Function at 0x49db30
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f1c61
mov eax, dword fs:[0]
push eax
mov eax, 0x1678
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x1674], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x168c]
mov dword fs:[0], eax
xor ebp, ebp
push 0x1ff
lea eax, [esp + 0x8d]
push ebp
push eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x94], 0
call sub.MSVCR90.dll_memset
push 0x13ff
lea ecx, [esp + 0x299]
push ebp
push ecx
mov byte [esp + 0x2a0], 0
call sub.MSVCR90.dll_memset
add esp, 0x18
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
mov dword [esp + 0x1694], ebp
mov eax, dword [esp + 0x169c]
cmp eax, 0xc98
jne 0x49dbe0
push str.tc_FileS
jmp 0x49dc4e
cmp eax, 0xd04
jne 0x49dbee
push str.tc_FileE
jmp 0x49dc4e
cmp eax, 0xcfd
jne 0x49dbfc
push str.tc_FileM
jmp 0x49dc4e
cmp eax, 0xcff
jne 0x49dc0a
push str.tc_FileD
jmp 0x49dc4e
cmp eax, 0xc34
jne 0x49dc18
push str.tc_FileG
jmp 0x49dc4e
cmp eax, 0xcfc
jne 0x49dc26
push str.tc_FileP
jmp 0x49dc4e
cmp eax, 0xd60
jne 0x49dc34
push str.td_DDXP
jmp 0x49dc4e
cmp eax, 0xd00
jne 0x49dc42
push str.tc_FileNa
jmp 0x49dc4e
cmp eax, 0xd02
jne 0x49dc58
push str.tc_FileB
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_820]
mov edi, 1
push edi
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
push str.SoftWareTrojanCut_
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x1694], 1
lea ecx, [esp + 0x44]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0x1694], 2
lea ecx, [esp + 0x6c]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0x1694], 3
mov dword [esp + 0x2c], ebp
jmp 0x49dcb0
cmp dword [0x103a97c], 0x78
jne 0x49dcf9
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.004029d0
mov byte [esp + 0x16a0], 4
mov edx, dword [eax]
push edx
push str._t_tRegSendStatus_RegOpenKeyEx__s_
push 8
call fcn.0043d500
add esp, 0x18
mov byte [esp + 0x1694], 3
lea ecx, [esp + 0x38]
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.004029d0
add esp, 0xc
mov byte [esp + 0x1694], 5
mov eax, dword [eax]
lea ecx, [esp + 0x24]
push ecx
push 0xf003f
push ebp
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete bl
mov byte [esp + 0x1694], 3
lea ecx, [esp + 0x3c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
test bl, bl
je 0x49deee
lea ecx, [esp + 0x58]
call sub.mfc90.dll_Ordinal_580
mov byte [esp + 0x1694], 6
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28c]
push eax
mov eax, dword [esp + 0x24]
push ebp
push ebp
lea ecx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x9c]
push edx
push eax
push ecx
mov dword [esp + 0x48], 0x200
mov dword [esp + 0x40], 0x1400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
add dword [esp + 0x1c], edi
mov esi, eax
cmp esi, ebp
jne 0x49deb6
mov al, byte [esp + 0x88]
test al, al
je 0x49deb6
cmp dword [0x103a97c], 0x78
jne 0x49dde9
lea edx, [esp + 0x288]
push edx
lea eax, [esp + 0x8c]
push eax
push str._t_tRegSendStatus_RegEnumValue__s___s_
push 8
call fcn.0043d500
mov al, byte [esp + 0x98]
add esp, 0x10
sub al, 0x30
cmp al, 9
ja 0x49dd61
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x60]
call sub.mfc90.dll_Ordinal_6494
push ebp
push ecx
lea edx, [esp + 0x290]
mov ecx, esp
mov dword [esp + 0x8c], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_314]
mov byte [esp + 0x169c], 7
lea eax, [esp + 0x60]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x90], esp
push 0x502ba4
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x16a4], 8
mov byte [esp + 0x16a4], 6
call fcn.004d90e0
add esp, 0x10
cmp dword [esp + 0x60], edi
jle 0x49deb6
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x88]
push ecx
push edx
lea ecx, [esp + 0x4c]
call sub.mfc90.dll_Ordinal_6154
cmp dword [esp + 0x60], edi
jle 0x49e086
mov eax, dword [esp + 0x5c]
add eax, 4
push eax
mov eax, dword [esp + 0x78]
push eax
lea ecx, [esp + 0x74]
call sub.mfc90.dll_Ordinal_6153
cmp dword [0x103a97c], 0x78
jne 0x49deb6
lea ecx, [esp + 0x288]
push ecx
lea edx, [esp + 0x8c]
push edx
push str._t_tRegSendStatus_Add_Message__s___s_
push 8
call fcn.0043d500
add esp, 0x10
mov byte [esp + 0x88], 0
mov byte [esp + 0x288], 0
cmp esi, 0x103
jne 0x49dd61
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x1694], 3
lea ecx, [esp + 0x58]
call sub.mfc90.dll_Ordinal_781
push str.SoftwareWow6432NodeTrojanCut
lea ecx, [esp + 0x44]
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov byte [esp + 0x1694], 9
push 0x4ff418
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00402a60
add esp, 0xc
mov byte [esp + 0x1694], 0xa
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov byte [esp + 0x1694], 9
lea ecx, [esp + 0x30]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1694], 3
lea ecx, [esp + 0x40]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, dword [esp + 0x2c]
add eax, edi
cmp eax, 0x64
mov dword [esp + 0x2c], eax
jl 0x49dcb0
push ebp
push str.SeBackupPrivilege
call fcn.004913e0
mov eax, dword [esp + 0x54]
add esp, 8
xor esi, esi
cmp eax, ebp
jle 0x49e013
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
jl 0x49e086
cmp esi, eax
jge 0x49e086
mov edx, dword [esp + 0x48]
mov eax, dword [edx + esi*4]
push eax
call fcn.004d8d70
add esp, 4
cmp esi, dword [esp + 0x74]
mov ebx, eax
jge 0x49e086
mov eax, dword [esp + 0x70]
mov eax, dword [eax + esi*4]
push eax
call fcn.004d8d70
add esp, 4
cmp dword [0x103a97c], 0x78
mov edi, eax
jne 0x49dfea
lea ecx, [esp + 0x288]
push ecx
lea edx, [esp + 0x8c]
push edx
push str._t_tRegSendStatus_PostMessage__s___s_
push 8
call fcn.0043d500
add esp, 0x10
mov eax, dword [esp + 0x169c]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx + 0x20]
push edi
push ebx
push eax
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0xa
call ebp
mov eax, dword [esp + 0x4c]
inc esi
cmp esi, eax
jl 0x49df84
mov byte [esp + 0x1694], 2
lea ecx, [esp + 0x6c]
call sub.mfc90.dll_Ordinal_781
mov byte [esp + 0x1694], 1
lea ecx, [esp + 0x44]
call sub.mfc90.dll_Ordinal_781
mov byte [esp + 0x1694], 0
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov dword [esp + 0x1694], 0xffffffff
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov ecx, dword [esp + 0x168c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1674]
xor ecx, esp
call fcn.004e0148
add esp, 0x1684
ret 4
call sub.mfc90.dll_Ordinal_1252
int3