Function at 0x496440
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x60c]
mov dword [ebp - 0x628], ecx
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x60c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49679b
mov edi, dword [ebp - 0x60c]
test edi, edi
je 0x49679b
push ebx
push esi
push 0x100
xor ebx, ebx
lea eax, [ebp - 0x104]
push ebx
push eax
xor esi, esi
call fcn.004a73c0
add esp, 0xc
mov dword [ebp - 0x608], 0x100
lea eax, [ebp - 0x608]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call edi
cmp eax, 0x103
je 0x49677c
test eax, eax
lea ecx, [ebx + 1]
push 0x100
cmovne ecx, ebx
lea eax, [ebp - 0x104]
push 0
push eax
mov ebx, ecx
inc esi
call fcn.004a73c0
add esp, 0xc
mov dword [ebp - 0x608], 0x100
lea eax, [ebp - 0x608]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x60c]
call edi
cmp eax, 0x103
jne 0x4964e4
test ebx, ebx
jle 0x49677c
imul eax, ebx, 0x274
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
mov dword [ebp - 0x624], esi
test esi, esi
je 0x49677c
xor eax, eax
xor edi, edi
push 0x100
mov dword [ebp - 0x614], eax
lea eax, [ebp - 0x104]
push edi
push eax
mov dword [ebp - 0x61c], edi
call fcn.004a73c0
add esp, 0xc
mov dword [ebp - 0x608], 0x100
lea eax, [ebp - 0x608]
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push edi
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x496733
mov dword [ebp - 0x620], esi
nop dword [eax + eax]
inc dword [ebp - 0x614]
test eax, eax
jne 0x4966d9
push 0x100
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004a73c0
lea eax, [ebp - 0x104]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push 0x4fbfd0
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.0046c0d0
add esp, 0x20
mov dword [ebp - 0x610], 0
lea eax, [ebp - 0x610]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x204]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4966d9
mov esi, dword [ebp - 0x610]
test esi, esi
je 0x4966d9
push 0x400
push eax
mov dword [ebp - 0x618], eax
lea eax, [ebp - 0x604]
push eax
call fcn.004a73c0
add esp, 0xc
mov dword [ebp - 0x608], 0x400
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x618]
push eax
push 0
push str.PackedCatalogItem
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x610]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4966d9
cmp dword [ebp - 0x618], 3
jne 0x4966d9
cmp edi, ebx
jge 0x4966d9
mov eax, dword [ebp - 0x620]
lea esi, [ebp - 0x500]
mov edi, eax
mov ecx, 0x9d
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x61c]
inc edi
add eax, 0x274
mov dword [ebp - 0x61c], edi
mov dword [ebp - 0x620], eax
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.004a73c0
add esp, 0xc
mov dword [ebp - 0x608], 0x100
lea eax, [ebp - 0x608]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x614]
push eax
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x4965c0
mov esi, dword [ebp - 0x624]
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jg 0x49675d
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x628]
test eax, eax
je 0x496769
mov dword [eax], edi
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a474b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004a474b
mov esp, ebp
pop ebp
ret