Function at 0x4b2d90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1bc
mov eax, 0x511644
call fcn.004f41e2
mov esi, ecx
mov dword [ebp - 0x1bc], esi
lea ecx, [ebp - 0x6c]
call fcn.004e25a1
xor ebx, ebx
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 4], ebx
call fcn.004b2b1f
movzx eax, word [ebp + 8]
xor ecx, ecx
push ecx
push ecx
push 0x147
push eax
push dword [esi + 4]
mov byte [ebp - 4], 1
mov edi, ebx
mov dword [ebp - 0x1b8], ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov dword [ebp - 0x1b0], eax
test eax, eax
js 0x4b2fba
xor ecx, ecx
push ecx
push eax
movzx eax, word [ebp + 8]
push 0x149
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov esi, eax
push 2
lea eax, [esi + 0x80]
push eax
call fcn.004e1c42
mov ebx, eax
pop ecx
pop ecx
test esi, esi
jle 0x4b2fa3
test ebx, ebx
je 0x4b30b8
push str.Directory_shell_
lea eax, [esi + 0x80]
push eax
push ebx
call fcn.00401a0b
mov ecx, ebx
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4b2e44
sub ecx, edx
sar ecx, 1
lea eax, [ebx + ecx*2]
push eax
push dword [ebp - 0x1b0]
movzx eax, word [ebp + 8]
push 0x148
push eax
mov eax, dword [ebp - 0x1bc]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x1b4], esi
push eax
push 0x20019
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push SysReAllocString
call esi
test eax, eax
jne 0x4b2fa3
push 1
push 0x412
mov dword [ebp - 0x1c4], 0x410
call fcn.004e1c42
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x1c4]
push eax
push edi
lea eax, [ebp - 0x1c0]
push eax
xor eax, eax
push eax
push str.Icon
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b2ee9
cmp dword [ebp - 0x1c0], 1
je 0x4b2efa
test edi, edi
je 0x4b2efa
push edi
call fcn.004e1bea
pop ecx
xor ecx, ecx
mov edi, ecx
jmp 0x4b2efc
xor ecx, ecx
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x1b0], ecx
push eax
push 0x20019
xor eax, eax
push eax
push 0x55ef94
push dword [ebp - 0x1b4]
call esi
test eax, eax
jne 0x4b2f97
push 1
push 0x1042
mov dword [ebp - 0x1c8], 0x1040
call fcn.004e1c42
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x1c8]
push eax
push esi
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x1b8], esi
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x1b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b2f7c
cmp dword [ebp - 0x1c0], 1
jne 0x4b2f7c
push esi
lea ecx, [ebp - 0x1ac]
call fcn.004b3261
jmp 0x4b2f8b
test edi, edi
je 0x4b2f8b
push edi
call fcn.004e1bea
xor eax, eax
pop ecx
mov edi, eax
push dword [ebp - 0x1b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1b4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4b2fae
push ebx
call fcn.004e1bea
pop ecx
mov ebx, dword [ebp - 0x1b8]
mov esi, dword [ebp - 0x1bc]
push 0x514870
lea ecx, [ebp - 0xcc]
call fcn.004e2b97
mov edx, 0x966
cmp word [ebp + 8], dx
push eax
lea eax, [edx - 0x10]
lea ecx, [edx - 0x15]
cmove eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x1ac]
call fcn.004b2c59
push eax
mov eax, 0x957
lea edx, [eax + 0xf]
cmp word [ebp + 8], dx
lea ecx, [eax - 5]
cmove eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
test edi, edi
mov eax, 0x514870
cmovne eax, edi
push eax
mov eax, 0x955
lea edx, [eax + 0x11]
cmp word [ebp + 8], dx
lea ecx, [eax - 5]
cmove eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, 0x966
cmp word [ebp + 8], ax
jne 0x4b3087
push 0x514870
lea ecx, [ebp - 0x128]
call fcn.004e2b97
push eax
push 0x9af
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
lea ecx, [ebp - 0x128]
call fcn.004e269c
xor ecx, ecx
test al, al
setne cl
push ecx
push 0x95d
push dword [esi + 4]
call fcn.00439272
add esp, 0xc
test ebx, ebx
je 0x4b3092
push ebx
call fcn.004e1bea
pop ecx
test edi, edi
je 0x4b309d
push edi
call fcn.004e1bea
pop ecx
lea ecx, [ebp - 0x1ac]
call fcn.004b2b92
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
call fcn.004f418c
ret 4
mov ebx, edi
jmp 0x4b2fb4