Function at 0x4b3e6f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x2f4
mov eax, 0x51177b
call fcn.004f41e2
mov ebx, ecx
mov dword [ebp - 0x2cc], ebx
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2e0], edx
test ecx, ecx
je 0x4b3ea6
mov dword [ecx], edx
test eax, eax
je 0x4b3eac
mov dword [eax], edx
push 2
push 0xffff
mov dword [ebp - 0x2bc], edx
call fcn.004e1c42
mov dword [ebp - 0x2d0], eax
pop ecx
pop ecx
test eax, eax
jne 0x4b3ed1
xor al, al
jmp 0x4b4294
push 0x966
push dword [ebx + 4]
xor eax, eax
mov dword [ebp - 0x2d4], eax
call fcn.004211b8
push 0x967
push dword [ebx + 4]
mov edi, eax
call fcn.004211b8
add esp, 0x10
lea ecx, [ebx + 0xc]
mov esi, eax
push ecx
lea ecx, [ebp - 0x300]
call fcn.004e981a
xor eax, eax
push eax
push eax
push 0x14b
push 0x966
push dword [ebx + 4]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor eax, eax
push eax
push eax
push 0x14b
push 0x967
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea eax, [ebp - 0x2bc]
push eax
push 0x20019
xor eax, eax
push eax
push str.Directory_shell
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b41e4
mov dword [ebp - 0x2c8], eax
jmp 0x4b3f6b
xor eax, eax
push 0x248
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.004f5a90
add esp, 0xc
mov dword [ebp - 0x2dc], 0x104
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x2c8]
push dword [ebp - 0x2bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4b41d8
lea ecx, [ebp - 0x258]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2e0]
jne 0x4b3fc1
push str.command
sub ecx, edx
lea eax, [ebp - 0x258]
push 0x124
sar ecx, 1
push eax
mov dword [ebp - 0x2e4], ecx
call fcn.004019cd
lea eax, [ebp - 0x2c4]
xor ecx, ecx
push eax
push 0x20019
push ecx
lea eax, [ebp - 0x258]
mov dword [ebp - 0x2c4], ecx
push eax
push dword [ebp - 0x2bc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b41c0
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2d8], 0x1fffa
push eax
push dword [ebp - 0x2d0]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b41b4
mov eax, dword [ebp - 0x2d8]
xor edx, edx
mov ecx, dword [ebp - 0x2d0]
shr eax, 1
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2c0], ecx
lea ecx, [ebp - 0x2b4]
mov word [ebp + eax*2 - 0x258], dx
xor eax, eax
mov byte [ebp - 0x2b5], al
call fcn.004e25a1
xor eax, eax
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.004e55bb
add esp, 0xc
test eax, eax
jne 0x4b41a4
lea ecx, [ebp - 0x2b4]
call fcn.0044612f
push eax
call fcn.004e487c
pop ecx
test al, al
je 0x4b41a4
jmp 0x4b410b
push str._inside
lea ecx, [ebp - 0x2b4]
call fcn.004e2996
test al, al
jne 0x4b412a
xor eax, eax
lea ecx, [ebp - 0x2b4]
push eax
push eax
push eax
push eax
push eax
push eax
push 0x52f7bc
push 0x52b6a4
push 0x52f7d0
push 0x52b6b0
call fcn.004e29eb
test al, al
jne 0x4b4131
xor eax, eax
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.004e55bb
add esp, 0xc
test eax, eax
je 0x4b40cc
jmp 0x4b4131
mov byte [ebp - 0x2b5], 1
mov cl, byte [ebp - 0x2b5]
mov eax, dword [ebp - 0x2e8]
test cl, cl
cmovne eax, dword [ebp - 0x2ec]
test eax, eax
je 0x4b414c
inc dword [eax]
inc dword [ebp - 0x2d4]
movzx eax, cl
lea ecx, [ebp - 0x258]
push ecx
xor ecx, ecx
xor eax, 1
push ecx
push 0x143
add eax, 0x966
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp byte [ebp - 0x2b5], 0
mov eax, esi
cmovne eax, edi
test eax, eax
jne 0x4b41a4
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.004e230a
cmp byte [ebp - 0x2b5], 0
pop ecx
pop ecx
je 0x4b41a2
mov edi, eax
jmp 0x4b41a4
mov esi, eax
xor eax, eax
lea ecx, [ebp - 0x2b4]
mov byte [ebp - 4], al
call fcn.004e25e0
push dword [ebp - 0x2c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp eax, 0x200
jb 0x4b3f69
push dword [ebp - 0x2bc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x514870
test edi, edi
mov eax, ebx
cmovne eax, edi
push eax
mov eax, dword [ebp - 0x2cc]
push 0x966
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
test edi, edi
je 0x4b4227
xor eax, eax
cmp word [edi], ax
je 0x4b4227
mov eax, dword [ebp - 0x2cc]
push edi
push 0x966
push dword [eax + 4]
call fcn.004aa35f
add esp, 0xc
test esi, esi
cmovne ebx, esi
push ebx
mov ebx, dword [ebp - 0x2cc]
push 0x967
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
test esi, esi
je 0x4b425d
xor eax, eax
cmp word [esi], ax
je 0x4b425d
push esi
push 0x967
push dword [ebx + 4]
call fcn.004aa35f
add esp, 0xc
test edi, edi
je 0x4b4268
push edi
call fcn.004e1bea
pop ecx
test esi, esi
je 0x4b4273
push esi
call fcn.004e1bea
pop ecx
push dword [ebp - 0x2d0]
call fcn.004e1bea
pop ecx
lea ecx, [ebp - 0x300]
call fcn.004e983b
cmp dword [ebp - 0x2d4], 0
setg al
call fcn.004f418c
ret 8