Function at 0x447210
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x497290
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edi
mov eax, dword [0x4f9130]
mov dword [ebp - 0x34], ecx
mov ecx, eax
inc eax
mov dword [0x4f9130], eax
test ecx, ecx
jne 0x4478c4
or edx, 0xffffffff
mov dword [0x4ef3d8], 0xffffffff
mov eax, 0x4ef3dc
test esi, esi
je 0x44741e
cmp dword [0x4ef3f0], 0x10
cmovae eax, dword [0x4ef3dc]
cmp esi, eax
jb 0x4473ff
cmp dword [0x4ef3f0], 0x10
mov ecx, 0x4ef3dc
mov eax, dword [0x4ef3ec]
cmovae ecx, dword [0x4ef3dc]
add eax, ecx
cmp esi, eax
ja 0x4473ff
cmp dword [0x4ef3f0], 0x10
mov eax, 0x4ef3dc
cmovae eax, dword [0x4ef3dc]
sub esi, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], edi
mov eax, dword [0x4ef3ec]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, esi
jb 0x4478df
sub eax, esi
mov esi, edx
cmp eax, edx
cmovb esi, eax
cmp dword [0x4ef3f0], 0x10
mov eax, 0x4ef3dc
mov dword [ebp - 0x30], esi
cmovae eax, dword [0x4ef3dc]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp esi, 0xf
ja 0x44733c
push esi
push eax
lea eax, [ebp - 0x28]
lfence
push eax
mov dword [ebp - 0x18], esi
call fcn.00413660
mov byte [ebp + esi - 0x28], 0
jmp 0x447395
cmp esi, 0x7fffffff
ja 0x4478e4
mov edi, esi
or edi, 0xf
lfence
cmp edi, 0x7fffffff
jbe 0x44735f
mov edi, closesocket
jmp 0x44736a
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x28]
call fcn.00437e20
mov esi, eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x30]
push eax
push dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
push esi
call fcn.00413660
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], esi
mov byte [esi + eax], 0
add esp, 0xc
mov dword [ebp - 0x38], 1
mov ecx, 0x4ef3dc
call fcn.00437cf0
movups xmm0, xmmword [ebp - 0x28]
mov edi, 1
mov byte [ebp - 0x28], 0
movups xmmword [0x4ef3dc], xmm0
movq xmm0, qword [ebp - 0x18]
mov dword [ebp - 0x38], edi
and edi, 0xfffffffe
movq qword [0x4ef3ec], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], 0xffffffff
or edx, 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
jmp 0x447435
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x447404
sub ecx, edx
push ecx
push esi
mov ecx, 0x4ef3dc
call fcn.00438520
or edx, 0xffffffff
jmp 0x447435
cmp dword [0x4ef3f0], 0x10
mov dword [0x4ef3ec], edi
cmovae eax, dword [0x4ef3dc]
mov byte [eax], 0
mov esi, dword [ebp - 0x34]
mov eax, 0x4ef3f4
test esi, esi
je 0x4475e9
cmp dword [0x4ef408], 0x10
cmovae eax, dword [0x4ef3f4]
cmp esi, eax
jb 0x4475cd
cmp dword [0x4ef408], 0x10
mov ecx, 0x4ef3f4
mov eax, dword [0x4ef404]
cmovae ecx, dword [0x4ef3f4]
add eax, ecx
cmp esi, eax
ja 0x4475cd
cmp dword [0x4ef408], 0x10
mov eax, 0x4ef3f4
cmovae eax, dword [0x4ef3f4]
sub esi, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 4], 1
mov eax, dword [0x4ef404]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, esi
jb 0x4478df
sub eax, esi
mov esi, edx
cmp eax, 0xffffffff
cmovb esi, eax
cmp dword [0x4ef408], 0x10
mov eax, 0x4ef3f4
mov dword [ebp - 0x2c], esi
cmovae eax, dword [0x4ef3f4]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
cmp esi, 0xf
ja 0x447513
push esi
push eax
lea eax, [ebp - 0x28]
lfence
push eax
mov dword [ebp - 0x18], esi
call fcn.00413660
mov byte [ebp + esi - 0x28], 0
jmp 0x44756f
cmp esi, 0x7fffffff
ja 0x4478e4
mov eax, esi
or eax, 0xf
lfence
cmp eax, 0x7fffffff
jbe 0x447535
mov eax, closesocket
jmp 0x447540
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x28]
inc eax
push eax
call fcn.00437e20
mov ecx, dword [ebp - 0x2c]
mov esi, eax
mov eax, dword [ebp - 0x30]
push ecx
push dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
push esi
mov dword [ebp - 0x14], eax
call fcn.00413660
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
mov byte [esi + eax], 0
add esp, 0xc
or edi, 2
mov ecx, 0x4ef3f4
mov dword [ebp - 0x38], edi
call fcn.00437cf0
movups xmm0, xmmword [ebp - 0x28]
