Function at 0x449047
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x46d014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x4c]
mov ebx, ecx
push eax
push 0xf003f
xor ecx, ecx
push ecx
push 0x40ce38
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x4c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
jne 0x449087
xor eax, eax
jmp 0x449337
push esi
call fcn.00448fe7
mov esi, eax
cmp esi, 0xffffffff
jne 0x4490a4
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x449336
inc esi
push edi
lea eax, [esi + esi]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
mov dword [ebp - 0x68], esi
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
push eax
push edi
lea eax, [ebp - 0x74]
xor esi, esi
push eax
push esi
push 0x40ceac
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x42
lea eax, [ebp - 0x48]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [ebp - 0x5c], esi
add esp, 0xc
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], esi
cmp word [edi], ax
je 0x4492fd
mov eax, ebx
and eax, 1
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x50]
push eax
push 0x40cec0
push edi
call fcn.00449d8d
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp - 0x6c], 0
lea esi, [eax + 1]
lea esi, [edi + esi*2]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
je 0x449199
push 0x40cec8
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x449199
mov ecx, 0x47c690
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x449145
sub ecx, edx
sar ecx, 1
je 0x449168
push 0x40ced8
push 0x20
pop edx
mov ecx, 0x47c690
call fcn.00442ee2
push 0xa
push 0x21
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
add esp, 0x10
lea eax, [ebp - 0x48]
mov ecx, 0x47c690
push eax
push 0x20
pop edx
call fcn.00442ee2
mov dword [ebp - 0x5c], 1
jmp 0x4492e4
test bl, 2
je 0x44920a
push 0x40cedc
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x44920a
mov ecx, 0x47c690
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4491b6
sub ecx, edx
sar ecx, 1
je 0x4491d9
push 0x40ced8
push 0x20
pop edx
mov ecx, 0x47c690
call fcn.00442ee2
push 0xa
push 0x21
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
add esp, 0x10
lea eax, [ebp - 0x48]
mov ecx, 0x47c690
push eax
push 0x20
pop edx
call fcn.00442ee2
mov dword [ebp - 0x60], 1
jmp 0x4492e4
test bl, 4
je 0x449278
push 0x40cf08
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x449278
mov ecx, 0x47c690
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x449227
sub ecx, edx
sar ecx, 1
je 0x44924a
push 0x40ced8
push 0x20
pop edx
mov ecx, 0x47c690
call fcn.00442ee2
push 0xa
push 0x21
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
add esp, 0x10
lea eax, [ebp - 0x48]
mov ecx, 0x47c690
push eax
push 0x20
pop edx
call fcn.00442ee2
mov dword [ebp - 0x64], 1
jmp 0x4492e4
test bl, 8
je 0x4492e4
push 0x40cf18
push esi
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4492e4
mov ecx, 0x47c690
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x449295
sub ecx, edx
sar ecx, 1
je 0x4492b8
push 0x40ced8
push 0x20
pop edx
mov ecx, 0x47c690
call fcn.00442ee2
push 0xa
push 0x21
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow_s]
add esp, 0x10
lea eax, [ebp - 0x48]
mov ecx, 0x47c690
push eax
push 0x20
pop edx
call fcn.00442ee2
mov dword [ebp - 0x58], 1
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea edi, [esi + eax*2]
xor eax, eax
cmp word [edi], ax
jne 0x449101
mov esi, dword [ebp - 0x58]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x70]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, bl
and al, 1
movzx eax, al
neg eax
pop ecx
sbb eax, eax
and eax, dword [ebp - 0x5c]
pop edi
test bl, 2
je 0x449327
or eax, dword [ebp - 0x60]
test bl, 4
je 0x44932f
or eax, dword [ebp - 0x64]
test bl, 8
je 0x449336
or eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00467073
leave
ret