Function at 0x424c80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x577690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x424]
add ecx, 1
mov dword [ebp - 0x428], ecx
mov edx, dword [ebp - 0x424]
mov al, byte [edx]
mov byte [ebp - 0x429], al
add dword [ebp - 0x424], 1
cmp byte [ebp - 0x429], 0
jne 0x424cab
mov ecx, dword [ebp - 0x424]
sub ecx, dword [ebp - 0x428]
mov dword [ebp - 0x430], ecx
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x41c]
add eax, 1
push eax
call fcn.004fa9a4
add esp, 4
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x41c]
add ecx, 1
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x410]
push eax
call fcn.004fb680
add esp, 0xc
mov dword [ebp - 0x414], 0x400
call fcn.00424bb0
test eax, eax
je 0x424d53
lea ecx, [ebp - 0x40c]
push ecx
push 0x20119
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x418], eax
jmp 0x424d75
lea ecx, [ebp - 0x40c]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jne 0x424ee3
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x40c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x418], eax
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x418], 0
jne 0x424ee3
mov dword [ebp - 0x420], 0
jmp 0x424de0
mov eax, dword [ebp - 0x420]
add eax, 1
mov dword [ebp - 0x420], eax
lea ecx, [ebp - 0x408]
mov dword [ebp - 0x434], ecx
mov edx, dword [ebp - 0x434]
add edx, 1
mov dword [ebp - 0x438], edx
mov eax, dword [ebp - 0x434]
mov cl, byte [eax]
mov byte [ebp - 0x439], cl
add dword [ebp - 0x434], 1
cmp byte [ebp - 0x439], 0
jne 0x424dfb
mov edx, dword [ebp - 0x434]
sub edx, dword [ebp - 0x438]
mov dword [ebp - 0x440], edx
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x440]
jae 0x424e62
mov ecx, dword [ebp - 0x420]
movsx edx, byte [ebp + ecx - 0x408]
push edx
call fcn.004fc58c
add esp, 4
mov ecx, dword [ebp - 0x420]
mov byte [ebp + ecx - 0x408], al
jmp 0x424dd1
mov dword [ebp - 0x420], 0
jmp 0x424e7d
mov edx, dword [ebp - 0x420]
add edx, 1
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x41c]
jae 0x424eb3
mov ecx, dword [ebp - 0x410]
add ecx, dword [ebp - 0x420]
movsx edx, byte [ecx]
push edx
call fcn.004fc58c
add esp, 4
mov ecx, dword [ebp - 0x410]
add ecx, dword [ebp - 0x420]
mov byte [ecx], al
jmp 0x424e6e
mov edx, dword [ebp - 0x410]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.004fc3f0
add esp, 8
test eax, eax
je 0x424ee3
mov ecx, dword [ebp - 0x410]
push ecx
call fcn.004f9186
add esp, 4
mov eax, 1
jmp 0x424ef4
mov edx, dword [ebp - 0x410]
push edx
call fcn.004f9186
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f8e7f
mov esp, ebp
pop ebp
ret