Function at 0x424ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x47f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp + 0x14]
push esi
push edi
mov dword [ebp - 0x63c], eax
call fcn.0042da20
movzx esi, al
neg esi
sbb esi, esi
xor eax, eax
push 0x616
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
and esi, 0x200
mov dword [ebp - 0x624], 0x618
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
or esi, 0x20019
push esi
push 0
push str.SoftwareiSafe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x634], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424b7e
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x630]
push eax
push 0
push str.channel
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x634]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x424b91
push eax
call edi
cmp word [ebp - 0x620], 0
jne 0x424b9f
xor ecx, ecx
jmp 0x424bbf
lea ecx, [ebp - 0x620]
lea edx, [ecx + 2]
jmp 0x424bb0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424bb0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x620]
push eax
mov ecx, ebx
call fcn.00406c00
push 0x618
lea eax, [ebp - 0x620]
push 0
push eax
mov dword [ebp - 0x624], 0x618
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
push esi
push 0
push str.SoftwareiSafe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x634], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x424c4a
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x630]
push eax
push 0
push 0x45d178
push dword [ebp - 0x634]
call ebx
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x424c57
push eax
call edi
cmp word [ebp - 0x620], 0
jne 0x424c65
xor ecx, ecx
jmp 0x424c7f
lea ecx, [ebp - 0x620]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424c70
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x628]
lea eax, [ebp - 0x620]
push eax
call fcn.00406c00
push 0x618
lea eax, [ebp - 0x620]
push 0
push eax
mov dword [ebp - 0x624], 0x618
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
push esi
push 0
push str.SoftwareiSafe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x634], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424d08
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x46ba04
push dword [ebp - 0x634]
call ebx
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x424d15
push eax
call edi
cmp word [ebp - 0x620], 0
jne 0x424d23
xor ecx, ecx
jmp 0x424d3f
lea ecx, [ebp - 0x620]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424d30
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x62c]
lea eax, [ebp - 0x620]
push eax
call fcn.00406c00
lea eax, [ebp - 0x634]
push eax
push esi
push 0
push str.SoftwareiSafe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x624], 4
mov dword [ebp - 0x62c], 4
mov dword [ebp - 0x634], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424db2
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x62c]
push eax
push 0
push str.Language
push dword [ebp - 0x634]
call ebx
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x424dbf
push eax
call edi
mov eax, dword [0x4826e4]
test al, 1
jne 0x424ddd
or eax, 1
push 0x45ae90
mov dword [0x4826e4], eax
call fcn.004521b7
add esp, 4
push dword [ebp - 0x638]
call fcn.004436b0
mov edx, eax
cmp word [edx], 0
jne 0x424df4
xor ecx, ecx
jmp 0x424e0f
mov ecx, edx
lea esi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x424e00
sub ecx, esi
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x63c]
push edx
call fcn.00406c00
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00452076
mov esp, ebp
pop ebp
ret 0x10