Function at 0x4bfb40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x55b203
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x660038]
xor eax, esp
mov dword [esp + 0x830], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x660038]
xor eax, esp
push eax
lea eax, [esp + 0x848]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x858]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x1c], esi
cmp ebp, ebx
je 0x4bfe76
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4bfb97
sub eax, edx
sar eax, 1
je 0x4bfe76
cmp esi, ebx
je 0x4bfe76
lea eax, [esp + 0x34]
push eax
mov edi, 1
push edi
push ebx
push ebp
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4bfe76
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x448]
push edx
lea eax, [esp + 0x48]
push eax
push ebx
push ebx
push ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x50], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x34]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x34], ebx
cmp esi, ebx
jne 0x4bfc1a
cmp dword [esp + 0x38], edi
ja 0x4bfc34
lea edx, [esp + 0x444]
mov eax, ebp
sub edx, ebp
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4bfc25
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x448]
call fcn.004c0100
push ebx
or edi, 0xffffffff
mov eax, ebp
lea esi, [esp + 0x28]
call fcn.00494ae0
mov dword [esp + 0x850], ebx
push ebx
or edi, edi
mov eax, str._shellopencommand
lea esi, [esp + 0x1c]
call fcn.00494ae0
mov byte [esp + 0x850], 1
mov ecx, esi
push ecx
lea edi, [esp + 0x28]
call fcn.00494c90
mov byte [esp + 0x850], 0
mov ecx, esi
call fcn.00494b70
lea edx, [esp + 0x30]
push edx
mov edi, 1
push edi
push ebx
lea eax, [esp + 0x30]
call fcn.00407eb0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4bfd13
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x30], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x30]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x30], ebx
cmp esi, ebx
jne 0x4bfd13
cmp dword [esp + 0x18], edi
jbe 0x4bfd13
mov esi, dword [esp + 0x1c]
lea edx, [esp + 0x44]
add esi, 0x24
push edx
mov eax, esi
call fcn.00494c30
mov ecx, esi
call fcn.004c0470
jmp 0x4bfd1f
mov edi, dword [esp + 0x1c]
add edi, 0x24
call fcn.00495360
push ebx
or edi, 0xffffffff
mov eax, ebp
lea esi, [esp + 0x1c]
call fcn.00494ae0
mov byte [esp + 0x850], 2
push ebx
or edi, edi
mov eax, str.DefaultIcon
lea esi, [esp + 0x18]
call fcn.00494ae0
mov byte [esp + 0x850], 3
mov eax, esi
push eax
lea edi, [esp + 0x1c]
call fcn.00494c90
mov byte [esp + 0x850], 2
mov ecx, esi
call fcn.00494b70
lea ecx, [esp + 0x2c]
push ecx
mov edi, 1
push edi
push ebx
lea eax, [esp + 0x24]
call fcn.00407eb0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4bffa7
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x44]
push ecx
push ebx
push ebx
push edx
mov dword [esp + 0x54], edi
mov dword [esp + 0x40], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x2c], ebx
cmp esi, ebx
jne 0x4bffa7
cmp dword [esp + 0x28], edi
jbe 0x4bffa7
cmp word [esp + 0x44], 0x22
jne 0x4bfeee
push ebx
or edi, 0xffffffff
lea eax, [esp + 0x48]
lea esi, [esp + 0x18]
call fcn.00494ae0
mov bl, 4
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
push ecx
lea edx, [edi + 2]
mov ecx, esi
call fcn.00494fc0
mov byte [esp + 0x850], 5
mov edi, esi
call fcn.00494c50
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
call fcn.00494b70
push 0
push 0x22
mov edx, esi
push edx
call fcn.00495250
test eax, eax
jge 0x4bfea0
mov byte [esp + 0x850], 2
mov ecx, esi
call fcn.00494b70
mov byte [esp + 0x850], 0
lea ecx, [esp + 0x18]
call fcn.00494b70
mov dword [esp + 0x850], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00494b70
xor al, al
mov ecx, dword [esp + 0x848]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x830]
xor ecx, esp
call fcn.0054904e
add esp, 0x840
ret
push eax
lea eax, [esp + 0x24]
push eax
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.00495030
mov byte [esp + 0x850], 6
mov edi, dword [esp + 0x1c]
add edi, 0x18
call fcn.00494c50
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
call fcn.00494b70
mov byte [esp + 0x850], 2
lea ecx, [esp + 0x14]
call fcn.00494b70
mov ebp, dword [esp + 0x1c]
xor ebx, ebx
jmp 0x4bff01
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x44]
lea edi, [ebp + 0x18]
push ecx
mov eax, edi
call fcn.00494c30
mov eax, edi
call fcn.00495350
test al, al
jne 0x4bffa2
push ebx
push 0x2c
push edi
call fcn.00495250
mov esi, eax
cmp esi, ebx
jge 0x4bff2e
mov ecx, edi
mov dword [ebp + 0x1c], ebx
call fcn.004c0470
jmp 0x4bffb6
lea eax, [esp + 0x14]
lea edx, [esi + 1]
push eax
mov ecx, edi
call fcn.00494fc0
mov bl, 7
mov byte [esp + 0x850], bl
lea eax, [esp + 0x14]
call fcn.00407eb0
push eax
call dword [sym.imp.MSVCR90.dll__wtoi]
add esp, 4
push esi
lea ecx, [esp + 0x24]
push ecx
xor edx, edx
mov ecx, edi
mov dword [ebp + 0x1c], eax
call fcn.00495030
mov byte [esp + 0x850], 8
call fcn.00494c50
mov byte [esp + 0x850], bl
lea ecx, [esp + 0x20]
call fcn.00494b70
mov byte [esp + 0x850], 2
lea ecx, [esp + 0x14]
call fcn.00494b70
mov ecx, edi
call fcn.004c0470
jmp 0x4bffb6
mov dword [ebp + 0x1c], ebx
jmp 0x4bffb6
mov esi, dword [esp + 0x1c]
lea edi, [esi + 0x18]
call fcn.00495360
mov dword [esi + 0x1c], ebx
mov byte [esp + 0x850], 0
lea ecx, [esp + 0x18]
call fcn.00494b70
mov dword [esp + 0x850], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.00494b70
mov al, 1
jmp 0x4bfe78