Function at 0x4bd865
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52a4b8
mov eax, dword fs:[0]
push eax
sub esp, 0x934
mov eax, dword [0x56f28c]
xor eax, ebp
mov dword [ebp - 0x30], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x920], ecx
mov ecx, dword [ebp - 0x920]
call fcn.004bdb20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
jmp 0x4bd43d
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004bfd60
cmp dword [ebp - 0x18], eax
jae 0x4bdae3
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov edx, dword [eax]
mov eax, dword [edx + 0x78]
cmp eax, dword [ebp + 0xc]
jne 0x4bdade
push 0x80
call fcn.004fff64
add esp, 4
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x8dc], 0
je 0x4bd4b0
mov ecx, dword [ebp - 0x8dc]
call fcn.004ed500
mov dword [ebp - 0x924], eax
jmp 0x4bd4ba
mov dword [ebp - 0x924], 0
mov ecx, dword [ebp - 0x924]
mov dword [ebp - 0x8d8], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x8d8]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
jne 0x4bd4e3
xor eax, eax
jmp 0x4bdae5
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.004ed390
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x78], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x928], ecx
cmp dword [ebp - 0x928], 5
ja case.0x4bd528.2
mov edx, dword [ebp - 0x928]
jmp dword [edx*4 + 0x4bdb04]
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 0x1428
mov ecx, dword [ebp - 0x920]
add ecx, 0x30
call fcn.00417f90
mov dword [ebp - 0x1c], 0
jmp 0x4bda92
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0x1430
mov ecx, dword [ebp - 0x920]
add ecx, 0x30
call fcn.00417f90
mov dword [ebp - 0x1c], 0
jmp 0x4bda92
push 0
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov eax, dword [eax]
push eax
call fcn.00478270
mov ecx, eax
call fcn.004ecdc0
push 1
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov ecx, dword [eax]
call fcn.0046ade0
push eax
lea ecx, [ebp - 0x8e0]
call fcn.00445870
mov dword [ebp - 0x92c], eax
mov edx, dword [ebp - 0x92c]
mov dword [ebp - 0x930], edx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x930]
call fcn.0046ade0
push eax
call fcn.004fc2c0
mov ecx, eax
call fcn.004fc560
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8e0]
call fcn.004458f0
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov ecx, dword [eax]
mov edx, dword [ecx + 0x68]
push edx
mov ecx, dword [ebp - 0x920]
add ecx, 0x80
call fcn.004a1f10
mov ecx, eax
call fcn.004c3c70
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov ecx, dword [eax]
cmp dword [ecx + 0x74], 0
je 0x4bd753
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov eax, dword [eax]
mov dword [eax + 0x70], 0
push 0
lea ecx, [ebp - 0x24]
call fcn.004daae0
mov dword [ebp - 4], 2
push 1
mov ecx, dword [ebp - 0x920]
add ecx, 0x78
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x8e4]
push ecx
mov ecx, dword [ebp - 0x920]
call fcn.004b9570
mov dword [ebp - 0x934], eax
mov edx, dword [ebp - 0x934]
push edx
lea ecx, [ebp - 0x24]
call fcn.004d15d0
lea ecx, [ebp - 0x8e4]
call fcn.004bfa60
lea ecx, [ebp - 0x24]
call fcn.004dab10
movzx eax, al
test eax, eax
je 0x4bd73f
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x24]
call fcn.004a1f10
mov ecx, eax
call fcn.004a3570
lea ecx, [ebp - 0x24]
call fcn.0046ade0
mov esi, eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov ecx, dword [eax]
mov dword [ecx + 0x68], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004bfa60
jmp 0x4bd805
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov eax, dword [eax]
mov dword [ebp - 0x8ec], eax
mov ecx, dword [ebp - 0x8ec]
mov dword [ebp - 0x8e8], ecx
cmp dword [ebp - 0x8e8], 0
je 0x4bd79a
push 1
mov ecx, dword [ebp - 0x8e8]
call fcn.004b2b30
