Function at 0x44eee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x675f64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x683088]
push edi
mov edi, ecx
test esi, esi
jne 0x44ef2e
push 0xd94
call fcn.004551c5
mov esi, eax
add esp, 4
test esi, esi
je 0x44ef26
push 0xd94
push 0
push esi
call fcn.005aecd0
add esp, 0xc
jmp 0x44ef28
xor esi, esi
mov dword [0x683088], esi
push edi
push 0x80
push esi
call fcn.005b222f
lea eax, [edi + 0x100]
push eax
mov eax, dword [0x683088]
add eax, 0x100
push 0x80
push eax
call fcn.005b222f
lea eax, [edi + 0x200]
push eax
mov eax, dword [0x683088]
add eax, 0x200
push 0x80
push eax
call fcn.005b222f
lea eax, [edi + 0x300]
push eax
mov eax, dword [0x683088]
add eax, 0x300
push 3
push eax
call fcn.005b222f
lea eax, [edi + 0x306]
push eax
mov eax, dword [0x683088]
add eax, 0x306
push 0x80
push eax
call fcn.005b222f
lea eax, [edi + 0x406]
push eax
mov eax, dword [0x683088]
add eax, 0x406
push 0x80
push eax
call fcn.005b222f
add esp, 0x48
lea eax, [edi + 0x506]
push eax
mov eax, dword [0x683088]
add eax, 0x506
push 0x80
push eax
call fcn.005b222f
mov ecx, dword [0x683088]
mov eax, dword [edi + 0x608]
mov dword [ecx + 0x608], eax
mov eax, dword [edi + 0x60c]
mov dword [ecx + 0x60c], eax
lea eax, [edi + 0x610]
push eax
lea eax, [ecx + 0x610]
push 0x80
push eax
call fcn.005b222f
lea eax, [edi + 0x710]
push eax
mov eax, dword [0x683088]
add eax, 0x710
push 0x141
push eax
call fcn.005b222f
lea eax, [edi + 0x992]
push eax
mov eax, dword [0x683088]
add eax, 0x992
push 0x80
push eax
call fcn.005b222f
mov ecx, dword [0x683088]
mov al, byte [edi + 0xa92]
push str.Windows
push 0x80
mov byte [ecx + 0xa92], al
lea eax, [ecx + 0xa94]
push eax
call fcn.005b222f
add esp, 0x3c
push 0x64c308
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44f0c2
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
push ecx
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call eax
mov ax, word [ebp - 0x34]
cmp ax, 6
je 0x44f0be
cmp ax, 9
jne 0x44f0c2
mov cl, 1
jmp 0x44f0c4
xor cl, cl
test cl, cl
mov edx, 0x6479ec
mov eax, 0x6439c8
cmove eax, edx
push eax
mov eax, dword [0x683088]
add eax, 0xb94
push 0x80
push eax
call fcn.005b222f
mov edi, dword [0x683088]
add esp, 0xc
xor esi, esi
add edi, 0xc94
mov dword [ebp - 8], esi
push str.RtlGetVersion
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44f131
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x150], 0x11c
push ecx
call eax
mov esi, dword [ebp - 0x144]
lea eax, [ebp - 0x154]
mov dword [ebp - 0x154], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44f196
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x64c33c
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
push esi
push str._d._d
push edi
call dword [0x67d074]
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.0058ac9d
mov esp, ebp
pop ebp
ret