Function at 0x44d060
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x4645c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov word [ebp - 0x220], 0
push 0x206
push 0
lea eax, [ebp - 0x21e]
push eax
call fcn.0042a350
add esp, 0xc
mov ecx, dword [ebp - 0x44c]
mov edx, dword [ecx + 0x1a30]
and edx, 4
je 0x44d163
push 0x103
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x220]
push ecx
call fcn.0042a6b1
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x220]
push ecx
call fcn.0042a3cf
add esp, 4
mov edx, 0x103
sub edx, eax
push edx
push str..dll
lea eax, [ebp - 0x220]
push eax
call fcn.0042b6f5
add esp, 0xc
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x44c]
call fcn.0044cf30
cmp eax, 1
jne 0x44d15b
mov edx, dword [ebp + 0x14]
sub edx, 1
push edx
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.0042a6b1
add esp, 0xc
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov word [eax + edx*2 - 2], 0
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
jmp 0x44d407
lea ecx, [ebp - 8]
push ecx
push 1
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x44d3e6
mov dword [ebp - 0x228], 0
lea edx, [ebp - 0x228]
push edx
push 0
lea eax, [ebp - 0x224]
push eax
push 0
push 0x45d32c
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44d3dc
mov eax, dword [ebp - 0x228]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00429e2e
add esp, 4
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x44d3dc
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x224]
push eax
push 0
push str.PATHEXT
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44d3dc
mov edx, dword [ebp - 4]
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], 0
mov word [ebp - 0x440], 0
push 0x208
push 0
lea eax, [ebp - 0x43e]
push eax
call fcn.0042a350
add esp, 0xc
push 0x45d184
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.004104f0
add esp, 8
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x44d3dc
mov edx, dword [ebp - 0x22c]
add edx, 2
mov dword [ebp - 0x230], edx
mov eax, dword [ebp - 0x230]
movzx ecx, word [eax]
test ecx, ecx
je 0x44d2df
mov edx, dword [ebp - 0x230]
movzx eax, word [edx]
cmp eax, 0x20
je 0x44d2df
mov ecx, dword [ebp - 0x230]
movzx edx, word [ecx]
cmp edx, 0x2c
je 0x44d2df
mov eax, dword [ebp - 0x230]
movzx ecx, word [eax]
cmp ecx, 0x3b
je 0x44d2df
mov edx, dword [ebp - 0x230]
movzx eax, word [edx]
cmp eax, 9
je 0x44d2df
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x230], ecx
jmp 0x44d289
mov edx, dword [ebp - 0x230]
mov word [edx], 0
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x440]
push ecx
call fcn.0042a6b1
add esp, 0xc
mov word [ebp - 0x238], 0
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x440]
push ecx
call fcn.0042a3cf
add esp, 4
mov edx, 0x104
sub edx, eax
push edx
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x440]
push ecx
call fcn.0042b6f5
add esp, 0xc
lea edx, [ebp - 0x440]
push edx
mov ecx, dword [ebp - 0x44c]
call fcn.0044cf30
cmp eax, 1
jne 0x44d390
mov eax, dword [ebp + 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x440]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0042a6b1
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov word [ecx + eax*2 - 2], 0
mov dword [ebp - 0xc], 1
jmp 0x44d3dc
mov edx, dword [ebp - 0x230]
sub edx, dword [ebp - 4]
sar edx, 1
mov eax, dword [ebp - 0x228]
shr eax, 1
sub eax, 1
cmp edx, eax
jae 0x44d3d5
mov ecx, dword [ebp - 0x230]
add ecx, 2
mov dword [ebp - 0x22c], ecx
push 0x45d1cc
mov edx, dword [ebp - 0x22c]
push edx
call fcn.004104f0
add esp, 8
mov dword [ebp - 0x22c], eax
jmp 0x44d3d7
jmp 0x44d3dc
jmp 0x44d26d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x44d404
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x448], ecx
mov edx, dword [ebp - 0x448]
push edx
call fcn.0042acac
add esp, 4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042a8b5
mov esp, ebp
pop ebp
ret 0x10