Function at 0x4f6e6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff3c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4f7260
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x4f7278
call fcn.00404858
push 0x4f7290
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4f7227
xor edx, edx
push ebp
push 0x4f7220
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4f72a0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov edi, esi
test esi, esi
je 0x4f7209
lea eax, [ebp - 0xb4]
xor ecx, ecx
mov edx, 0x9c
call fcn.004031c4
mov dword [ebp - 0xb4], 0x9c
lea eax, [ebp - 0xb4]
push eax
call edi
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4f6f52
lea eax, [ebp - 0xb4]
xor ecx, ecx
mov edx, 0x94
call fcn.004031c4
mov dword [ebp - 0xb4], 0x94
lea eax, [ebp - 0xb4]
push eax
call edi
test eax, eax
jne 0x4f6f52
call fcn.0040e100
mov eax, dword [ebp - 0xa4]
sub eax, 1
jb 0x4f71fc
je 0x4f716d
dec eax
jne 0x4f7209
cmp dword [ebp - 0xb0], 4
ja 0x4f6f86
lea eax, [ebp - 0xc]
mov edx, 0x4f72b8
call fcn.00404858
jmp 0x4f6ff1
cmp dword [ebp - 0xb0], 5
jne 0x4f6fa7
cmp dword [ebp - 0xac], 0
jne 0x4f6fa7
lea eax, [ebp - 0xc]
mov edx, 0x4f72d8
call fcn.00404858
jmp 0x4f6ff1
cmp dword [ebp - 0xb0], 5
jne 0x4f6fc8
cmp dword [ebp - 0xac], 1
jne 0x4f6fc8
lea eax, [ebp - 0xc]
mov edx, 0x4f72f8
call fcn.00404858
jmp 0x4f6ff1
cmp dword [ebp - 0xb0], 5
jne 0x4f6ff1
cmp dword [ebp - 0xac], 2
jne 0x4f6ff1
lea eax, [ebp - 0xc]
mov edx, 0x4f7318
call fcn.00404858
call fcn.004041e8
jmp 0x4f7232
test bl, bl
je 0x4f708c
mov al, byte [ebp - 0x1a]
cmp al, 1
jne 0x4f7032
mov ax, word [ebp - 0x1c]
and ax, 0x200
cmp ax, 0x200
jne 0x4f7020
lea eax, [ebp - 0xc]
mov edx, 0x4f7338
call fcn.00404a88
jmp 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f734c
call fcn.00404a88
jmp 0x4f7209
cmp al, 3
jne 0x4f7209
mov ax, word [ebp - 0x1c]
mov edx, eax
and dx, 0x80
cmp dx, 0x80
jne 0x4f705e
lea eax, [ebp - 0xc]
mov edx, 0x4f7364
call fcn.00404a88
jmp 0x4f7209
and ax, 2
cmp ax, 2
jne 0x4f707a
lea eax, [ebp - 0xc]
mov edx, 0x4f7380
call fcn.00404a88
jmp 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f739c
call fcn.00404a88
jmp 0x4f7209
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4f73a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x18], 0x14
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404e0c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0x4f73d4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.00404e0c
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
call fcn.00408dc4
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408b74
mov eax, dword [ebp - 0xb8]
mov edx, 0x4f73e8
call fcn.00404bcc
jne 0x4f7126
lea eax, [ebp - 0xc]
mov edx, 0x4f73f8
call fcn.00404a88
jmp 0x4f7209
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x14]
call fcn.00408dc4
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00408b74
mov eax, dword [ebp - 0xc0]
mov edx, 0x4f7410
call fcn.00404bcc
jne 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f739c
call fcn.00404a88
jmp 0x4f7209
cmp dword [ebp - 0xb0], 4
jne 0x4f71a4
cmp dword [ebp - 0xac], 0
jne 0x4f71a4
lea eax, [ebp - 0xc]
mov edx, 0x4f7424
call fcn.00404858
cmp byte [ebp - 0x9f], 0x43
jne 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f7444
call fcn.00404a88
jmp 0x4f7209
cmp dword [ebp - 0xb0], 4
jne 0x4f71db
cmp dword [ebp - 0xac], 0xa
jne 0x4f71db
lea eax, [ebp - 0xc]
mov edx, 0x4f7454
call fcn.00404858
cmp byte [ebp - 0x9f], 0x41
jne 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f7474
call fcn.00404a88
jmp 0x4f7209
cmp dword [ebp - 0xb0], 4
jne 0x4f7209
cmp dword [ebp - 0xac], 0x5a
jne 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f7480
call fcn.00404858
jmp 0x4f7209
lea eax, [ebp - 0xc]
mov edx, 0x4f74a0
call fcn.00404858
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7227
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f7267
lea eax, [ebp - 0xc4]
mov edx, 4
call fcn.004047e4
lea eax, [ebp - 0x14]
call fcn.004047c0
lea eax, [ebp - 0xc]
call fcn.004047c0
ret