Function at 0x4b3829
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x4f45b8
push 0x64
call fcn.00481917
add esp, 4
mov dword [ebp - 0xc], eax
push 4
call fcn.00481917
add esp, 4
mov dword [ebp - 0x24], eax
push 0x64
call fcn.00481917
add esp, 4
mov dword [ebp - 8], eax
push 4
call fcn.00481917
add esp, 4
mov dword [ebp - 0x20], eax
push 4
call fcn.00481917
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0
push ebx
push esi
call fcn.004b42e3
add esp, 8
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x4b3ae1
push 0
push 0
push dword [ebp - 0x18]
call fcn.00481ada
add esp, 0xc
push 0x64
push 0
push dword [ebp - 0x20]
call fcn.00481ada
add esp, 0xc
push 0x64
push 0
push dword [ebp - 0x24]
call fcn.00481ada
add esp, 0xc
mov dword [ebp - 4], 0x4f45b8
mov edi, 0x4f45b8
push dword [ebp - 0x20]
call fcn.00481979
add esp, 4
push eax
push dword [ebp - 8]
call fcn.00481979
add esp, 4
push eax
push dword [ebp - 0x18]
call fcn.00481979
add esp, 4
push eax
push 0
push dword [ebp - 0x24]
call fcn.00481979
add esp, 4
push eax
push dword [ebp - 0xc]
call fcn.00481979
add esp, 4
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x28]
call sub.ADVAPI32.DLL_RegEnumValueA
cmp eax, 0x103
je 0x4b3acb
push 0
push dword [ebp - 0x18]
call fcn.00481ac1
add esp, 8
mov dword [ebp - 0x10], eax
push 0x4f45b8
push dword [ebp - 0x14]
call fcn.004710d4
add esp, 8
cmp eax, 0
je 0x4b3961
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, 0
push 0
push dword [ebp - 0x24]
call fcn.00481ac1
add esp, 8
sub eax, 1
mov esi, eax
jmp 0x4b39b4
push ebx
push dword [ebp - 0xc]
call fcn.00481a4b
add esp, 8
cmp eax, 0
jne 0x4b398d
jmp 0x4b39b8
push ebx
push dword [ebp - 0xc]
call fcn.00481a4b
add esp, 8
push eax
call fcn.00470d59
add esp, 4
push eax
push dword [ebp - 4]
call fcn.00471226
add esp, 8
mov dword [ebp - 4], eax
add ebx, 1
cmp ebx, esi
jle 0x4b397a
mov eax, dword [ebp - 0x10]
cmp eax, 1
je 0x4b39d1
cmp eax, 7
je 0x4b39d1
cmp eax, 3
je 0x4b39d1
cmp eax, 4
je 0x4b3a27
jmp 0x4b3a41
mov ebx, 0
push 0
push dword [ebp - 0x20]
call fcn.00481ac1
add esp, 8
sub eax, 1
mov esi, eax
jmp 0x4b3a21
push ebx
push dword [ebp - 8]
call fcn.00481a4b
add esp, 8
cmp eax, 0
jne 0x4b39fd
jmp 0x4b3a25
push ebx
push dword [ebp - 8]
call fcn.00481a4b
add esp, 8
push eax
call fcn.00470d59
add esp, 4
push eax
push edi
call fcn.00471226
add esp, 8
mov edi, eax
add ebx, 1
cmp ebx, esi
jle 0x4b39ea
jmp 0x4b3a41
push 0
push dword [ebp - 8]
call fcn.00481ac1
add esp, 8
push eax
call fcn.00470da5
add esp, 4
mov edi, eax
jmp 0x4b3a41
cmp dword [ebp + 0x14], 0
je 0x4b3aa0
push edi
push 0x4f45c4
push dword [ebp - 4]
push 0x4f45d4
push 0
push dword [ebp - 0x18]
call fcn.00481ac1
add esp, 8
push eax
call fcn.00470da5
add esp, 4
push eax
push dword [ebp - 0x14]
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x4b3ac9
push edi
push 0x4f45c4
push dword [ebp - 4]
push dword [ebp - 0x14]
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x4b3acd
jmp 0x4b3ad6
add dword [ebp - 0x1c], 1
jmp 0x4b389e
push dword [ebp - 0x28]
call fcn.004b435e
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x4b3ae6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret