Function at 0x4c0338
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4c0341
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4c06e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.00405e24
lea eax, [ebp - 4]
mov edx, edi
call fcn.00405e68
cmp dword [ebp - 4], 0
je 0x4c039a
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4c039a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.00406324
mov edi, esi
and edi, 0x300
and esi, 0xfffffcff
lea eax, [ebp - 0x18]
push eax
or edi, 0x20019
push edi
push 0
mov eax, dword [ebp - 4]
call fcn.0040627c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c06b4
xor ecx, ecx
push ebp
push 0x4c06ad
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
mov eax, dword [ebp - 0x14]
call fcn.0040627c
mov esi, eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c0696
mov edx, dword [ebp - 0x1c]
test edx, edx
sar edx, 0
mov eax, ebx
call fcn.0040650c
cmp dword [ebx], 0
je 0x4c046e
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx]
call fcn.0040627c
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edx, dword [ebx]
mov eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4c044a
sub eax, 4
mov eax, dword [eax]
mov ecx, dword [ebx]
cmp byte [ecx + eax - 1], 0
jne 0x4c046e
mov eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4c0464
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
mov eax, ebx
call fcn.0040650c
cmp dword [ebx], 0
je 0x4c0696
mov eax, dword [ebx]
cmp byte [eax], 0x40
jne 0x4c0696
lea eax, [ebp - 0x10]
mov edx, 0x2800
call fcn.00406a9c
mov eax, dword [ebp - 0x10]
call fcn.004067c8
add eax, eax
push eax
mov eax, dword [ebp - 0x10]
call fcn.004067b8
xor ecx, ecx
pop edx
call fcn.0040d87c
cmp dword [0x77a5ac], 0
je 0x4c053d
lea eax, [ebp - 0xc]
mov edx, dword [ebx]
call fcn.004067a8
push 0
mov eax, dword [ebp - 0x10]
call fcn.004067c8
push eax
mov eax, dword [ebp - 0x10]
call fcn.004067b8
push eax
mov eax, dword [ebp - 0xc]
call fcn.004067b8
push eax
call dword [0x77a5ac]
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x4c0507
mov eax, dword [ebp - 0x10]
call fcn.004067b8
mov edx, eax
mov eax, ebx
call fcn.00405ff8
jmp 0x4c0533
mov edx, dword [ebx]
mov eax, 0x4c0704
call fcn.004063c8
test eax, eax
jle 0x4c0533
push ebx
mov edx, dword [ebx]
mov eax, 0x4c0704
call fcn.004063c8
mov edx, eax
inc edx
mov eax, dword [ebx]
mov ecx, 0x7fffffff
call fcn.004062e4
call fcn.004057d4
jmp 0x4c06b4
mov edx, dword [ebx]
mov eax, 0x4c0710
call fcn.004063c8
mov esi, eax
test esi, esi
jne 0x4c0553
mov al, 1
jmp 0x4c056a
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4c0564
sub eax, 4
mov eax, dword [eax]
dec eax
cmp esi, eax
setge al
test al, al
je 0x4c0572
mov al, 1
jmp 0x4c057b
mov eax, dword [ebx]
cmp byte [eax + esi], 0x2d
setne al
test al, al
je 0x4c0589
call fcn.004057d4
jmp 0x4c06b4
lea eax, [ebp - 8]
push eax
mov ecx, esi
sub ecx, 2
mov eax, dword [ebx]
mov edx, 2
call fcn.004062e4
lea eax, [ebp - 0x2c]
push eax
lea edx, [esi + 2]
mov eax, dword [ebx]
mov ecx, 0x7fffffff
call fcn.004062e4
mov eax, dword [ebp - 0x2c]
or edx, 0xffffffff
call fcn.00449f28
mov esi, eax
test esi, esi
jge 0x4c05cc
call fcn.004057d4
jmp 0x4c06b4
lea ecx, [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 8]
call fcn.004be5cc
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00449434
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0044ab70
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00449434
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 8]
call fcn.00405e68
mov eax, dword [ebp - 8]
call fcn.0040627c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4c0626
call fcn.004057d4
jmp 0x4c06b4
xor eax, eax
push ebp
push 0x4c068f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.004067c8
push eax
mov eax, dword [ebp - 0x10]
call fcn.004067b8
push eax
push esi
mov eax, dword [ebp - 0x24]
push eax
call sub.user32.dll_LoadStringW
mov eax, dword [ebp - 0x10]
call fcn.004067b8
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00406760
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.004068ec
je 0x4c0678
mov eax, ebx
mov edx, dword [ebp - 0x10]
call fcn.00406074
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c0696
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c06b4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c06f0
lea eax, [ebp - 0x3c]
mov edx, 5
call fcn.00405df4
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040660c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405df4
ret