Function at 0x44c53f
Capabilities:
Get file size
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, eax
xor eax, eax
push eax
mov edi, 0x8007000e
mov dword [ebp - 4], eax
call fcn.0044d3ab
test eax, eax
je 0x44c571
push ebx
push 0x41fdb8
push eax
call fcn.00443e3c
jmp 0x44c573
xor eax, eax
mov esi, eax
test ebx, ebx
jne 0x44c58e
test esi, esi
je 0x44c584
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004003
jmp 0x44c76b
test esi, esi
je 0x44c769
mov ecx, ebx
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x44c59d
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [ebp + 0xc]
mov edx, 0x404264
mov ecx, edx
test edi, edi
jne 0x44c5d3
mov ecx, 0x4044bc
lea eax, [ecx + 2]
mov dword [ebp + 0xc], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x44c5d9
sub ecx, dword [ebp + 0xc]
sar ecx, 1
test edi, edi
jne 0x44c5f3
mov edx, 0x4044bc
mov edi, dword [ebp + 8]
lea eax, [ecx*2 + 2]
push eax
push edx
push 0x41fdd0
push esi
push dword [edi + 0x14]
call fcn.00444422
push 4
push 0x4044bc
push 0x41fdd8
push esi
push dword [edi + 0x14]
call fcn.00444422
push ebx
call fcn.00440bc3
test eax, eax
je 0x44c75e
push 0x41
pop eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov edi, eax
pop ecx
test edi, edi
je 0x44c75e
xor eax, eax
push eax
push 0x8000080
push 3
push eax
push 3
push eax
push ebx
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x44c6ee
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp + 0xc], eax
cmp eax, reloc.ADVAPI32.dll_TraceMessage
je 0x44c6e5
cmp dword [ebp + 8], 0
push eax
mov ecx, edi
jbe 0x44c6a7
push dword [ebp + 8]
push 0x41fde8
push 0x41
pop eax
call fcn.0042c95b
add esp, 0xc
jmp 0x44c6b6
push 0x41d1dc
push 0x41
pop eax
call fcn.0042c95b
pop ecx
pop ecx
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x44c6bb
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
xor eax, eax
push eax
push 0x41fdf8
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0xc]
push eax
lea edx, [ebp + 8]
mov ecx, ebx
call fcn.00441bda
test eax, eax
js 0x44c756
mov ecx, dword [ebp + 0xc]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push 0x41d104
push 0x41
pop eax
mov ecx, edi
call fcn.0042c95b
mov ecx, edi
add esp, 0x14
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44c72f
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push ebx
push 0x4019ec
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8