Function at 0x4c31b1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xb10
mov eax, 0x54422f
call fcn.00506b61
push 0x70
pop ecx
mov esi, str.e3Ecw9dZEx5mg31LsotwVl3BR0MYuxR0jDgezBqqmTaoXVSNebxr8LPvlg7f6o9LN4sBZBdYk64TZOKsME0Syv7baBmew4s4BkKC5uS9nwJLIEPafaz1u6oBYOt7eRv5QM3rhu4C9gNYNTbDidSVfwOCATnGbI99cKk9uoof3GtN9O0PYwgVfYRY26FM0D37qkT17ZDceMcgu1JTykTcmfBa8B050IHnyMBP4Lieu9kBTWVdI9HGoCVz7LlhVv4rZV1C0GptObCshl8nWgvFirIPMmH2cnLBPyBnsvpL3cN70l7mWg4LoQsgdGI3IkrGKEakUGvzoMiy7Cv4FAHkQysOxNFQYG6fZD7BiLyK4pnWBeFdj15mCWZLFFjBruXA3UtvA6mA3OfmNwBlL5woIVCR01q7DPpjoTXatc3kgZtYi2A1OpJ6lLXYqHtMV5UrN
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x2b4]
mov ebx, dword [ebp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x37
pop ecx
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp + 0xc]
movsw word es:[edi], word [esi]
mov esi, str.zCgFbIgYtEmGhxqCfG3Gnm653WEbDObv2qPdrnpfz4oGZTMGnhgUDZd4L5Q6Pu0ifUVrhvQjfG9ehhL81lToxzIS9tKkvUfs1AlhoAMqDE1JZjr3Ik6zQkNNuO9vUCtZnAQdlOqWnVFf2gF2rSXWCeRk5najVmH7H4wJahRMyvBw7SPGkzaqXQfEZbMzqmky0TS5GshWGbjFQZtl4sJkF9D5X5XX
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0xf0]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xb18], eax
xor eax, eax
mov dword [ebp - 0xb1c], eax
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xafc], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xae4]
lea eax, [ebp - 0x2b4]
push eax
call fcn.00405820
lea eax, [ebp - 0xae4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xb04]
call fcn.00407e30
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0xae4]
push edi
call fcn.0046d37e
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0xae4]
call fcn.00405820
lea eax, [ebp - 0xae4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xb04]
call fcn.00407e30
push 0
push edi
lea ecx, [ebp - 0xae4]
mov byte [ebp - 4], 0
call fcn.0046d37e
push ebx
lea ecx, [ebp - 0xacc]
call fcn.004024f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xae8]
push eax
xor ebx, ebx
mov byte [ebp - 4], 3
push 0x20119
push ebx
push dword [ebp - 0xb08]
mov dword [ebp - 0xae8], ebx
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xaf0], ebx
call esi
test eax, eax
je 0x4c330c
mov ecx, dword [ebp - 0xaec]
lea eax, [ebp - 0xacc]
push eax
call fcn.00404660
jmp 0x4c3432
lea eax, [ebp - 0xaf8]
push eax
push 0x20119
push ebx
push str.SoftWare
push dword [ebp - 0xae8]
call esi
test eax, eax
je 0x4c3338
push dword [ebp - 0xae8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c32f5
lea eax, [ebp - 0xaf4]
push eax
push 0x20119
push ebx
push dword [ebp - 0xb0c]
push dword [ebp - 0xaf8]
call esi
test eax, eax
je 0x4c336f
push dword [ebp - 0xaf8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xae8]
call esi
jmp 0x4c32f5
lea eax, [ebp - 0xaf0]
push eax
push 0x20119
push ebx
push dword [ebp - 0xb10]
push dword [ebp - 0xaf4]
call esi
test eax, eax
je 0x4c33a4
push dword [ebp - 0xaf0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xaf4]
jmp 0x4c3363
push 0x800
lea eax, [ebp - 0xab4]
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0xb14], 0x400
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0xab4]
push eax
push ebx
push ebx
push dword [ebp - 0xb18]
push dword [ebp - 0xaf0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xaf0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xaf4]
call esi
push dword [ebp - 0xaf8]
call esi
push dword [ebp - 0xae8]
call esi
lea eax, [ebp - 0xab4]
push eax
call fcn.004f3a59
pop ecx
mov ecx, dword [ebp - 0xaec]
test eax, eax
je 0x4c32fb
lea eax, [ebp - 0xab4]
push eax
call fcn.004024f0
push ebx
push edi
lea ecx, [ebp - 0xacc]
call fcn.00402590
lea ecx, [ebp - 0xb04]
call fcn.0046d3d0
mov eax, dword [ebp - 0xaec]
call fcn.00506b0b
ret