Function at 0x4b68e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5f067b
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x6656b0]
xor eax, esp
mov dword [esp + 0x43c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6656b0]
xor eax, esp
push eax
lea eax, [esp + 0x454]
mov dword fs:[0], eax
mov eax, dword [esp + 0x464]
mov esi, ecx
mov ebx, 7
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], cx
mov dword [esp + 0x45c], ebp
mov edi, dword [esi + 0x28]
mov dword [esi + 0x34], ebp
cmp edi, ebp
jne 0x4b6980
mov dword [esp + 0x45c], 0xffffffff
cmp dword [esp + 0x3c], 8
jb 0x4b696e
mov edx, dword [esp + 0x28]
push edx
call fcn.004c4802
add esp, 4
xor eax, eax
mov word [esp + 0x28], ax
mov dword [esp + 0x3c], ebx
xor al, al
jmp 0x4b6bb2
push 0x40a
lea ecx, [esp + 0x44]
push ebp
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0x400
call fcn.005bfee0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
push str.IPAddress
push edi
call ebx
cmp eax, ebp
jne 0x4b6a87
mov eax, dword [esp + 0x20]
cmp eax, 7
je 0x4b6a09
push eax
push 0x634440
call fcn.004a7cf0
add esp, 8
mov dword [esp + 0x45c], 0xffffffff
cmp dword [esp + 0x3c], 8
jb 0x4b69fb
mov edx, dword [esp + 0x28]
push edx
call fcn.004c4802
add esp, 4
xor eax, eax
mov word [esp + 0x28], ax
xor al, al
jmp 0x4b6baa
mov eax, dword [esp + 0x1c]
call fcn.004b7460
xor edi, edi
cmp dword [esp + 0x18], ebp
jbe 0x4b6a5c
lea eax, [esp + edi + 0x40]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x4b6a23
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x28]
call fcn.0040f730
cmp dword [esp + 0x38], ebp
je 0x4b6a5c
mov ebx, dword [esp + 0x1c]
mov ecx, esi
push ecx
call fcn.00412ff0
mov edx, dword [esp + 0x38]
lea edi, [edi + edx*2 + 2]
cmp edi, dword [esp + 0x18]
jb 0x4b6a1a
mov dword [esp + 0x45c], 0xffffffff
cmp dword [esp + 0x3c], 8
jb 0x4b6a7b
mov eax, dword [esp + 0x28]
push eax
call fcn.004c4802
add esp, 4
xor ecx, ecx
mov word [esp + 0x28], cx
jmp 0x4b6ba8
cmp eax, 0xea
je 0x4b6a9c
push eax
mov dword [esi + 0x34], eax
push 0x6344f8
jmp 0x4b69d4
mov eax, dword [esp + 0x20]
cmp eax, 7
je 0x4b6ace
push eax
push 0x634440
call fcn.004a7cf0
add esp, 8
mov dword [esp + 0x45c], 0xffffffff
lea esi, [esp + 0x24]
call fcn.0040f810
xor al, al
jmp 0x4b6bb6
mov ecx, dword [esp + 0x18]
add ecx, 0xa
push ecx
call fcn.004c47f7
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x4b6af3
push str.CRegistry::RegQueryValueForMultiString___:
call fcn.004a7cf0
add esp, 4
jmp 0x4b6ab3
mov edx, dword [esp + 0x18]
add edx, 0xa
push edx
push ebp
push edi
call fcn.005bfee0
mov edx, dword [esi + 0x28]
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
push ebp
push str.IPAddress
push edx
call ebx
mov ebx, eax
cmp ebx, ebp
je 0x4b6b39
push edi
call fcn.004c4802
add esp, 4
push ebx
mov dword [esi + 0x34], ebx
push 0x6344f8
jmp 0x4b6aab
mov eax, dword [esp + 0x1c]
call fcn.004b7460
xor esi, esi
cmp dword [esp + 0x18], ebp
jbe 0x4b6b79
lea ecx, [esp + 0x24]
lea eax, [esi + edi]
push ecx
call fcn.0040f7e0
cmp dword [esp + 0x38], ebp
je 0x4b6b79
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
call fcn.00412ff0
mov eax, dword [esp + 0x38]
lea esi, [esi + eax*2 + 2]
cmp esi, dword [esp + 0x18]
jb 0x4b6b4a
push edi
call fcn.004c4802
add esp, 4
mov dword [esp + 0x45c], 0xffffffff
cmp dword [esp + 0x3c], 8
jb 0x4b6ba1
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004c4802
add esp, 4
xor edx, edx
mov word [esp + 0x28], dx
mov al, 1
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebp
mov ecx, dword [esp + 0x454]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.005b7e8e
add esp, 0x44c
ret 4