Function at 0x44ea20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x673f64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x681078]
push edi
mov edi, ecx
test esi, esi
jne 0x44ea6e
push 0xd94
call fcn.00454d05
mov esi, eax
add esp, 4
test esi, esi
je 0x44ea66
push 0xd94
push 0
push esi
call fcn.005ae810
add esp, 0xc
jmp 0x44ea68
xor esi, esi
mov dword [0x681078], esi
push edi
push 0x80
push esi
call fcn.005b1d6f
lea eax, [edi + 0x100]
push eax
mov eax, dword [0x681078]
add eax, 0x100
push 0x80
push eax
call fcn.005b1d6f
lea eax, [edi + 0x200]
push eax
mov eax, dword [0x681078]
add eax, 0x200
push 0x80
push eax
call fcn.005b1d6f
lea eax, [edi + 0x300]
push eax
mov eax, dword [0x681078]
add eax, 0x300
push 3
push eax
call fcn.005b1d6f
lea eax, [edi + 0x306]
push eax
mov eax, dword [0x681078]
add eax, 0x306
push 0x80
push eax
call fcn.005b1d6f
lea eax, [edi + 0x406]
push eax
mov eax, dword [0x681078]
add eax, 0x406
push 0x80
push eax
call fcn.005b1d6f
add esp, 0x48
lea eax, [edi + 0x506]
push eax
mov eax, dword [0x681078]
add eax, 0x506
push 0x80
push eax
call fcn.005b1d6f
mov ecx, dword [0x681078]
mov eax, dword [edi + 0x608]
mov dword [ecx + 0x608], eax
mov eax, dword [edi + 0x60c]
mov dword [ecx + 0x60c], eax
lea eax, [edi + 0x610]
push eax
lea eax, [ecx + 0x610]
push 0x80
push eax
call fcn.005b1d6f
lea eax, [edi + 0x710]
push eax
mov eax, dword [0x681078]
add eax, 0x710
push 0x141
push eax
call fcn.005b1d6f
lea eax, [edi + 0x992]
push eax
mov eax, dword [0x681078]
add eax, 0x992
push 0x80
push eax
call fcn.005b1d6f
mov ecx, dword [0x681078]
mov al, byte [edi + 0xa92]
push str.Windows
push 0x80
mov byte [ecx + 0xa92], al
lea eax, [ecx + 0xa94]
push eax
call fcn.005b1d6f
add esp, 0x3c
push 0x64a8a8
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ec02
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x34]
push ecx
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call eax
mov ax, word [ebp - 0x34]
cmp ax, 6
je 0x44ebfe
cmp ax, 9
jne 0x44ec02
mov cl, 1
jmp 0x44ec04
xor cl, cl
test cl, cl
mov edx, 0x6465d4
mov eax, 0x642638
cmove eax, edx
push eax
mov eax, dword [0x681078]
add eax, 0xb94
push 0x80
push eax
call fcn.005b1d6f
mov edi, dword [0x681078]
add esp, 0xc
xor esi, esi
add edi, 0xc94
mov dword [ebp - 8], esi
push str.RtlGetVersion
push str.ntdll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44ec71
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x150], 0x11c
push ecx
call eax
mov esi, dword [ebp - 0x144]
lea eax, [ebp - 0x154]
mov dword [ebp - 0x154], 0
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ecd6
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x64a8dc
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x154]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
push esi
push str._d._d
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
call fcn.0058a7e9
mov esp, ebp
pop ebp
ret