Function at 0x4c7f33
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4eed39
call fcn.004ebd20
sub esp, 0x444
mov eax, dword [0x517ad4]
xor eax, ebp
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 4]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x448], ebx
je 0x4c7f67
xor eax, eax
jmp 0x4c826a
mov dword [ebp - 0x434], esi
push 0x20019
push str.SOFTWAREASIO
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x434]
mov dword [ebp - 4], esi
call fcn.0040124f
test eax, eax
je 0x4c7fac
cmp dword [ebp - 0x434], esi
je 0x4c7fa2
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80004005
jmp 0x4c826a
mov dword [ebp - 0x438], esi
push edi
push 0x7f
pop ecx
xor eax, eax
mov word [ebp - 0x210], si
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x434]
lea eax, [ebp - 0x450]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x438]
mov esi, 0x100
push edi
mov dword [ebp - 0x43c], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4c8249
xor ebx, ebx
mov dword [ebp - 0x42c], ebx
push 0x20019
lea eax, [ebp - 0x210]
push eax
push edi
lea eax, [ebp - 0x42c]
call fcn.0040124f
test eax, eax
jne 0x4c807d
lea eax, [ebp - 0x210]
push eax
lea edi, [ebp - 0x430]
call fcn.00403098
push str.CLSID
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x43c], esi
push eax
lea esi, [ebp - 0x43c]
lea edi, [ebp - 0x210]
call fcn.00401282
test eax, eax
je 0x4c808c
mov eax, dword [ebp - 0x430]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x4c807d
push eax
call fcn.004013b2
mov byte [ebp - 4], 0
cmp dword [ebp - 0x42c], ebx
jmp 0x4c8228
lea eax, [ebp - 0x42c]
push eax
lea ebx, [ebp - 0x428]
mov ecx, str.CLSID
call fcn.004c6ec0
test eax, eax
jne 0x4c8206
xor esi, esi
cmp dword [ebp - 0x42c], esi
je 0x4c80c7
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x42c], esi
mov eax, dword [0x51b438]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x444]
push str.CLSID_sInprocServer32
push eax
mov byte [ebp - 4], 3
call fcn.00405b51
mov ebx, dword [ebp - 0x444]
add esp, 0xc
push 0x2001f
push ebx
push SysReAllocStringLen
lea eax, [ebp - 0x42c]
call fcn.0040124f
test eax, eax
je 0x4c8148
add ebx, 0xfffffff4
cmp ebx, dword [0x51b43c]
je 0x4c8122
push ebx
call fcn.004013b2
mov eax, dword [ebp - 0x430]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x4c8139
push eax
call fcn.004013b2
mov byte [ebp - 4], 0
cmp dword [ebp - 0x42c], esi
jmp 0x4c8228
mov word [ebp - 0x418], si
xor eax, eax
mov ecx, 0x81
lea edi, [ebp - 0x416]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x4f8548
lea eax, [ebp - 0x42c]
push eax
lea esi, [ebp - 0x440]
lea edi, [ebp - 0x418]
mov dword [ebp - 0x440], 0x104
call fcn.00401282
test eax, eax
je 0x4c8199
lea eax, [ebx - 0xc]
cmp eax, dword [0x51b43c]
je 0x4c8206
push eax
jmp 0x4c8201
push 0x34
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
je 0x4c81ae
call fcn.004c7528
mov esi, eax
jmp 0x4c81b0
xor esi, esi
test esi, esi
mov dword [ebp - 0x440], esi
je 0x4c81f5
lea edi, [ebp - 0x430]
mov eax, esi
call fcn.0040311c
lea eax, [ebp - 0x418]
push eax
lea eax, [esi + 4]
call fcn.0040315f
lea edi, [esi + 8]
lea esi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x440]
push eax
mov eax, dword [ebp - 0x448]
movsd dword es:[edi], dword [esi]
call fcn.0043a749
add ebx, 0xfffffff4
cmp ebx, dword [0x51b43c]
je 0x4c8206
push ebx
call fcn.004013b2
mov eax, dword [ebp - 0x430]
add eax, 0xfffffff4
cmp eax, dword [0x51b43c]
je 0x4c821d
push eax
call fcn.004013b2
mov byte [ebp - 4], 0
cmp dword [ebp - 0x42c], 0
je 0x4c8236
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x438]
mov ebx, dword [ebp - 0x448]
xor esi, esi
jmp 0x4c7fb3
mov esi, dword [ebx + 4]
neg esi
sbb esi, esi
and esi, 0x7fffbffe
add esi, 0x80004002
test edi, edi
je 0x4c8267
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004ebd70
leave
ret