Function at 0x4c48d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5616fd
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x668038]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x668038]
xor eax, esp
push eax
lea eax, [esp + 0x83c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84c]
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
je 0x4c4b1c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4c4923
sub eax, edx
sar eax, 1
je 0x4c4b1c
cmp ebp, ebx
je 0x4c4b1c
lea eax, [esp + 0x20]
push eax
push 1
push ebx
push esi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4c4b1c
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x43c]
push edx
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ecx
mov dword [esp + 0x48], 1
mov dword [esp + 0x44], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x20]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x20], ebx
cmp edi, ebx
jne 0x4c49a7
cmp dword [esp + 0x2c], 2
ja 0x4c49c1
lea edx, [esp + 0x438]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4c49b2
push ebp
lea eax, [esp + 0x43c]
call fcn.004c4d70
lea eax, [ebp + 0x24]
push eax
push esi
call fcn.004c51c0
add esp, 8
mov eax, esi
push ebx
or edi, 0xffffffff
lea esi, [esp + 0x20]
call fcn.004993c0
mov dword [esp + 0x844], ebx
push ebx
or edi, edi
mov eax, str.DefaultIcon
lea esi, [esp + 0x18]
call fcn.004993c0
mov byte [esp + 0x844], 1
mov ecx, esi
push ecx
lea edi, [esp + 0x20]
call fcn.00499570
mov byte [esp + 0x844], bl
mov ecx, esi
call fcn.00499450
lea edx, [esp + 0x24]
push edx
push 1
push ebx
mov eax, edi
call fcn.00408130
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4c4c36
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push eax
mov dword [esp + 0x4c], 1
mov dword [esp + 0x40], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x24]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
cmp esi, ebx
jne 0x4c4c36
cmp dword [esp + 0x28], 2
jbe 0x4c4c36
cmp word [esp + 0x38], 0x22
jne 0x4c4b8a
push ebx
or edi, 0xffffffff
lea eax, [esp + 0x3c]
lea esi, [esp + 0x18]
call fcn.004993c0
mov byte [esp + 0x844], 2
lea edx, [esp + 0x18]
push edx
lea edx, [edi + 2]
mov ecx, esi
call fcn.004998c0
mov byte [esp + 0x844], 3
mov edi, esi
call fcn.00499530
mov byte [esp + 0x844], 2
lea ecx, [esp + 0x18]
call fcn.00499450
push ebx
push 0x22
mov eax, esi
push eax
call fcn.00499b50
cmp eax, ebx
jge 0x4c4b46
mov byte [esp + 0x844], bl
mov ecx, esi
call fcn.00499450
mov dword [esp + 0x844], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00499450
xor al, al
mov ecx, dword [esp + 0x83c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.0054eee2
add esp, 0x834
ret
push eax
lea ecx, [esp + 0x1c]
push ecx
xor edx, edx
lea ecx, [esp + 0x1c]
call fcn.00499930
mov byte [esp + 0x844], 4
lea edi, [ebp + 0x18]
call fcn.00499530
mov byte [esp + 0x844], 2
lea ecx, [esp + 0x18]
call fcn.00499450
mov byte [esp + 0x844], bl
lea ecx, [esp + 0x14]
call fcn.00499450
jmp 0x4c4b99
lea edx, [esp + 0x38]
lea edi, [ebp + 0x18]
push edx
mov eax, edi
call fcn.00499510
mov eax, edi
call fcn.00499c50
test al, al
jne 0x4c4c3e
push ebx
push 0x2c
push edi
call fcn.00499b50
mov esi, eax
cmp esi, ebx
jge 0x4c4bc3
mov ecx, edi
mov dword [ebp + 0x1c], ebx
call fcn.004c5280
jmp 0x4c4c41
lea eax, [esp + 0x14]
lea edx, [esi + 1]
push eax
mov ecx, edi
call fcn.004998c0
mov byte [esp + 0x844], 5
lea eax, [esp + 0x14]
call fcn.00408130
push eax
call dword [sym.imp.MSVCR90.dll__wtoi]
add esp, 4
push esi
lea ecx, [esp + 0x1c]
push ecx
xor edx, edx
mov ecx, edi
mov dword [ebp + 0x1c], eax
call fcn.00499930
mov byte [esp + 0x844], 6
call fcn.00499530
mov byte [esp + 0x844], 5
lea ecx, [esp + 0x18]
call fcn.00499450
mov byte [esp + 0x844], bl
lea ecx, [esp + 0x14]
call fcn.00499450
mov ecx, edi
call fcn.004c5280
jmp 0x4c4c41
lea edi, [ebp + 0x18]
call fcn.00499c60
mov dword [ebp + 0x1c], ebx
mov dword [esp + 0x844], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.00499450
mov al, 1
jmp 0x4c4b1e