Function at 0x44fc8e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44fc94
call fcn.004ac8b0
push dword [esp + 0x5c]
call fcn.00452470
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.00452000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.00452000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.00452000
push dword [esp]
call fcn.0045033b
push dword [esp + 8]
mov edx, 0x5375de
pop ecx
call fcn.00452400
je 0x44fd41
cmp dword [0x2249c78], 0
je 0x44fd25
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x2249c7c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x2249c6c]
push dword [0x2249c74]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x44fd3f
lea eax, [esp + 0x10]
push eax
push dword [0x2249c6c]
push dword [0x2249c74]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x44fda6
lea eax, [esp + 0x18]
push eax
push dword [0x2249c74]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0x2249c78], 0
je 0x44fd8e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0x2249c7c]
or ebx, 0xf003f
push ebx
push 0
push dword [0x2249c6c]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x44fda6
lea eax, [esp + 0x10]
push eax
push dword [0x2249c6c]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x450080
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
push dword [esp + 0x24]
call fcn.004aa170
lea eax, [esp + 0x24]
push eax
call fcn.004ac750
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x450080
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x44fe87
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44fe74
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004aac50
lea eax, [esp + 0x30]
push eax
call fcn.004ac750
jmp 0x44fe82
mov edx, 0x5360c4
lea ecx, [esp + 0x2c]
call fcn.00452008
jmp 0x45007f
mov ebx, 2
cmp ebx, dword [esp]
jne 0x44fefc
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44fee9
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004aac50
lea eax, [esp + 0x30]
push eax
call fcn.004ac750
jmp 0x44fef7
mov edx, 0x5360c4
lea ecx, [esp + 0x2c]
call fcn.00452008
jmp 0x45007f
mov ebx, 4
cmp ebx, dword [esp]
jne 0x44ff6e
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44ff5b
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004aaa60
lea eax, [esp + 0x30]
push eax
call fcn.004ac750
jmp 0x44ff69
mov edx, 0x537772
lea ecx, [esp + 0x2c]
call fcn.00452008
jmp 0x45007f
mov ebx, 3
cmp ebx, dword [esp]
jne 0x45007f
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004ab5a0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x45007f
mov edx, 0x5360c4
lea ecx, [esp + 0x2c]
call fcn.00452008
mov dword [esp + 0x44], 0
jmp 0x44ffd9
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x450076
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
pop eax
call fcn.004523d0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x450033
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
mov edx, 0x537772
push edx
call fcn.004ac7e0
lea eax, [esp + 0x30]
push eax
call fcn.004ac750
mov edx, dword [esp + 0x2c]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac710
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004aa2a0
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004ac750
inc dword [esp + 0x44]
jno 0x44ffd9
push dword [esp + 0x3c]
call fcn.004ab540
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004ac710
pop edx
push eax
push edx
call fcn.004ac7e0
pop eax
push eax
call fcn.00452440
pop edx
add eax, edx
jmp 0x4500b1
push dword [esp + 8]
call fcn.004ac910
push dword [esp + 0x20]
call fcn.004ac910
push dword [esp]
call fcn.004ac910
push dword [esp + 4]
call fcn.004ac910
push dword [esp + 0x28]
call fcn.004ac910
add esp, 0x48
pop ebx
ret 0xc