and edi, 0xfffffffd
mov byte [ebp - 0x28], 0
movups xmmword [0x4ef3f4], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [0x4ef404], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
jmp 0x447604
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4475d2
sub ecx, edx
push ecx
push esi
mov ecx, 0x4ef3f4
call fcn.00438520
jmp 0x447604
cmp dword [0x4ef408], 0x10
mov dword [0x4ef404], 0
cmovae eax, dword [0x4ef3f4]
mov byte [eax], 0
mov edx, dword [ebp - 0x3c]
mov eax, 0x4ef40c
test edx, edx
je 0x4477b7
mov esi, dword [0x4ef420]
cmp esi, 0x10
cmovae eax, dword [0x4ef40c]
cmp edx, eax
jb 0x447795
mov eax, dword [0x4ef41c]
cmp esi, 0x10
mov ecx, 0x4ef40c
cmovae ecx, dword [0x4ef40c]
add eax, ecx
cmp edx, eax
ja 0x447795
cmp esi, 0x10
mov eax, 0x4ef40c
cmovae eax, dword [0x4ef40c]
sub edx, eax
mov dword [ebp - 4], 2
mov eax, dword [0x4ef41c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp eax, edx
jb 0x4478df
sub eax, edx
mov esi, 0xffffffff
cmp eax, 0xffffffff
cmovb esi, eax
cmp dword [0x4ef420], 0x10
mov eax, 0x4ef40c
mov dword [ebp - 0x30], esi
cmovae eax, dword [0x4ef40c]
add eax, edx
mov dword [ebp - 0x3c], eax
cmp esi, 0xf
ja 0x4476db
push esi
push eax
lea eax, [ebp - 0x28]
lfence
push eax
mov dword [ebp - 0x18], esi
call fcn.00413660
mov byte [ebp + esi - 0x28], 0
jmp 0x447737
cmp esi, 0x7fffffff
ja 0x4478e4
mov eax, esi
or eax, 0xf
lfence
cmp eax, 0x7fffffff
jbe 0x4476fd
mov eax, closesocket
jmp 0x447708
cmp eax, 0x16
mov ecx, 0x16
cmovb eax, ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x28]
inc eax
push eax
call fcn.00437e20
mov ecx, dword [ebp - 0x30]
mov esi, eax
mov eax, dword [ebp - 0x2c]
push ecx
push dword [ebp - 0x3c]
mov dword [ebp - 0x18], ecx
push esi
mov dword [ebp - 0x14], eax
call fcn.00413660
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], esi
mov byte [esi + eax], 0
add esp, 0xc
or edi, 4
mov ecx, 0x4ef40c
mov dword [ebp - 0x38], edi
call fcn.00437cf0
movups xmm0, xmmword [ebp - 0x28]
and edi, 0xfffffffb
mov byte [ebp - 0x28], 0
movups xmmword [0x4ef40c], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [0x4ef41c], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
jmp 0x4477d2
mov ecx, edx
lea esi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4477a0
sub ecx, esi
push ecx
push edx
mov ecx, 0x4ef40c
call fcn.00438520
jmp 0x4477d2
cmp dword [0x4ef420], 0x10
mov dword [0x4ef41c], 0
cmovae eax, dword [0x4ef40c]
mov byte [eax], 0
mov eax, dword [ebp - 0x40]
mov esi, str._unspecified_
test eax, eax
cmovne esi, eax
mov eax, dword [0x4ef3d4]
cmp eax, 0x40
jne 0x4478b0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x2c], 0
push eax
push 1
push 0
push 0x4a01f0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x40], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x447849
cmp eax, 2
jne 0x447832
push str.Inst_GetDefaultLogLevel:_Log_level_path_doesnt_exist_so_cant_open
push 4
call fcn.00446b80
add esp, 8
mov eax, 0x2f
jmp 0x4478ab
push str.Inst_GetDefaultLogLevel:_Could_not_open_log_level_path
push eax
push 4
call fcn.00447040
add esp, 0xc
mov eax, 0x2f
jmp 0x4478ab
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push str.LogLevel
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x447880
push str.Inst_GetDefaultLogLevel:_Could_not_read_log_level_value
push eax
push 4
call fcn.00447040
add esp, 0xc
mov dword [ebp - 0x34], 0x2f
mov eax, dword [ebp - 0x2c]
cmp eax, 4
je 0x44789f
push eax
push str.Inst_GetDefaultLogLevel:_Log_level_value_is_the_wrong_type:_0x_08x
push 4
call fcn.00446b80
add esp, 0xc
mov dword [ebp - 0x34], 0x2f
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
mov dword [0x4ef3d4], eax
push eax
push esi
push str.Inst_SetupLogging:_Begin_Logging__s__LogLevel_0x_08x_
push 0x100
call fcn.00446b80
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
call fcn.00437e10
call fcn.00437e00
int3