Function at 0x488c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eb815
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x70
mov eax, dword [0x670440]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x67ba44]
cmp eax, dword [esi + 4]
jle 0x488d5b
push 0x67ba44
call fcn.00502dcc
mov eax, dword [0x67ba44]
add esp, 4
cmp eax, 0xffffffff
jne 0x488d10
mov dword [ebp - 4], 0
call fcn.00459940
push 0x5ed910
call fcn.0050309c
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x67ba44
call fcn.00502d7b
mov eax, dword [0x67ba44]
add esp, 4
cmp eax, dword [esi + 4]
jle 0x488d5b
push 0x67ba44
call fcn.00502dcc
add esp, 4
cmp dword [0x67ba44], 0xffffffff
jne 0x488d5b
mov dword [ebp - 4], 1
call fcn.00459940
push 0x5ed910
call fcn.0050309c
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x67ba44
call fcn.00502d7b
add esp, 4
mov ecx, dword [0x67bacc]
mov eax, bind
sub eax, ecx
cmp eax, 0xe
jb 0x489126
cmp dword [0x67bad0], 0xf
mov eax, 0x67babc
push ecx
cmova eax, dword [0x67babc]
push eax
push 0xe
push str.SoftwareNSUS_
push ecx
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x44]
call fcn.004544d0
mov dword [ebp - 4], 2
mov edx, dword [ebp - 0x30]
mov eax, edx
mov ecx, dword [ebp - 0x34]
sub eax, ecx
cmp eax, 1
jb 0x488dca
lea eax, [ecx + 1]
cmp edx, 0xf
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
cmova eax, dword [ebp - 0x44]
mov word [eax + ecx], 0x5c
lea eax, [ebp - 0x44]
jmp 0x488de2
push 1
push 0x65fa44
mov byte [ebp - 0x7c], 0
lea ecx, [ebp - 0x44]
push dword [ebp - 0x7c]
push 1
call fcn.0044bce0
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x18], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push 0x67baec
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.0044a8e0
mov dword [ebp - 0x64], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x74], xmm0
mov dword [ebp - 0x60], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x74], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x64], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xf
jbe 0x488e99
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x488e8f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48912b
push ecx
push edx
call fcn.005030b1
add esp, 8
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x488ee3
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x488ed9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x48912b
push ecx
push edx
call fcn.005030b1
add esp, 8
cmp dword [ebp - 0x60], 0xf
lea esi, [ebp - 0x74]
mov dword [ebp - 0x1c], 0
cmova esi, dword [ebp - 0x74]
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x20], 0x65d73c
mov byte [ebp - 4], 7
test esi, esi
je 0x48901b
cmp byte [esi], 0
je 0x48901b
lea ecx, [ebp - 0x20]
call fcn.0048d670
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x48900c
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
mov al, 1
mov esi, 0xf
movups xmmword [ebp - 0x44], xmm0
mov byte [ebp - 0x18], al
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 8
push eax
push 0
lea eax, [ebp - 0x80]
mov dword [ebp - 0x7c], 0
push eax
push 0
push str.new_installed
push dword [ebp - 0x1c]
mov dword [ebp - 0x80], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x488f9e
push eax
push str.new_installed
push str.fail_to_call_::RegQueryValueExA_name_:__s_0x_0x
call fcn.0044afd0
add esp, 0xc
cmp dword [ebp - 0x80], 1
jne 0x488fd9
push dword [ebp - 0x7c]
lea eax, [ebp - 0x44]
push eax
push str.new_installed
lea ecx, [ebp - 0x20]
call fcn.0048d690
test eax, eax
jne 0x488fd6
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [ebp - 0x5c], xmm0
movq xmm0, qword [ebp - 0x34]
movq qword [ebp - 0x4c], xmm0
mov edi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
jmp 0x489032
mov esi, dword [ebp - 0x30]
cmp esi, 0xf
jbe 0x48901b
mov ecx, dword [ebp - 0x44]
inc esi
mov eax, ecx
cmp esi, 0x1000
jb 0x489000
mov ecx, dword [eax - 4]
add esi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x489130
push esi
push ecx
call fcn.005030b1
add esp, 8
jmp 0x48901b
push eax
push esi
push str.fail_to_call_::RegOpenKeyExA_regKey_:__s_0x_0x
call fcn.0044afd0
add esp, 0xc
xorps xmm0, xmm0
xor ecx, ecx
mov edi, 0xf
mov dword [ebp - 0x4c], ecx
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x5c], cl
cmp edi, 0xf
lea edx, [ebp - 0x5c]
cmova edx, dword [ebp - 0x5c]
cmp ecx, 2
jne 0x4890a4
mov esi, 0x65fa58
sub ecx, 4
jb 0x489061
nop dword [eax + eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x489066
add edx, 4
add esi, 4
sub ecx, 4
jae 0x489050
cmp ecx, 0xfffffffc
je 0x48909a
mov al, byte [edx]
cmp al, byte [esi]
jne 0x489093
cmp ecx, 0xfffffffd
je 0x48909a
mov al, byte [edx + 1]
cmp al, byte [esi + 1]
jne 0x489093
cmp ecx, 0xfffffffe
je 0x48909a
mov al, byte [edx + 2]
cmp al, byte [esi + 2]
jne 0x489093
cmp ecx, 0xffffffff
je 0x48909a
mov al, byte [edx + 3]
cmp al, byte [esi + 3]
je 0x48909a
sbb eax, eax
or eax, 1
jmp 0x48909c
xor eax, eax
mov byte [ebp - 0x75], 1
test eax, eax
je 0x4890a8
mov byte [ebp - 0x75], 0
cmp edi, 0xf
jbe 0x4890d5
mov ecx, dword [ebp - 0x5c]
inc edi
mov eax, ecx
cmp edi, 0x1000
jb 0x4890cb
mov ecx, dword [eax - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x489135
push edi
push ecx
call fcn.005030b1
add esp, 8
mov ecx, dword [ebp - 0x60]
cmp ecx, 0xf
jbe 0x489105
mov edx, dword [ebp - 0x74]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4890fb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x489135
push ecx
push edx
call fcn.005030b1
add esp, 8
mov al, byte [ebp - 0x75]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00502d42
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00447160
call fcn.005be8d2
call fcn.005be8d2
call fcn.005be8d2
int3