Function at 0x49c8c6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c0
xor eax, eax
mov dword [ebp - 0x3c], eax
lea edx, [ebp - 4]
push edx
push 9
push 0
push 0x768669
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x49c8fc
xor eax, eax
jmp 0x49ccc7
xor edx, edx
mov dword [ebp - 0x14], edx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x49ccbc
mov dword [ebp - 0x2c], 0x400
push 0x400
push 0
lea edx, [ebp - 0x440]
push edx
call fcn.0066c86c
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x440]
push eax
mov edx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
push edx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49ccb1
lea eax, [ebp - 0x440]
push eax
call fcn.0049c83c
pop ecx
mov byte [ebp - 0x3d], al
lea edx, [ebp - 0xc]
push edx
push 1
push 0
lea ecx, [ebp - 0x440]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x49c906
mov dword [ebp - 0x2c], 0x400
mov dword [ebp - 0x30], 1
push 0x400
push 0
lea edx, [ebp - 0x840]
push edx
call fcn.0066c86c
add esp, 0xc
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x840]
push eax
lea edx, [ebp - 0x30]
push edx
push 0
push 0x768681
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x49cca9
push dword [ebp + 8]
lea eax, [ebp - 0x840]
push eax
call fcn.0066cbe8
add esp, 8
test eax, eax
jne 0x49cca9
mov byte [ebp - 0x3e], 0
lea edx, [ebp - 8]
push edx
push 9
push 0
push 0x768688
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x49c906
xor eax, eax
mov dword [ebp - 0x18], eax
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], 0x400
push 0x400
push 0
lea ecx, [ebp - 0x440]
push ecx
call fcn.0066c86c
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x440]
push edx
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x49cc96
push 0xa
push 0x768693
lea edx, [ebp - 0x440]
push edx
call fcn.0066cc80
add esp, 0xc
test eax, eax
jne 0x49cc96
lea ecx, [ebp - 0x440]
push ecx
call fcn.0049c83c
pop ecx
mov byte [ebp - 0x3f], al
mov byte [ebp - 0x40], 0
lea eax, [ebp - 0x440]
push eax
push 0x76869e
lea edx, [ebp - 0x840]
push edx
call fcn.00670e94
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
lea eax, [ebp - 0x840]
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
test edx, edx
jne 0x49cc96
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], 0x400
mov dword [ebp - 0x30], 1
push 0x400
push 0
lea eax, [ebp - 0x840]
push eax
call fcn.0066c86c
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x840]
push ecx
lea eax, [ebp - 0x30]
push eax
push 0
push 0x7686b3
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
test edx, edx
jne 0x49cb59
push 0x7686be
lea ecx, [ebp - 0x840]
push ecx
call fcn.0066cbe8
add esp, 8
test eax, eax
jne 0x49cb59
inc dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x400
mov dword [ebp - 0x30], 1
push 0x400
push 0
lea eax, [ebp - 0x840]
push eax
call fcn.0066c86c
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x840]
push ecx
lea eax, [ebp - 0x30]
push eax
push 0
push 0x7686ce
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
test edx, edx
jne 0x49cbc0
push 0x7686d3
lea ecx, [ebp - 0x840]
push ecx
call fcn.0066cbe8
add esp, 8
test eax, eax
jne 0x49cbc0
inc dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0x400
mov dword [ebp - 0x30], 1
push 0x400
push 0
lea eax, [ebp - 0x840]
push eax
call fcn.0066c86c
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x840]
push ecx
lea eax, [ebp - 0x30]
push eax
push 0
push 0x7686e3
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
test edx, edx
jne 0x49cc29
push 5
push 0x7686ee
lea ecx, [ebp - 0x840]
push ecx
call fcn.0066cc80
add esp, 0xc
test eax, eax
jne 0x49cc29
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
dec eax
jl 0x49cc8e
lea edx, [ebp - 0x436]
push edx
call fcn.006749dc
pop ecx
imul ecx, dword [ebp - 0x3c], 0x23
mov dword [ecx*8 + 0xbbcd7c], eax
imul eax, dword [ebp - 0x3c], 0x23
mov dl, byte [ebp - 0x3d]
mov byte [eax*8 + 0xbbce86], dl
imul ecx, dword [ebp - 0x3c], 0x23
mov al, byte [ebp - 0x3e]
mov byte [ecx*8 + 0xbbce87], al
imul edx, dword [ebp - 0x3c], 0x23
mov cl, byte [ebp - 0x3f]
mov byte [edx*8 + 0xbbce88], cl
imul eax, dword [ebp - 0x3c], 0x23
mov dl, byte [ebp - 0x40]
mov byte [eax*8 + 0xbbce89], dl
imul ecx, dword [ebp - 0x3c], 0x23
mov byte [ecx*8 + 0xbbcd81], 0
inc dword [ebp - 0x3c]
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x49ca2e
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x49c911
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x3c]
mov esp, ebp
pop ebp
ret