Function at 0x44cef7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0x12
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x44cefd
call fcn.004ceb50
push dword [esp + 0x5c]
call fcn.0044f440
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.0044f000
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.0044f000
mov edx, dword [esp + 0x58]
lea ecx, [esp + 8]
call fcn.0044f000
push dword [esp]
call fcn.0044d5a3
push dword [esp + 8]
mov edx, 0x5e70f0
pop ecx
call fcn.0044f3d0
je 0x44cfaa
cmp dword [0xf8179c], 0
je 0x44cf8e
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0xf817a0]
or ebx, 0xf003f
push ebx
push 0
push dword [0xf81790]
push dword [0xf81798]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x44cfa8
lea eax, [esp + 0x10]
push eax
push dword [0xf81790]
push dword [0xf81798]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
jmp 0x44d00f
lea eax, [esp + 0x18]
push eax
push dword [0xf81798]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x14], eax
cmp dword [0xf8179c], 0
je 0x44cff7
lea eax, [esp + 0x10]
push eax
mov ebx, dword [0xf817a0]
or ebx, 0xf003f
push ebx
push 0
push dword [0xf81790]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0xc], eax
jmp 0x44d00f
lea eax, [esp + 0x10]
push eax
push dword [0xf81790]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44d2e8
mov dword [esp + 0x1c], 0x400
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
push dword [esp + 0x24]
call fcn.004cc530
lea eax, [esp + 0x24]
push eax
call fcn.004ceac0
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
jne 0x44d2e8
push dword [esp + 0x24]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x44d0f0
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44d0dd
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004ccff0
lea eax, [esp + 0x30]
push eax
call fcn.004ceac0
jmp 0x44d0eb
mov edx, 0x5e60ba
lea ecx, [esp + 0x2c]
call fcn.0044f008
jmp 0x44d2e7
mov ebx, 2
cmp ebx, dword [esp]
jne 0x44d165
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44d152
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov ebx, dword [esp + 0x28]
dec ebx
push ebx
push dword [esp + 0x30]
call fcn.004ccff0
lea eax, [esp + 0x30]
push eax
call fcn.004ceac0
jmp 0x44d160
mov edx, 0x5e60ba
lea ecx, [esp + 0x2c]
call fcn.0044f008
jmp 0x44d2e7
mov ebx, 4
cmp ebx, dword [esp]
jne 0x44d1d7
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44d1c4
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, dword [esp + 0x3c]
cdq
push edx
push eax
call fcn.004cc2f0
lea eax, [esp + 0x30]
push eax
call fcn.004ceac0
jmp 0x44d1d2
mov edx, 0x5e71a0
lea ecx, [esp + 0x2c]
call fcn.0044f008
jmp 0x44d2e7
mov ebx, 3
cmp ebx, dword [esp]
jne 0x44d2e7
mov dword [esp + 0x38], 0x400
push dword [esp + 0x38]
call fcn.004cd990
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x40]
lea eax, [esp + 0x48]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x44d2e7
mov edx, 0x5e60ba
lea ecx, [esp + 0x2c]
call fcn.0044f008
mov dword [esp + 0x44], 0
jmp 0x44d242
mov ebx, dword [esp + 0x38]
dec ebx
cmp ebx, dword [esp + 0x44]
jl 0x44d2de
mov ebx, dword [esp + 0x3c]
add ebx, dword [esp + 0x44]
push ebx
call fcn.004cdce0
mov ebx, eax
and ebx, 0xff
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x48]
cmp ebx, 0x10
jge 0x44d29b
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
mov edx, 0x5e71a0
push edx
call fcn.004cea70
lea eax, [esp + 0x30]
push eax
call fcn.004ceac0
mov edx, dword [esp + 0x2c]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea40
pop edx
push eax
mov eax, dword [esp + 0x54]
cdq
push edx
push eax
call fcn.004cc660
pop eax
lea eax, [esp + 0x30]
push eax
call fcn.004ceac0
inc dword [esp + 0x44]
jno 0x44d242
push dword [esp + 0x3c]
call fcn.004cd930
pop eax
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x28]
push edx
call fcn.004cea40
pop edx
push eax
push edx
call fcn.004cea70
pop eax
push eax
call fcn.0044f410
pop edx
add eax, edx
jmp 0x44d319
push dword [esp + 8]
call fcn.004cebc0
push dword [esp + 0x20]
call fcn.004cebc0
push dword [esp]
call fcn.004cebc0
push dword [esp + 4]
call fcn.004cebc0
push dword [esp + 0x28]
call fcn.004cebc0
add esp, 0x48
pop ebx
ret 0xc