Function at 0x484f6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x84]
sub esp, 0x84
push 0xfffffffffffffffe
push 0x4e06d8
push 0x499ffd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4f1020]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x80], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0x8c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SYSTEMCurrentControlSetServicesDiskEnum
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x484fde
xor eax, eax
jmp 0x485199
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 4
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push str.Count
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x48518a
mov eax, dword [ebp - 0x34]
shl eax, 3
push eax
mov esi, dword [sym.imp.MSVCR80.dll_malloc]
call esi
pop ecx
mov dword [edi], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2c], eax
jae 0x48518a
mov byte [ebp], bl
push 0x7f
push ebx
lea eax, [ebp + 1]
push eax
call sub.MSVCR80.dll_memset
push dword [ebp - 0x2c]
push str..PHYSICALDRIVE_u
lea eax, [ebp]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
mov dword [ebp - 0x38], ebx
push 0xd28
call esi
add esp, 0x1c
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x485079
push ebx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
jmp 0x485182
push 0xd28
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push closesocket
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x4850aa
push dword [ebp - 0x20]
jmp 0x48506d
push ebx
lea ecx, [ebp - 0x38]
push ecx
push 0xd28
push dword [ebp - 0x20]
push ebx
push ebx
push 0x7400c
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, ebx
jne 0x48510b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push dword [ebp - 0x44]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x485182
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
shr eax, 2
shl eax, 5
push eax
call esi
pop ecx
mov ecx, dword [edi]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + edx*8 + 4], eax
mov eax, dword [edi]
mov ecx, edx
mov dword [eax + ecx*8], ebx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x3c]
jae 0x48516c
mov eax, dword [edi]
mov ecx, dword [ebp - 0x1c]
lea eax, [eax + ecx*8]
mov edx, dword [eax]
mov ecx, edx
shl ecx, 5
add ecx, dword [eax + 4]
inc edx
mov dword [eax], edx
push 0x20
mov eax, dword [ebp - 0x28]
shl eax, 5
mov edx, dword [ebp - 0x20]
lea eax, [eax + edx + 8]
push eax
push ecx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
add dword [ebp - 0x28], 4
jmp 0x485130
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x1c]
inc dword [ebp - 0x2c]
jmp 0x48502b
mov dword [ebp - 4], 0xfffffffe
call fcn.004851be
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.00499bb9
add ebp, 0x84
leave
ret