Function at 0x4505d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x4ef]
mov dword [ebp - 0x510], 0
push 0
push eax
mov ebx, ecx
mov dword [ebp - 0x508], 0
mov dword [ebp - 0x504], 0
mov byte [ebp - 0x4f0], 0
call fcn.004644a0
push 0x104
lea eax, [ebp - 0x3e7]
mov byte [ebp - 0x3e8], 0
push 0
push eax
call fcn.004644a0
push 0x104
lea eax, [ebp - 0x2df]
mov byte [ebp - 0x2e0], 0
push 0
push eax
call fcn.004644a0
push 0x104
lea eax, [ebp - 0x1d7]
mov byte [ebp - 0x1d8], 0
push 0
push eax
call fcn.004644a0
push 0x2f
xorps xmm0, xmm0
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0xcf]
mov dword [ebp - 0xb], 0
push 0
push eax
movdqu xmmword [ebp - 0x1b], xmm0
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
movdqu xmmword [ebp - 0xa0], xmm0
mov byte [ebp - 0xd0], 0
call fcn.004644a0
xorps xmm0, xmm0
mov byte [ebp - 0x90], 0
add esp, 0x3c
movq qword [ebp - 0x7f], xmm0
mov edx, 0x49e6d4
mov dword [ebp - 0x77], 0
lea ecx, [ebp - 0x3e8]
mov dword [ebp - 0x73], 0
movdqu xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x57], 0
movdqu xmmword [ebp - 0x8f], xmm0
mov dword [ebp - 0x53], 0
movdqu xmmword [ebp - 0x6f], xmm0
mov dword [ebp - 0x37], 0
movq qword [ebp - 0x5f], xmm0
movdqu xmmword [ebp - 0x4f], xmm0
mov word [ebp - 0x33], 0
movq qword [ebp - 0x3f], xmm0
mov byte [ebp - 0x31], 0
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x4f8], 0
mov dword [ebp - 0x500], 0
mov dword [ebp - 0x50c], 0
mov dword [ebp - 0x4f4], 0
call fcn.00447390
mov edx, 0x49e6fc
lea ecx, [ebp - 0x1c]
call fcn.00447390
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x510]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x3e8]
push eax
push 0x80000001
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x450b16
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x4f0]
mov dword [ebp - 0x4fc], 0x105
push eax
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x510]
call esi
test eax, eax
jne 0x450b10
mov edx, 0x49e70c
lea ecx, [ebp - 0xa0]
call fcn.00447390
mov edx, str.xCGY_D__vPE
lea ecx, [ebp - 0xd0]
call fcn.00447390
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0xa0]
push eax
push str._s_s_s
lea eax, [ebp - 0x2e0]
push 0x105
push eax
call fcn.0046158b
add esp, 0x18
lea eax, [ebp - 0x508]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x2e0]
push eax
push dword [ebp - 0x510]
call edi
test eax, eax
jne 0x450b10
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x4f8]
push eax
push 0
push 0
push 0
push dword [ebp - 0x508]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x450b10
cmp dword [ebp - 0x4f8], eax
jbe 0x450b10
mov edx, 0x49e748
lea ecx, [ebp - 0x2c]
call fcn.00447390
mov edx, str._b1_I3a_a
lea ecx, [ebp - 0x90]
call fcn.00447390
mov edx, 0x49e760
lea ecx, [ebp - 0x70]
call fcn.00447390
mov edx, 0x49e770
lea ecx, [ebp - 0x50]
call fcn.00447390
xor edi, edi
mov dword [ebp - 0x52c], edi
cmp dword [ebp - 0x4f8], edi
jbe 0x450b10
push 0x105
lea eax, [ebp - 0x1d8]
mov dword [ebp - 0x500], 0x105
push 0
push eax
call fcn.004644a0
add esp, 0xc
lea eax, [ebp - 0x500]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x1d8]
push eax
push edi
push dword [ebp - 0x508]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x450b10
lea eax, [ebp - 0x504]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x1d8]
push eax
push dword [ebp - 0x508]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x450b10
push eax
push eax
lea eax, [ebp - 0x50c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x504]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x450b10
push dword [ebp - 0x50c]
call fcn.0046243d
mov edi, eax
add esp, 4
test edi, edi
je 0x450b10
mov ecx, dword [ebp - 0x50c]
push ecx
push 0
push edi
mov dword [ebp - 0x4f4], ecx
call fcn.004644a0
add esp, 0xc
lea eax, [ebp - 0x4f4]
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x504]
call esi
test eax, eax
je 0x4509b8
push edi
call fcn.004624b3
add esp, 4
push dword [ebp - 0x504]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x450af7
lea eax, [ebp - 0x2c]
push eax
push str.____s_:
push ebx
call fcn.00447150
push edi
push str._ws_r_n
push ebx
call fcn.00447150
add esp, 0x18
mov dword [ebp - 0x528], 3
lea esi, [ebp - 0x90]
mov eax, dword [ebp - 0x50c]
push eax
push 0
push edi
mov dword [ebp - 0x4f4], eax
call fcn.004644a0
add esp, 0xc
lea eax, [ebp - 0x4f4]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x504]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x450ab7
mov ecx, dword [ebp - 0x4f4]
cmp ecx, 2
jb 0x450ab7
lea eax, [edi + 1]
mov dword [ebp - 0x51c], eax
lea eax, [ecx - 1]
mov dword [ebp - 0x520], eax
lea eax, [ebp - 0x518]
push eax
push 1
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x520]
push eax
mov eax, dword [ebx + 0x41c]
call eax
test eax, eax
je 0x450ab7
mov edx, dword [ebp - 0x514]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0x524], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450a75
sub eax, dword [ebp - 0x524]
sar eax, 1
je 0x450ab0
push esi
push str.____s_:
push ebx
call fcn.00447150
push dword [ebp - 0x514]
push str._ws_r_n
push ebx
call fcn.00447150
mov edx, dword [ebp - 0x514]
add esp, 0x18
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
add esi, 0x20
dec dword [ebp - 0x528]
jne 0x4509e6
push 0x49d700
mov ecx, ebx
call fcn.00447190
push edi
call fcn.004624b3
add esp, 4
push dword [ebp - 0x504]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
and dword [ebp - 0x504], eax
mov edi, dword [ebp - 0x52c]
inc edi
mov dword [ebp - 0x52c], edi
cmp edi, dword [ebp - 0x4f8]
jb 0x4508b1
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x504]
test eax, eax
je 0x450b23
push eax
call esi
mov eax, dword [ebp - 0x508]
test eax, eax
je 0x450b30
push eax
call esi
mov eax, dword [ebp - 0x510]
test eax, eax
je 0x450b3d
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046125f
mov esp, ebp
pop ebp
ret