Function at 0x4575e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4ea1f6
mov eax, dword fs:[0]
push eax
mov eax, 0x19030
call fcn.004e03c0
mov eax, dword [0x53fa2c]
xor eax, esp
mov dword [esp + 0x1902c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53fa2c]
xor eax, esp
push eax
lea eax, [esp + 0x19044]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x19054]
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1904c], 3
push 0x2800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
lea eax, [esp + 0x19058]
push eax
lea ecx, [edi + 4]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], 0x2800
call fcn.004029d0
mov byte [esp + 0x19058], 4
push 1
push str.SeBackupPrivilege
call fcn.004913e0
mov ecx, dword [esp + 0x28]
add esp, 0x14
lea eax, [esp + 0x28]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
jne 0x4579ae
mov ecx, dword [esp + 0x1905c]
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x2c]
push esi
lea eax, [esp + 0x34]
push eax
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
jne 0x457726
mov edi, 0x5000
cmp edi, 0x7d000
jge 0x457722
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
push 0x40
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [esp + 0x1905c]
mov esi, eax
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x34]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
add edi, 0x2800
cmp ebx, 0xea
je 0x4576d4
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4579ae
push esi
cmp dword [esp + 0x24], ebx
jne 0x45775b
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [esp + 0x19060]
push edx
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_300]
jmp 0x4579d4
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_314]
mov byte [esp + 0x1904c], 5
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_4481]
cmp byte [0x103a972], 0
je 0x457998
push 0
push str.TC_ENV
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_2481]
cmp eax, 0xffffffff
jne 0x4577c3
push 0
push 0x50e740
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_2481]
cmp eax, 0xffffffff
je 0x457998
mov eax, dword [esp + 0x1905c]
mov ebx, dword [sym.imp.MSVCR90.dll__stricmp]
push str.tC_Sweep
push eax
call ebx
add esp, 8
test eax, eax
je 0x457998
mov ecx, dword [esp + 0x1905c]
push ecx
push str.TC_Org
call ebx
add esp, 8
test eax, eax
je 0x45786b
mov edx, dword [esp + 0x1905c]
push edx
push str.TC_Tel
call ebx
add esp, 8
test eax, eax
je 0x45786b
mov eax, dword [esp + 0x1905c]
push eax
push str.TC_User_name
call ebx
add esp, 8
test eax, eax
je 0x45786b
mov ecx, dword [esp + 0x1905c]
push ecx
push str.TC_User_Office
call ebx
add esp, 8
test eax, eax
je 0x45786b
mov edx, dword [esp + 0x1905c]
push edx
push str.TC_IDATE
call ebx
add esp, 8
test eax, eax
je 0x45786b
mov eax, dword [esp + 0x1905c]
push eax
push str.TC_Section
call ebx
add esp, 8
test eax, eax
jne 0x457939
push str.tc_user
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x457939
push ecx
lea ebx, [esi + 8]
mov ecx, esp
mov dword [esp + 0x40], esp
push ebx
call dword [sym.imp.mfc90.dll_Ordinal_314]
mov byte [esp + 0x19050], 6
push ecx
lea edx, [esp + 0x19064]
mov ecx, esp
mov dword [esp + 0x38], esp
push edx
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x19054], 7
push ecx
lea eax, [esp + 0x19064]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov byte [esp + 0x19058], 8
mov byte [esp + 0x19058], 5
mov ecx, edi
call fcn.00457170
push ebx
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90.dll_Ordinal_314]
mov byte [esp + 0x1904c], 9
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x24]
push ecx
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x18], 1
mov byte [esp + 0x1904c], 5
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1904c], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4579dc
push 0x18fff
lea edx, [esp + 0x45]
push 0
push edx
mov byte [esp + 0x4c], 0
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x4c]
push eax
push ecx
push 0x101e7d8
push 1
call fcn.004915e0
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea edx, [esp + 0x40]
push edx
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_310]
mov dword [esp + 0x18], 1
mov byte [esp + 0x1904c], 4
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
jmp 0x4579dc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_300]
jmp 0x45797c
push 0
push str.SeBackupPrivilege
call fcn.004913e0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x19060]
push ecx
mov ecx, ebp
call dword [sym.imp.mfc90.dll_Ordinal_300]
mov dword [esp + 0x18], 1
mov byte [esp + 0x1904c], 3
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1904c], 2
lea ecx, [esp + 0x19058]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1904c], 1
lea ecx, [esp + 0x1905c]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov byte [esp + 0x1904c], 0
lea ecx, [esp + 0x19060]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, ebp
mov ecx, dword [esp + 0x19044]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1902c]
xor ecx, esp
call fcn.004e0148
add esp, 0x1903c
ret 0x10