Function at 0x4c9fa4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x43
push 0
push 0
dec ecx
jne 0x4c9fac
lea eax, [ebp - 0x1e0]
mov edx, dword [0x407be0]
call fcn.00404e40
xor eax, eax
push ebp
push 0x4ca835
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ca68c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x537b44], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x537b4c]
call fcn.004042c0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jne 0x4c9ff1
mov dword [0x537b48], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4ca840
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ca0cb
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x4ca0c2
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4ca0c2
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040491c
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404790
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040491c
push ebp
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.004c9ac8
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4ca06f
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4ca860
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4ca1bc
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x4ca1bc
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4ca1bc
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040491c
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404790
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404790
mov edx, 0x4ca870
mov ecx, 4
call fcn.00408b60
test eax, eax
je 0x4ca199
mov eax, dword [ebp - 0xc]
call fcn.00404790
mov edx, 0x4ca878
mov ecx, 4
call fcn.00408b60
test eax, eax
jne 0x4ca1b0
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.0040491c
push ebp
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004c9ac8
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4ca12f
cmp dword [0x537b44], 0
jle 0x4ca1cc
push ebp
call fcn.004c9d04
pop ecx
cmp dword [0x537b14], 0
jne 0x4ca234
mov dword [ebp - 8], 0x64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4ca880
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ca234
lea eax, [ebp - 0x1e8]
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.00404540
mov eax, dword [ebp - 0x1e8]
lea edx, [ebp - 0x1e4]
call fcn.00408bb4
mov edx, dword [ebp - 0x1e4]
mov eax, 0x537b14
call fcn.00404314
cmp dword [0x537b14], 0
je 0x4ca2c2
lea edx, [ebp - 0x1ec]
mov eax, dword [0x537b14]
call fcn.00409770
mov edx, dword [ebp - 0x1ec]
mov eax, 0x537b3c
call fcn.00404314
lea eax, [ebp - 0x1f4]
push eax
mov eax, dword [0x537b3c]
call fcn.00404590
mov edx, eax
sub edx, 3
mov ecx, 4
mov eax, dword [0x537b3c]
call fcn.004047f0
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.00408a30
mov eax, dword [ebp - 0x1f0]
mov edx, 0x4ca890
call fcn.004046dc
jne 0x4ca2c2
mov eax, dword [0x537b3c]
call fcn.00404590
mov edx, eax
sub edx, 4
mov eax, 0x537b3c
call fcn.0040491c
cmp dword [0x537b14], 0
jne 0x4ca62a
cmp dword [0x537b40], 0
jne 0x4ca380
cmp dword [0x537b44], 0
jle 0x4ca307
cmp dword [0x537b48], 0xffffffff
je 0x4ca307
mov eax, 0x537b3c
mov edx, dword [0x537b48]
mov edx, dword [edx*4 + 0x537b4c]
call fcn.00404314
jmp 0x4ca311
mov eax, 0x537b3c
call fcn.004042c0
cmp dword [0x537b3c], 0
jne 0x4ca362
mov dword [ebp - 8], 0x64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4ca898
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ca362
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x86], 0
mov eax, 0x537b3c
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.00404540
cmp dword [0x537b3c], 0
jne 0x4ca3fc
mov eax, 0x537b14
mov edx, 0x4ca8ac
call fcn.00404314
jmp 0x4ca3fc
mov eax, dword [0x537b44]
dec eax
test eax, eax
jl 0x4ca3d7
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [0x537b40]
call fcn.00404790
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x537b9c]
call fcn.00404790
pop edx
call fcn.00408b20
test eax, eax
jne 0x4ca3cf
mov eax, 0x537b3c
mov edx, dword [ebp - 0x14]
mov edx, dword [edx*4 + 0x537b4c]
call fcn.00404314
jmp 0x4ca3d7
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4ca395
cmp dword [0x537b3c], 0
jne 0x4ca3fc
mov eax, 0x537b14
mov ecx, dword [0x537b40]
mov edx, 0x4ca8bc
call fcn.004045dc
push ebp
call fcn.004c9f0c
pop ecx
cmp dword [0x537b3c], 0
je 0x4ca62a
lea eax, [ebp - 0x10]
call fcn.004042c0
mov eax, dword [0x537b3c]
call fcn.00404590
mov edx, dword [0x537b3c]
cmp byte [edx + eax - 1], 0x5c
jne 0x4ca43f
mov eax, dword [0x537b3c]
call fcn.00404590
mov edx, eax
dec edx
mov eax, 0x537b3c
call fcn.0040491c
push dword [0x537b3c]
push 0x4ca8c8
push 0x4ca8ac
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.00404650
mov eax, dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.00409598
test eax, eax
jne 0x4ca4a8
push dword [0x537b3c]
push 0x4ca8c8
push 0x4ca8ac
mov eax, 0x537b14
mov edx, 3
call fcn.00404650
lea eax, [ebp - 0x1e0]
call fcn.0040960c
jmp 0x4ca5e1
push dword [0x537b3c]
push 0x4ca8d8
push 0x4ca8ac
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.00404650
mov eax, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.00409598
test eax, eax
jne 0x4ca511
push dword [0x537b3c]
push 0x4ca8d8
push 0x4ca8ac
mov eax, 0x537b14
mov edx, 3
call fcn.00404650
lea eax, [ebp - 0x1e0]
call fcn.0040960c
jmp 0x4ca5e1
push dword [0x537b3c]
push 0x4ca8c8
push 0x4ca8e4
lea eax, [ebp - 0x200]
mov edx, 3
call fcn.00404650
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.00409598
test eax, eax
jne 0x4ca5e1
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x204]
xor edx, edx
mov eax, dword [ebp - 0x1d4]
call fcn.004096a8
mov eax, dword [ebp - 0x204]
mov ecx, 6
mov edx, 4
call fcn.004047f0
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x30
jb 0x4ca5c3
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x39
ja 0x4ca5c3
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004046dc
jbe 0x4ca5c3
push dword [0x537b3c]
push 0x4ca8c8
push dword [ebp - 0x1d4]
mov eax, 0x537b14
mov edx, 3
call fcn.00404650
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404358
lea eax, [ebp - 0x1e0]
call fcn.004095e8
test eax, eax
je 0x4ca54f
lea eax, [ebp - 0x1e0]
call fcn.0040960c
cmp dword [0x537b14], 0
jne 0x4ca62a
cmp dword [0x537b40], 0
jne 0x4ca604
mov eax, 0x537b14
mov edx, 0x4ca8ac
call fcn.00404314
jmp 0x4ca62a
push dword [0x537b3c]
push 0x4ca8c8
push 0x4ca8f8
mov eax, 0x537b14
mov edx, 3
call fcn.00404650
push ebp
call fcn.004c9f0c
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4ca8fc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4ca664
mov edx, 0x4ca904
lea eax, [ebp - 0x85]
mov ecx, 3
call fcn.004099ec
test eax, eax
je 0x4ca668
xor eax, eax
jmp 0x4ca66a
mov al, 1
mov byte [0x537b38], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca693
cmp dword [ebp - 4], 0
je 0x4ca68b
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret