Function at 0x445480
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e125
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4b41e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov edx, dword [edi + 0x99c]
cmp esi, edx
jge 0x44568d
lea ecx, [esi + 1]
jb 0x4454cb
mov edx, ecx
mov dword [edi + 0x99c], ecx
mov eax, dword [edi + 0x9a4]
lea ebx, [esi + esi*2]
shl ebx, 5
cmp byte [ebx + eax], 0
je 0x44568d
cmp edx, esi
ja 0x4454eb
mov dword [edi + 0x99c], ecx
mov esi, eax
mov eax, dword [esi + ebx + 0x54]
test eax, eax
je 0x44568d
cmp word [eax], 0
je 0x44568d
xorps xmm0, xmm0
mov byte [esi + ebx + 0x5c], 1
mov esi, eax
mov dword [ebp - 0x28], eax
movq qword [ebp - 0x34], xmm0
mov edi, str.Monitoring_
mov dword [ebp - 0x2c], 0
xor eax, eax
inc eax
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x445523
xor ecx, ecx
inc ecx
cmp word [ecx*2 + str.Monitoring_], 0
jne 0x445531
add ecx, eax
mov ebx, esi
test esi, esi
jne 0x44554a
mov dword [ebp - 0x28], esi
jmp 0x44555e
xor eax, eax
cmp word [esi], ax
je 0x44555c
mov dword [ebp - 0x28], esi
inc eax
cmp word [ebx + eax*2], 0
jne 0x445554
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x20], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
nop
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + ecx]
mov edx, eax
test ax, ax
jne 0x445590
mov esi, dword [ebp - 0x28]
mov eax, 0x5c
nop dword [eax]
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x4455b0
test ebx, ebx
je 0x4455e1
movzx eax, word [ebx]
mov edx, eax
test ax, ax
je 0x4455e1
nop
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x4455d0
mov edi, dword [ebp - 0x20]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], eax
push ecx
mov dword [ebp - 4], 0
mov edx, 0xf003f
mov ecx, edi
mov byte [ebp - 0x2c], 1
call fcn.00405480
mov esi, eax
mov dword [ebp - 0x1c], 0
test esi, esi
je 0x44566e
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], 4
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push str.Status
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44566e
cmp dword [ebp - 0x18], 4
jne 0x44566e
cmp dword [ebp - 0x1c], eax
je 0x44566e
push 4
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push str.Status
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
jmp 0x445674
mov bl, 1
test esi, esi
je 0x445680
cmp esi, 0xffffffff
je 0x445680
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00469e73
add esp, 4
mov al, bl
jmp 0x44568f
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00469e65
mov esp, ebp
pop ebp
ret 4