Function at 0x448690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
push 0x4cb498
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], ebx
call fcn.0043c200
lea ecx, [esp + 0x14]
push ecx
push str.MachineGuid
mov ecx, str.SOFTWAREMicrosoftCryptography_
mov eax, reloc.WSOCK32.dll_bind
lea edi, [esp + 0x40]
call fcn.0041e540
mov esi, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp esi, ebx
je 0x4486fb
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x4486f2
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push esi
call edi
jmp 0x448701
cmp eax, ebx
jne 0x4486fb
call fcn.0045f130
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x18]
lea ecx, [esp + 0x38]
call fcn.004024a0
mov esi, dword [esp + 0x18]
mov dword [esp + 0x18], esi
cmp esi, ebx
je 0x4487b1
push esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x448730
push esi
call ebp
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448744
push esi
call edi
jmp 0x44874d
cmp eax, ebx
jne 0x44874d
call fcn.0045f130
lea eax, [esi + 4]
cmp eax, ebx
je 0x4487b1
cmp byte [eax], bl
je 0x4487b1
mov ebx, dword [esp + 0x54]
push esi
mov dword [ebx], esi
call edi
and eax, 0xff
cmp eax, 0x80
jl 0x448770
push esi
call ebp
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448795
push esi
call edi
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
jne 0x44879e
call fcn.0045f130
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
mov eax, dword [esp + 0x30]
push 0x101
push str.SOFTWAREMicrosoftCryptography_
push reloc.WSOCK32.dll_bind
lea edx, [esp + 0x34]
xor eax, eax
push edx
mov edx, str.MachineGuid
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], ebx
call fcn.00455250
mov edi, 0x800
call fcn.0045eff0
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x448813
push edi
push esi
push ebx
mov dword [esp + 0x2c], edi
call fcn.004a16b0
add esp, 0xc
mov eax, dword [esp + 0x34]
cmp eax, esi
je 0x448819
add eax, 4
jmp 0x44881b
mov dword [esp + 0x20], esi
jmp 0x448806
xor eax, eax
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x2c]
push ebx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x24]
push ecx
push esi
push eax
push edx
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esp + 0x14], esi
cmp ebx, esi
je 0x448869
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x448850
sub eax, edx
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.0043c200
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x1c]
call fcn.00401250
test esi, esi
je 0x44889c
push esi
call ebp
and eax, 0xff
cmp eax, 0x80
jl 0x448893
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x44889c
test eax, eax
jne 0x44889c
call fcn.0045f130
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x54]
mov dword [edx], ebp
test ebp, ebp
je 0x4488c4
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0x80
jl 0x4488c4
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp dword [esp + 0x20], 0
je 0x4488d6
test ebx, ebx
je 0x4488d6
mov esi, ebx
call fcn.0045f130
lea edi, [esp + 0x28]
call fcn.004551d0
test ebp, ebp
je 0x44891d
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and eax, 0xff
cmp eax, 0x80
jl 0x448912
push ebp
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
test eax, eax
jne 0x44891d
mov esi, ebp
call fcn.0045f130
lea edi, [esp + 0x38]
call fcn.004026d0
mov eax, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret