sub.ADVAPI32.dll_RegCloseKey
lea eax, [edi + 0x10]
cmp dword [eax], 0
jne 0x44b51f
movzx edx, word [esi + 2]
push 0x50
push eax
push edx
call fcn.00403887
movzx eax, word [esi]
add eax, eax
add dword [ebp - 0x1c], eax
add esi, 4
add edi, 0x60
dec ebx
jne 0x44b404
pop esi
add esi, 0xc
sub dword [ebp - 0x18], 1
jne 0x44b3f7
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
push dword [ebp - 0x24]
call fcn.0040398e
mov eax, dword [ebp - 0x20]
pop ebx
pop edi
pop esi
leave
ret