mov dword [ebp - 0x938], eax
jmp 0x4bd7a4
mov dword [ebp - 0x938], 0
mov edx, dword [ebp - 0x18]
push edx
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0x8fc]
push ecx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004bfd30
mov ecx, eax
call fcn.004d1930
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x8f4], edx
mov dword [ebp - 0x8f0], eax
mov ecx, dword [ebp - 0x8f0]
push ecx
mov edx, dword [ebp - 0x8f4]
push edx
lea eax, [ebp - 0x90c]
push eax
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004bfe00
mov ecx, dword [ebp - 0x920]
call fcn.004be590
xor ecx, ecx
test eax, eax
setg cl
mov dword [ebp - 0x20], ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
push 0x405
call fcn.00424e30
add eax, 4
mov ecx, eax
call fcn.0046ade0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x920]
call fcn.004bcfc0
push 0
push 0
push 0x1436
mov ecx, 0x57357c
call fcn.004e6de0
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4bda92
push 0x820
push 0
lea eax, [ebp - 0x854]
push eax
call fcn.00500270
add esp, 0xc
mov dword [ebp - 0x2c], 0x81e
mov dword [ebp - 0x28], 1
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x854]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov ecx, dword [eax]
call fcn.0046ade0
push eax
push 0x53fc24
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
movzx edx, word [ebp - 0x854]
test edx, edx
je 0x4bd962
lea ecx, [ebp - 0x858]
call fcn.004457d0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x854]
push eax
push 0x53fc54
lea ecx, [ebp - 0x858]
push ecx
call fcn.00428670
add esp, 0xc
push 0x820
push 0
lea edx, [ebp - 0x854]
push edx
call fcn.00500270
add esp, 0xc
mov dword [ebp - 0x2c], 0x81e
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x854]
push ecx
lea edx, [ebp - 0x28]
push edx
push str.folder
lea ecx, [ebp - 0x858]
call fcn.0046ade0
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x858]
call fcn.004458f0
movzx eax, word [ebp - 0x854]
test eax, eax
je 0x4bd98f
lea ecx, [ebp - 0x854]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bd98f
lea edx, [ebp - 0x854]
push edx
call fcn.004b4730
add esp, 4
jmp 0x4bd9dc
lea ecx, [ebp - 0x8d4]
call fcn.004a68c0
mov dword [ebp - 4], 4
push 0x53fc9c
push 0x53fca0
push 0x53fcac
push 0x53fcb0
mov eax, dword [ebp - 0x920]
mov ecx, dword [eax + 0x30]
push ecx
lea ecx, [ebp - 0x8d4]
call fcn.004a7790
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d4]
call fcn.004a6970
jmp 0x4bda92
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov eax, dword [eax]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x920]
add ecx, 0x84
call fcn.004d1880
mov edx, dword [eax]
add edx, 8
push edx
call fcn.0044ad90
add esp, 8
push str.4200
push 0x53fcd4
call fcn.00427ed0
mov ecx, eax
call fcn.00493130
push eax
call fcn.00427ed0
mov ecx, eax
call fcn.00490e70
push eax
call fcn.0045f160
mov ecx, eax
call fcn.00460d80
jmp 0x4bda92
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x914], eax
mov ecx, dword [ebp - 0x914]
mov dword [ebp - 0x910], ecx
cmp dword [ebp - 0x910], 0
je 0x4bda81
push 1
mov ecx, dword [ebp - 0x910]
call fcn.004b2b30
mov dword [ebp - 0x93c], eax
jmp 0x4bda8b
mov dword [ebp - 0x93c], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0
je 0x4bdad5
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x91c], edx
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x918], eax
cmp dword [ebp - 0x918], 0
je 0x4bdacb
push 1
mov ecx, dword [ebp - 0x918]
call fcn.004b2b30
mov dword [ebp - 0x940], eax
jmp 0x4bdad5
mov dword [ebp - 0x940], 0
mov dword [ebp - 0x1c], 0
jmp 0x4bdae3
jmp 0x4bd434
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x30]
xor ecx, ebp
call fcn.004ffa01
mov esp, ebp
pop ebp
ret 0x10