Function at 0x447430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ed811
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x81bc
call fcn.004b4b00
mov eax, dword [0x555ab0]
xor eax, esp
mov dword [esp + 0x81b8], eax
push ebx
push esi
push edi
mov eax, dword [0x555ab0]
xor eax, esp
push eax
lea eax, [esp + 0x81d0]
mov dword fs:[0], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov edx, ecx
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x81dc], 0
call fcn.00444fd0
add esp, 4
lea ecx, [esp + 0x1c]
push 0x2001f
push dword [eax]
push dword [0x558ef4]
call fcn.0041d5a0
mov edx, dword [esp + 0x10]
test eax, eax
setne bl
add edx, 0xfffffff0
or eax, 0xffffffff
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4474e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [0x55e860]
test bl, bl
je 0x44753a
mov eax, esi
imul eax, esi
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 0xb
jne 0x44752f
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xf
jne 0x447527
dec esi
mov dword [0x55e860], esi
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [esp + 0x1c]
xor bl, bl
jmp 0x447801
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xb
jne 0x447554
dec esi
mov dword [0x55e860], esi
xor eax, eax
push 0x7ffe
push eax
mov word [esp + 0x1cc], ax
lea eax, [esp + 0x1ce]
push eax
mov dword [esp + 0x24], 0x4000
call fcn.004b4d70
lea eax, [esi + 1]
imul eax, esi
cdq
mov edi, 0x13
idiv edi
xor ecx, ecx
add esp, 0xc
mov dword [esp + 0x10], ecx
cmp edx, 0x11
jne 0x4475d8
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aeef0
push eax
call fcn.004b08fb
mov esi, dword [0x55e860]
add esp, 8
xor ecx, ecx
movsd xmm0, qword [0x53f9d8]
movsd xmm1, qword [0x53fa00]
movsd xmm5, qword [0x53f9d0]
mov ebx, dword [esp + 0x1c]
xorps xmm2, xmm2
movsd qword [esp + 0x3c], xmm0
movsd qword [esp + 0x44], xmm2
movsd qword [esp + 0x2c], xmm1
movsd qword [esp + 0x34], xmm5
mov eax, esi
imul eax, esi
cdq
mov edi, 0x14
idiv edi
cmp edx, 0xf
jne 0x447666
movd xmm4, esi
movapd xmm3, xmm0
cvtdq2pd xmm4, xmm4
lea ecx, [ecx]
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x44764a
subsd xmm2, xmm3
divsd xmm3, xmm1
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
movsd xmm1, qword [esp + 0x2c]
comisd xmm0, xmm5
ja 0x447630
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1d8]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
mov dword [esp + 0x10], ecx
test edi, edi
je 0x44769e
cmp edi, 0x103
jne 0x4477c3
mov eax, dword [0x5556d8]
mov ecx, 0x5556d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c4]
mov byte [esp + 0x81d8], 1
test eax, 0xffff0000
jne 0x4476e3
movzx esi, ax
mov ecx, esi
call fcn.00401970
test eax, eax
je 0x447711
push esi
push eax
lea ecx, [esp + 0x1c]
call fcn.00402420
jmp 0x447711
lea ecx, [esp + 0x1c4]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4476f0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x1c8]
push eax
lea ecx, [esp + 0x1c]
call fcn.004021b0
mov byte [esp + 0x81d8], 2
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x447731
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x14]
push eax
call fcn.0041eef0
push 0x8000
lea eax, [esp + 0x1c8]
push 0
push eax
mov dword [esp + 0x24], 0x4000
call fcn.004b4d70
mov esi, dword [0x55e860]
mov ecx, 0x18
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
add esp, 0xc
cmp edx, 1
jne 0x447799
xor ecx, ecx
jmp 0x447770
mov eax, dword [esp + ecx*4 + 0x58]
add eax, dword [esp + ecx*4 + 0x54]
add ecx, 4
add eax, dword [esp + ecx*4 + 0x40]
add eax, dword [esp + ecx*4 + 0x3c]
imul eax, eax, 0xd4
add esi, eax
cmp ecx, 0x178
jb 0x447770
mov dword [0x55e860], esi
mov byte [esp + 0x81d8], 0
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4477bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x10]
test edi, edi
jne 0x4477ea
mov esi, dword [0x55e860]
movsd xmm5, qword [esp + 0x34]
movsd xmm1, qword [esp + 0x2c]
movsd xmm0, qword [esp + 0x3c]
movsd xmm2, qword [esp + 0x44]
jmp 0x44760f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4477fb
push ebx
call edi
xor eax, eax
jmp 0x4477ff
mov eax, dword [esp + 0x1c]
mov bl, 1
test eax, eax
je 0x447808
push eax
call edi
mov al, bl
mov ecx, dword [esp + 0x81d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x81b8]
xor ecx, esp
call fcn.004b00a0
mov esp, ebp
pop ebp
ret