Function at 0x4b0c40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5159c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xac]
call fcn.004b1330
push fcn.004cdd05
lea ecx, [ebp - 0x198]
push ecx
lea ecx, [ebp - 0xac]
call fcn.004a3550
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0xac]
call fcn.004a3580
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
lea ecx, [ebp - 0xac]
call fcn.004a3550
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.004b1960
add esp, 0x20
mov dword [ebp - 0x8c], 0
lea edx, [ebp - 0x8c]
push edx
push 8
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4b0d10
mov dword [ebp - 0x1b4], 0
lea ecx, [ebp - 0xac]
call fcn.004b11a0
mov eax, dword [ebp - 0x1b4]
jmp 0x4b1008
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x90], 0x40
mov dword [ebp - 0xb8], 0
jmp 0x4b0d49
mov eax, dword [ebp - 0xb8]
add eax, 1
mov dword [ebp - 0xb8], eax
lea ecx, [ebp - 0x90]
push ecx
lea edx, [ebp - 0x88]
push edx
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
jne 0x4b0ed4
mov dword [ebp - 0xbc], 0x80
lea edx, [ebp - 0xbc]
push edx
lea eax, [ebp - 0x140]
push eax
push 0
push str.NetCfgInstanceId
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4b0eba
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x1d0]
call fcn.004b13b0
lea ecx, [ebp - 0x1d0]
push ecx
lea edx, [ebp - 0x15c]
push edx
call fcn.004c17a0
add esp, 8
lea ecx, [ebp - 0x1d0]
call fcn.004b1180
push fcn.004cdd05
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x15c]
call fcn.004a3550
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x15c]
call fcn.004a3580
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1e8]
push eax
lea ecx, [ebp - 0x15c]
call fcn.004a3550
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x1f0]
push eax
call fcn.004b1960
add esp, 0x20
push 0
lea ecx, [ebp - 0x15c]
push ecx
lea ecx, [ebp - 0xac]
call fcn.004b1270
cmp eax, 0xffffffff
je 0x4b0eaf
mov dword [ebp - 0xbc], 4
lea edx, [ebp - 0xbc]
push edx
lea eax, [ebp - 0x160]
push eax
push 0
push str.Characteristics
lea ecx, [ebp - 0x88]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4b0ea5
mov eax, dword [ebp - 0x160]
and eax, 4
je 0x4b0ea5
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xb4], 1
lea ecx, [ebp - 0x15c]
call fcn.004b11a0
cmp dword [ebp - 0xb4], 0
je 0x4b0ec5
jmp 0x4b0ed4
mov dword [ebp - 0x90], 0x40
jmp 0x4b0d3a
cmp dword [ebp - 0xb4], 0
jne 0x4b0fde
mov dword [ebp - 0xb0], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x18c]
call fcn.004b1330
push fcn.004cdd05
lea edx, [ebp - 0x1f8]
push edx
lea ecx, [ebp - 0x18c]
call fcn.004a3550
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x18c]
call fcn.004a3580
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x18c]
call fcn.004a3550
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x210]
push eax
call fcn.004b1960
add esp, 0x20
mov dword [ebp - 0x170], str.vmware
mov dword [ebp - 0x16c], str.anchorfree
mov dword [ebp - 0x168], str.tap_win32
mov dword [ebp - 0x164], 0x5034e0
mov dword [ebp - 0x190], 0
jmp 0x4b0f9c
mov ecx, dword [ebp - 0x190]
add ecx, 1
mov dword [ebp - 0x190], ecx
cmp dword [ebp - 0x190], 4
jae 0x4b0fd3
push 0
mov edx, dword [ebp - 0x190]
mov eax, dword [ebp + edx*4 - 0x170]
push eax
lea ecx, [ebp - 0x18c]
call fcn.004b12a0
cmp eax, 0xffffffff
je 0x4b0fd1
mov dword [ebp - 0xb0], 0
jmp 0x4b0fd3
jmp 0x4b0f8d
lea ecx, [ebp - 0x18c]
call fcn.004b11a0
mov ecx, dword [ebp - 0x8c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xb0]
mov dword [ebp - 0x214], edx
lea ecx, [ebp - 0xac]
call fcn.004b11a0
mov eax, dword [ebp - 0x214]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c62c9
mov esp, ebp
pop ebp
ret 8