Function at 0x499640
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5fc263
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x72d630]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x72d630]
xor eax, esp
push eax
lea eax, [esp + 0x848]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x858]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x1c], esi
cmp ebp, ebx
je 0x499976
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x499697
sub eax, edx
sar eax, 1
je 0x499976
cmp esi, ebx
je 0x499976
lea eax, [esp + 0x34]
push eax
mov edi, 1
push edi
push ebx
push ebp
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x499976
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x448]
push edx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x34]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], ebx
cmp esi, ebx
jne 0x49971a
cmp dword [esp + 0x38], edi
ja 0x499734
lea edx, [esp + 0x444]
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x499725
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x448]
call fcn.00499c00
push ebx
or edi, 0xffffffff
mov eax, ebp
lea esi, [esp + 0x28]
call fcn.004728e0
mov dword [esp + 0x850], ebx
push ebx
or edi, edi
mov eax, str._shellopencommand
lea esi, [esp + 0x1c]
call fcn.004728e0
mov byte [esp + 0x850], 1
mov ecx, esi
push ecx
lea edi, [esp + 0x28]
call fcn.00472a90
mov byte [esp + 0x850], 0
mov ecx, esi
call fcn.004740c0
lea edx, [esp + 0x30]
push edx
mov edi, 1
push edi
push ebx
lea eax, [esp + 0x30]
call fcn.004221b0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x499813
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x30]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x30], ebx
cmp esi, ebx
jne 0x499813
cmp dword [esp + 0x18], edi
jbe 0x499813
mov esi, dword [esp + 0x1c]
lea edx, [esp + 0x44]
add esi, 0x24
push edx
mov eax, esi
call fcn.00472a30
mov ecx, esi
call fcn.00499f70
jmp 0x49981f
mov edi, dword [esp + 0x1c]
add edi, 0x24
call fcn.00473180
push ebx
or edi, 0xffffffff
mov eax, ebp
lea esi, [esp + 0x1c]
call fcn.004728e0
mov byte [esp + 0x850], 2
push ebx
or edi, edi
mov eax, str.DefaultIcon
lea esi, [esp + 0x18]
call fcn.004728e0
mov byte [esp + 0x850], 3
mov eax, esi
push eax
lea edi, [esp + 0x1c]
call fcn.00472a90
mov byte [esp + 0x850], 2
mov ecx, esi
call fcn.004740c0
lea ecx, [esp + 0x2c]
push ecx
mov edi, 1
push edi
push ebx
lea eax, [esp + 0x24]
call fcn.004221b0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x499aa7
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x44]
push ecx
push ebx
push ebx
push edx
mov dword [esp + 0x54], edi
mov dword [esp + 0x40], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], ebx
cmp esi, ebx
jne 0x499aa7
cmp dword [esp + 0x28], edi
jbe 0x499aa7
cmp word [esp + 0x44], 0x22
jne 0x4999ee
push ebx
or edi, 0xffffffff
lea eax, [esp + 0x48]
lea esi, [esp + 0x18]
call fcn.004728e0
mov bl, 4
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
push ecx
lea edx, [edi + 2]
mov ecx, esi
call fcn.00472de0
mov byte [esp + 0x850], 5
mov edi, esi
call fcn.00472a50
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
call fcn.004740c0
push 0
push 0x22
mov edx, esi
push edx
call fcn.00473070
test eax, eax
jge 0x4999a0
mov byte [esp + 0x850], 2
mov ecx, esi
call fcn.004740c0
mov byte [esp + 0x850], 0
lea ecx, [esp + 0x18]
call fcn.004740c0
mov dword [esp + 0x850], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.004740c0
xor al, al
mov ecx, dword [esp + 0x848]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.005e038a
add esp, 0x840
ret
push eax
lea eax, [esp + 0x24]
push eax
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.00472e50
mov byte [esp + 0x850], 6
mov edi, dword [esp + 0x1c]
add edi, 0x18
call fcn.00472a50
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
call fcn.004740c0
mov byte [esp + 0x850], 2
lea ecx, [esp + 0x14]
call fcn.004740c0
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
jmp 0x499a01
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x44]
lea edi, [ebp + 0x18]
push ecx
mov eax, edi
call fcn.00472a30
mov eax, edi
call fcn.00473170
test al, al
jne 0x499aa2
push ebx
push 0x2c
push edi
call fcn.00473070
mov esi, eax
cmp esi, ebx
jge 0x499a2e
mov ecx, edi
mov dword [ebp + 0x1c], ebx
call fcn.00499f70
jmp 0x499ab6
lea eax, [esp + 0x14]
lea edx, [esi + 1]
push eax
mov ecx, edi
call fcn.00472de0
mov bl, 7
mov byte [esp + 0x850], bl
lea eax, [esp + 0x14]
call fcn.004221b0
push eax
call dword [sym.imp.MSVCR90.dll__wtoi]
add esp, 4
push esi
lea ecx, [esp + 0x24]
push ecx
xor edx, edx
mov ecx, edi
mov dword [ebp + 0x1c], eax
call fcn.00472e50
mov byte [esp + 0x850], 8
call fcn.00472a50
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
call fcn.004740c0
mov byte [esp + 0x850], 2
lea ecx, [esp + 0x14]
call fcn.004740c0
mov ecx, edi
call fcn.00499f70
jmp 0x499ab6
mov dword [ebp + 0x1c], ebx
jmp 0x499ab6
mov esi, dword [esp + 0x1c]
lea edi, [esi + 0x18]
call fcn.00473180
mov dword [esi + 0x1c], ebx
mov byte [esp + 0x850], 0
lea ecx, [esp + 0x18]
call fcn.004740c0
mov dword [esp + 0x850], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.004740c0
mov al, 1
jmp 0x499978