Function at 0x4e0b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x612f65
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x67f864]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x88], 1
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [ebp - 0x8c], esi
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edi, eax
xor bl, bl
call fcn.004dfa10
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ecx*8 + 0x686060]
test eax, eax
je 0x4e0bbb
nop
cmp eax, edi
je 0x4e0bb4
mov eax, dword [ecx*8 + 0x686068]
add ecx, 1
test eax, eax
jne 0x4e0ba0
jmp 0x4e0bbb
mov bl, byte [ecx*8 + 0x686064]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x7c], 0
call fcn.00574d26
xor edi, edi
push 0x5c
lea eax, [ebp - 0x78]
push edi
mov dword [ebp - 4], edi
push eax
mov byte [ebp - 4], 1
call fcn.005d5de0
add esp, 0xc
push 0x687a08
lea ecx, [edi + 1]
mov byte [ebp - 0x61], bl
mov word [ebp - 0x5c], di
call fcn.004e4af0
cmp dword [0x687a10], edi
jle 0x4e0c76
mov ecx, dword [0x687a0c]
mov word [ecx], di
cmp dword [0x687a10], edi
jle 0x4e0c76
mov edx, dword [0x687a0c]
push edi
mov edi, dword [sym.imp.GDI32.dll_EnumFontFamiliesExW]
lea eax, [ebp - 0x7c]
push eax
push 0x4e0500
lea ecx, [ebp - 0x78]
push ecx
push esi
mov byte [edx + 0x40], bl
call edi
push 0
lea edx, [ebp - 0x7c]
push edx
push 0x4e0500
lea eax, [ebp - 0x78]
push eax
push esi
mov byte [ebp - 0x61], 2
call edi
push 0
lea ecx, [ebp - 0x7c]
push ecx
push 0x4e0500
lea edx, [ebp - 0x78]
push edx
push esi
mov byte [ebp - 0x61], 0xff
call edi
push 0
lea eax, [ebp - 0x7c]
push eax
push 0x4e0500
lea ecx, [ebp - 0x78]
push ecx
push esi
mov byte [ebp - 0x61], 1
call edi
jmp 0x4e0c9d
jmp fcn.00574b84
mov dword [ebp - 4], 0xffffffff
call fcn.00574d3c
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x20
push str.MS_Shell_Dlg
push 0x690870
mov dword [0x69248c], eax
call edi
push 0x20
push str.MS_Shell_Dlg2
push 0x6908b0
call edi
lea eax, [ebp - 0x80]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionFontSubstitutes
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e0d58
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x84]
push ecx
push 0x690870
lea edx, [ebp - 0x90]
push edx
push eax
mov eax, dword [ebp - 0x80]
push str.MS_Shell_Dlg
mov ebx, 0x40
push eax
mov dword [ebp - 0x84], ebx
call edi
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x84]
push ecx
push 0x6908b0
lea edx, [ebp - 0x90]
push edx
push 0
push str.MS_Shell_Dlg_2
push eax
mov dword [ebp - 0x84], ebx
call edi
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004e0a00
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x88]
mov dword [0x6924d0], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005ce60a
mov esp, ebp
pop ebp
ret