Function at 0x4bb958
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x3c
mov eax, 0x4c9e3f
call fcn.004c5434
mov ebx, edx
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x30]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov word [ebp - 0x30], ax
mov edi, 0x101
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
mov eax, esi
mov byte [ebp - 4], 2
sub eax, ecx
je 0x4bba2e
sub eax, 1
je 0x4bba29
sub eax, 1
je 0x4bba2e
mov edi, dword [0x4f5664]
test edi, edi
je 0x4bb9d3
push esi
push 0x47253c
cmp dword [0x4f5660], ecx
jne 0x4bba22
mov ecx, edi
call dword [0x4f6d6c]
call edi
pop ecx
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov edx, ebx
call fcn.004ba6a6
cmp dword [ebp - 0x14], 0
je 0x4bb9ef
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
mov esi, 0x40af50
cmp dword [ebp - 0x38], eax
je 0x4bba07
push esi
push dword [ebp - 0x38]
call fcn.004c51f0
pop ecx
pop ecx
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x48], eax
je 0x4bba1a
push esi
push dword [ebp - 0x48]
call fcn.004c51f0
pop ecx
pop ecx
call fcn.004c5402
ret 8
call fcn.004ba6fd
jmp 0x4bb9d1
mov edi, 0x109
mov edx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004bec6c
test eax, eax
js 0x4bb9d3
push dword [ebp - 0x48]
lea eax, [ebp - 0x38]
push dword [esi*4 + 0x406eac]
push 0x4725d8
push eax
call fcn.004becc9
add esp, 0x10
test eax, eax
js 0x4bb9d3
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x14], 0
test eax, eax
je 0x4bba73
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push edi
xor edi, edi
push edi
push dword [ebp - 0x38]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4bbadd
cmp dword [0x4f5664], edi
je 0x4bb9d3
mov esi, dword [ebp - 0x38]
cmp dword [0x4f5660], edi
jne 0x4bbac9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x472580
mov esi, dword [0x4f5664]
mov ecx, esi
call dword [0x4f6d6c]
call esi
add esp, 0xc
jmp 0x4bb9d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x472580
call fcn.004ba6fd
jmp 0x4bbac1
cmp esi, 1
jne 0x4bbbb4
push ecx
push 0xff
lea ecx, [ebp - 0x48]
call fcn.004addc3
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x48]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4bbb53
cmp dword [0x4f5664], edi
je 0x4bb9d3
mov esi, dword [ebp - 0x38]
cmp dword [0x4f5660], edi
jne 0x4bbb44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x472668
jmp 0x4bbab1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x472668
jmp 0x4bbad6
push 1
push 0x40af9c
lea ecx, [ebp - 0x38]
call fcn.004adbfb
test al, al
je 0x4bb9d3
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x38]
sub eax, dword [ebp - 0x48]
sar eax, 1
push eax
push dword [ebp - 0x48]
call fcn.004adbfb
test al, al
je 0x4bb9d3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
test eax, eax
je 0x4bbb97
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 1
push edi
push dword [ebp - 0x38]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4bba8d
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x48]
mov word [eax], dx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
call fcn.004bedc1
test eax, eax
jns 0x4bbc12
cmp dword [0x4f5664], edi
je 0x4bb9d3
mov esi, dword [ebp - 0x38]
cmp dword [0x4f5660], edi
jne 0x4bbc00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x4725e8
jmp 0x4bbab1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x4725e8
jmp 0x4bbad6
push dword [ebp - 0x48]
mov ecx, dword [ebp - 0x18]
mov edx, ebx
call fcn.004b5440
jmp 0x4bb9e0