Function at 0x4489b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push 0x4cb498
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
call fcn.0043c500
lea ecx, [esp + 0x14]
push ecx
push str.MachineGuid
mov ecx, str.SOFTWAREMicrosoftCryptography_
mov eax, reloc.WSOCK32.dll_bind
lea edi, [esp + 0x40]
call fcn.0041e810
mov esi, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp esi, ebx
je 0x448a1b
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448a12
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call edi
jmp 0x448a21
cmp eax, ebx
jne 0x448a1b
call fcn.0045f5a0
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x38]
call fcn.004024a0
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x448ad1
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x448a50
push esi
call ebp
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448a64
push esi
call edi
jmp 0x448a6d
cmp eax, ebx
jne 0x448a6d
call fcn.0045f5a0
lea eax, [esi + 4]
cmp eax, ebx
je 0x448ad1
cmp byte [eax], bl
je 0x448ad1
mov ebx, dword [esp + 0x54]
push esi
mov dword [ebx], esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x448a90
push esi
call ebp
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448ab5
push esi
call edi
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
jne 0x448abe
call fcn.0045f5a0
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov eax, dword [esp + 0x30]
push 0x101
push str.SOFTWAREMicrosoftCryptography_
push reloc.WSOCK32.dll_bind
lea edx, [esp + 0x34]
xor eax, eax
push edx
mov edx, str.MachineGuid
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
call fcn.00455560
mov edi, 0x800
call fcn.0045f460
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x448b33
push edi
push esi
push ebx
mov dword [esp + 0x2c], edi
call fcn.004a1b50
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, esi
je 0x448b39
add eax, 4
jmp 0x448b3b
mov dword [esp + 0x20], esi
jmp 0x448b26
xor eax, eax
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x2c]
push ebx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x24]
push ecx
push esi
push eax
push edx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], esi
cmp ebx, esi
je 0x448b89
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448b70
sub eax, edx
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.0043c500
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x1c]
call fcn.00401250
test esi, esi
je 0x448bbc
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448bb3
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x448bbc
test eax, eax
jne 0x448bbc
call fcn.0045f5a0
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x54]
mov dword [edx], ebp
test ebp, ebp
je 0x448be4
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0x80
jl 0x448be4
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp dword [esp + 0x20], 0
je 0x448bf6
test ebx, ebx
je 0x448bf6
mov esi, ebx
call fcn.0045f5a0
lea edi, [esp + 0x28]
call fcn.004554e0
test ebp, ebp
je 0x448c3d
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x448c32
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
jne 0x448c3d
mov esi, ebp
call fcn.0045f5a0
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret