Function at 0x44cf15
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x41
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x220]
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x2ac
mov dword [ebp - 0x278], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x270], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], esi
mov dword [esp + 4], str.SOFTWAREMicrosoftWIMMountMounted_Images
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x44cf79
xor eax, eax
jmp 0x44d1c8
lea eax, [ebp - 0x254]
xor ecx, ecx
lea esi, [ebp - 0x250]
xor ebx, ebx
mov dword [ebp - 0x26c], 0x104
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x25c]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x260]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x264]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x268]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x270]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x26c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0x2c], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
sub esp, 0x30
mov eax, dword [ebp - 0x27c]
cmp ebx, dword [ebp - 0x270]
jae 0x44d19f
xor edx, edx
lea edi, [ebp - 0x248]
mov dword [ebp - 0x278], 0x28
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x278]
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
sub esp, 0x20
test eax, eax
je 0x44d05a
inc ebx
jmp 0x44d001
mov dword [esp + 0x10], edi
lea edi, [ebp - 0x11c]
mov dword [esp + 0xc], str.SOFTWAREMicrosoftWIMMountMounted_Images_sWIM_Path
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov byte [ebp - 0x19], 0
mov ecx, 1
mov edx, edi
mov dword [esp + 4], 0x104
mov eax, 0x80000002
mov dword [esp], 0x527d80
call fcn.0044c8e2
test eax, eax
jne 0x44d10e
lea edx, [ebp - 0x11c]
lea edi, [ebp - 0x248]
mov dword [esp + 0xc], str.SOFTWAREMicrosoftWIMMountMounted_Images_sImage_Index
mov dword [esp], edx
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll__snprintf_s]
lea eax, [ebp - 0x274]
mov byte [ebp - 0x19], 0
mov ecx, 4
mov dword [esp], eax
lea edx, [ebp - 0x11c]
mov eax, 0x80000002
mov dword [esp + 4], 4
call fcn.0044c8e2
test eax, eax
jne 0x44d12a
jmp 0x44d139
mov eax, dword [ebp + 8]
mov dword [esp], 0x527d80
mov dword [esp + 4], eax
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x44d0ad
jmp 0x44d057
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x274], eax
jne 0x44d057
mov byte [0x527d80], 0
mov dword [esp + 0x10], edi
lea edi, [ebp - 0x11c]
mov dword [esp + 0xc], str.SOFTWAREMicrosoftWIMMountMounted_Images_sMount_Path
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf_s]
mov byte [ebp - 0x19], 0
mov ecx, 1
mov edx, edi
mov dword [esp + 4], 0x104
mov eax, 0x80000002
mov dword [esp], 0x527d80
call fcn.0044c8e2
test eax, eax
je 0x44d057
cmp ebx, dword [ebp - 0x270]
jb 0x44d1a6
mov byte [0x527d80], 0
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
cmp byte [0x527d80], 0
je 0x44cf72
mov eax, 0x527d80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret