Function at 0x4d0d56
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xab0
mov eax, 0x553fe9
call fcn.00514880
push 0x4e
pop ecx
mov esi, str.O7WPmH8jra5Xk718SnPvZKEHsSmst0hxmI5ZeuoyozGr70BwlP0vlmLYtsZlmAKZvQpZZ4UzOcIiGNCxYQS91OMITASxp7VuvGZ48AG6qk1T4Us26wsH0m90o429SmIRPVpQ75oOEvzClvmxRu0AA4KqAwdMZ2VHHRvHnj6HSJY46ujDdZaCB8dBapZEslXcbBRv1lEhhesMZxrpijaTDwdcGdlogigZy0xJmMxmdZj7Hmv1E3DlWyQEMvKNlMi7PmiVmH9KYsyOxE2wJiJSYNEYgEaQhcrH4SgiFBgJwHDJuhX5eVYjqklucm
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x254]
mov ebx, dword [ebp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x41
pop ecx
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp + 0xc]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp + 0x14]
movsb byte es:[edi], byte [esi]
mov esi, str.CD7lJU5JJNuHX00agUYS5FXLidVjW5WXyDBTO5zugCxKXcXEKZQZZzGCIEU3bhp5m5NtHCWQq67Z5uXIy5vkN695OlFdBMzeibW7wFHU60auTuwHEckVqjpocfdEfyLzVdgp8CklXCT9Wa2cfKMmDvcXFFjgv2F72YIES08s8OB7kTsjoepIIjv2wFxRJiHaUuVUnGcLxpX2NNguuAevYRretCgJUs3rE10raar3pHjYvPmLGoePQ28FtNvCHR309aWKR
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp + 0x18]
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xab8], eax
xor eax, eax
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xaa4], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xa84]
lea eax, [ebp - 0x254]
push eax
call fcn.004057d0
lea eax, [ebp - 0xa84]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xaa4]
call fcn.00407f90
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0xa84]
push edi
call fcn.00479e2e
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0xa84]
call fcn.004057d0
lea eax, [ebp - 0xa84]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xaa4]
call fcn.00407f90
push 0
push edi
lea ecx, [ebp - 0xa84]
mov byte [ebp - 4], 0
call fcn.00479e2e
push ebx
lea ecx, [ebp - 0xa6c]
call fcn.004024f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xa88]
push eax
xor ebx, ebx
mov byte [ebp - 4], 3
push 0x20119
push ebx
push dword [ebp - 0xaa8]
mov dword [ebp - 0xa88], ebx
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 0xa98], ebx
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xa90], ebx
call esi
test eax, eax
je 0x4d0eb3
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xa6c]
push eax
call fcn.00404610
jmp 0x4d0fd9
lea eax, [ebp - 0xa98]
push eax
push 0x20119
push ebx
push str.SoftWare
push dword [ebp - 0xa88]
call esi
test eax, eax
je 0x4d0edf
push dword [ebp - 0xa88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d0e9c
lea eax, [ebp - 0xa94]
push eax
push 0x20119
push ebx
push dword [ebp - 0xaac]
push dword [ebp - 0xa98]
call esi
test eax, eax
je 0x4d0f16
push dword [ebp - 0xa98]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xa88]
call esi
jmp 0x4d0e9c
lea eax, [ebp - 0xa90]
push eax
push 0x20119
push ebx
push dword [ebp - 0xab0]
push dword [ebp - 0xa94]
call esi
test eax, eax
je 0x4d0f4b
push dword [ebp - 0xa90]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xa94]
jmp 0x4d0f0a
push 0x800
lea eax, [ebp - 0xa54]
push ebx
push eax
call fcn.004f14e0
add esp, 0xc
mov dword [ebp - 0xab4], 0x400
lea eax, [ebp - 0xab4]
push eax
lea eax, [ebp - 0xa54]
push eax
push ebx
push ebx
push dword [ebp - 0xab8]
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xa94]
call esi
push dword [ebp - 0xa98]
call esi
push dword [ebp - 0xa88]
call esi
lea eax, [ebp - 0xa54]
push eax
call fcn.005017a9
pop ecx
mov ecx, dword [ebp - 0xa8c]
test eax, eax
je 0x4d0ea2
lea eax, [ebp - 0xa54]
push eax
call fcn.004024f0
push ebx
push edi
lea ecx, [ebp - 0xa6c]
call fcn.00402590
lea ecx, [ebp - 0xaa4]
call fcn.00479e80
mov eax, dword [ebp - 0xa8c]
call fcn.0051483b
ret