Function at 0x449e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x4605d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.004288a0
add esp, 0xc
mov ecx, dword [ebp - 0x44c]
mov edx, dword [ecx + 0x1a30]
and edx, 4
je 0x449f53
push 0x103
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x220]
push ecx
call fcn.00429415
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x220]
push ecx
call fcn.00428ced
add esp, 4
mov edx, 0x103
sub edx, eax
push edx
push str..dll
lea eax, [ebp - 0x220]
push eax
call fcn.00429ae7
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x44c]
call fcn.00449d20
cmp eax, 1
jne 0x449f4b
mov edx, dword [ebp + 0x14]
sub edx, 1
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00429415
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov word [eax + edx*2 - 2], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
jmp 0x44a1f7
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44a1d6
mov dword [ebp - 0x228], 0
lea edx, [ebp - 0x228]
push edx
push 0
lea eax, [ebp - 0x224]
push eax
push 0
push 0x459044
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a1cc
mov eax, dword [ebp - 0x228]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042837a
add esp, 4
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44a1cc
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x224]
push eax
push 0
push str.PATHEXT
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a1cc
mov edx, dword [ebp - 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], 0
mov word [ebp - 0x440], 0
push 0x208
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.004288a0
add esp, 0xc
push 0x458e9c
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.0040eff0
add esp, 8
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x44a1cc
mov edx, dword [ebp - 0x22c]
add edx, 2
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x230]
movzx ecx, word [eax]
test ecx, ecx
je 0x44a0cf
mov edx, dword [ebp - 0x230]
movzx eax, word [edx]
cmp eax, 0x20
je 0x44a0cf
mov ecx, dword [ebp - 0x230]
movzx edx, word [ecx]
cmp edx, 0x2c
je 0x44a0cf
mov eax, dword [ebp - 0x230]
movzx ecx, word [eax]
cmp ecx, 0x3b
je 0x44a0cf
mov edx, dword [ebp - 0x230]
movzx eax, word [edx]
cmp eax, 9
je 0x44a0cf
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
jmp 0x44a079
mov edx, dword [ebp - 0x230]
mov word [edx], 0
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x440]
push ecx
call fcn.00429415
add esp, 0xc
mov word [ebp - 0x238], 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x440]
push ecx
call fcn.00428ced
add esp, 4
mov edx, 0x104
sub edx, eax
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x440]
push ecx
call fcn.00429ae7
add esp, 0xc
lea edx, [ebp - 0x440]
push edx
mov ecx, dword [ebp - 0x44c]
call fcn.00449d20
cmp eax, 1
jne 0x44a180
mov eax, dword [ebp + 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x440]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00429415
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov word [ecx + eax*2 - 2], 0
mov dword [ebp - 0xc], 1
jmp 0x44a1cc
mov edx, dword [ebp - 0x230]
sub edx, dword [ebp - 4]
sar edx, 1
mov eax, dword [ebp - 0x228]
shr eax, 1
sub eax, 1
cmp edx, eax
jae 0x44a1c5
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x22c], ecx
push 0x458ee4
mov edx, dword [ebp - 0x22c]
push edx
call fcn.0040eff0
add esp, 8
mov dword [ebp - 0x22c], eax
jmp 0x44a1c7
jmp 0x44a1cc
jmp 0x44a05d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x44a1f4
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x448], ecx
mov edx, dword [ebp - 0x448]
push edx
call fcn.00428c38
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428c24
mov esp, ebp
pop ebp
ret 0x10