Function at 0x44a402
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44a408
call fcn.004a68b0
push dword [esp + 0x5c]
call fcn.0044c470
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0044c000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0044c000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0044c000
push dword [esp]
call fcn.0044aaaf
push dword [esp + 8]
mov edx, 0x53105c
pop ecx
call fcn.0044c400
je 0x44a4b5
cmp dword [0x11470f4], 0
je 0x44a499
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x11470f8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x11470e8]
push dword [0x11470f0]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x44a4b3
lea eax, [esp + 0x10]
push eax
push dword [0x11470e8]
push dword [0x11470f0]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x44a51a
lea eax, [esp + 0x18]
push eax
push dword [0x11470f0]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x11470f4], 0
je 0x44a502
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x11470f8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x11470e8]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x44a51a
lea eax, [esp + 0x10]
push eax
push dword [0x11470e8]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44a7f4
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a6710
pop edx
push eax
push dword [esp + 0x24]
call fcn.004a4170
lea eax, [esp + 0x24]
push eax
call fcn.004a6750
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44a7f4
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x44a5fb
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44a5e8
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a6710
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004a4c50
lea eax, [esp + 0x30]
push eax
call fcn.004a6750
jmp 0x44a5f6
mov edx, 0x5300ba
lea ecx, [esp + 0x2c]
call fcn.0044c008
jmp 0x44a7f3
mov ebx, 2
cmp ebx, dword [esp]
jne 0x44a670
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44a65d
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a6710
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004a4c50
lea eax, [esp + 0x30]
push eax
call fcn.004a6750
jmp 0x44a66b
mov edx, 0x5300ba
lea ecx, [esp + 0x2c]
call fcn.0044c008
jmp 0x44a7f3
mov ebx, 4
cmp ebx, dword [esp]
jne 0x44a6e2
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44a6cf
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a6710
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004a4a60
lea eax, [esp + 0x30]
push eax
call fcn.004a6750
jmp 0x44a6dd
mov edx, 0x53110c
lea ecx, [esp + 0x2c]
call fcn.0044c008
jmp 0x44a7f3
mov ebx, 3
cmp ebx, dword [esp]
jne 0x44a7f3
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004a55a0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44a7f3
mov edx, 0x5300ba
lea ecx, [esp + 0x2c]
call fcn.0044c008
mov dword [esp + 0x44], 0
jmp 0x44a74d
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x44a7ea
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.0044c3d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x44a7a7
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a67e0
mov edx, 0x53110c
push edx
call fcn.004a67e0
lea eax, [esp + 0x30]
push eax
call fcn.004a6750
mov edx, dword [esp + 0x2c]
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a67e0
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a6710
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004a42a0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004a6750
inc dword [esp + 0x44]
jno 0x44a74d
push dword [esp + 0x3c]
call fcn.004a5540
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004a6710
pop edx
push eax
push edx
call fcn.004a67e0
pop eax
push eax
call fcn.0044c440
pop edx
add eax, edx
jmp 0x44a825
push dword [esp + 8]
call fcn.004a6910
push dword [esp + 0x20]
call fcn.004a6910
push dword [esp]
call fcn.004a6910
push dword [esp + 4]
call fcn.004a6910
push dword [esp + 0x28]
call fcn.004a6910
add esp, 0x48
pop ebx
ret 0xc