Function at 0x547aa4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38c
lea eax, [ebp - 0x44]
lea ecx, [0x5792b4]
mov dl, byte [0x5973ae]
mov dword [ebp - 0x28], ecx
mov ecx, 0x586c60
mov dword [ebp - 0x24], ecx
mov ecx, ebp
mov dword [ebp - 0x20], ecx
mov ecx, esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], 0x5482ea
mov byte [ebp - 0x2c9], dl
call fcn.00579e71
mov dl, byte [ebp - 0x2c9]
test dl, 1
je 0x547afa
mov byte [ebp - 0x45], 1
jmp 0x5482aa
mov eax, SysReAllocStringLen
xor ecx, ecx
mov edx, 0x20019
lea esi, [ebp - 0x4c]
mov word [0x5973b0], 0
mov word [0x5975b0], 0
mov word [0x5977b0], 0
mov word [0x5979b0], 0
mov dword [0x597bb0], 0x1838
mov dword [0x597bb4], 0
mov edi, dword [str.SOFTWAREIDtech_S.A.Environment]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x4c]
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], edi
mov dword [ebx + 0xc], 0x20019
mov dword [ebx + 8], 0
mov dword [ebx], SysReAllocStringLen
mov dword [ebp - 0x2d4], esi
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2dc], edx
call sub.ADVAPI32.DLL_RegOpenKeyExW
sub esp, 0x14
cmp eax, 0
jne 0x5482a0
lea eax, [0x586a18]
xor ecx, ecx
lea edx, [ebp - 0x250]
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x100
mov word [ebp - 0x24c], 0
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x2e0], eax
lea eax, [ebp - 0x250]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], esi
mov dword [ebx], edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 0x586a18
mov dword [ebp - 0x2e4], edx
mov dword [ebp - 0x2e8], ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
cmp eax, 0
jne 0x547c9a
cmp dword [ebp - 0x250], 0
jbe 0x547c57
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x5c
je 0x547c44
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x2f
jne 0x547c57
mov eax, dword [ebp - 0x250]
sub eax, 1
mov word [ebp + eax*2 - 0x24c], 0
lea eax, [0x5973b0]
mov ecx, 0xff
lea edx, [ebp - 0x24c]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0xff
mov dword [ebp - 0x2ec], ecx
call fcn.00566a50
mov word [0x5975ae], 0
mov dword [ebp - 0x2f0], eax
jmp 0x547ca3
mov byte [ebp - 0x45], 0
jmp 0x5482aa
lea eax, str.CustomerDir
xor ecx, ecx
lea edx, [ebp - 0x250]
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x100
mov word [ebp - 0x24c], 0
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 0x250]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], esi
mov dword [ebx], edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], str.CustomerDir
mov dword [ebp - 0x2f8], edx
mov dword [ebp - 0x2fc], ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
cmp eax, 0
jne 0x547da7
cmp dword [ebp - 0x250], 0
jbe 0x547d64
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x5c
je 0x547d51
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x2f
jne 0x547d64
mov eax, dword [ebp - 0x250]
sub eax, 1
mov word [ebp + eax*2 - 0x24c], 0
lea eax, [0x5975b0]
mov ecx, 0xff
lea edx, [ebp - 0x24c]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0xff
mov dword [ebp - 0x300], ecx
call fcn.00566a50
mov word [0x5977ae], 0
mov dword [ebp - 0x304], eax
jmp 0x547db0
mov byte [ebp - 0x45], 0
jmp 0x5482aa
lea eax, str.TmpDir
xor ecx, ecx
lea edx, [ebp - 0x250]
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x100
mov word [ebp - 0x24c], 0
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x250]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], esi
mov dword [ebx], edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], str.TmpDir
mov dword [ebp - 0x30c], edx
mov dword [ebp - 0x310], ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
cmp eax, 0
jne 0x547eb2
cmp dword [ebp - 0x250], 0
jbe 0x547e71
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x5c
je 0x547e5e
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x2f
jne 0x547e71
mov eax, dword [ebp - 0x250]
sub eax, 1
mov word [ebp + eax*2 - 0x24c], 0
lea eax, [0x5977b0]
mov ecx, 0xff
lea edx, [ebp - 0x24c]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0xff
mov dword [ebp - 0x314], ecx
call fcn.00566a50
mov word [0x5979ae], 0
mov dword [ebp - 0x318], eax
lea eax, str.RshHost
xor ecx, ecx
lea edx, [ebp - 0x250]
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x100
mov word [ebp - 0x24c], 0
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x31c], eax
lea eax, [ebp - 0x250]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], esi
mov dword [ebx], edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], str.RshHost
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x324], ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
cmp eax, 0
jne 0x547fb4
cmp dword [ebp - 0x250], 0
jbe 0x547f73
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x5c
je 0x547f60
mov eax, dword [ebp - 0x250]
sub eax, 1
movzx eax, word [ebp + eax*2 - 0x24c]
cmp eax, 0x2f
jne 0x547f73
mov eax, dword [ebp - 0x250]
sub eax, 1
mov word [ebp + eax*2 - 0x24c], 0
lea eax, [0x5979b0]
mov ecx, 0xff
lea edx, [ebp - 0x24c]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0xff
mov dword [ebp - 0x328], ecx
call fcn.00566a50
mov word [0x597bae], 0
mov dword [ebp - 0x32c], eax
lea eax, str.RshPort
xor ecx, ecx
lea edx, [ebp - 0x250]
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x100
mov word [ebp - 0x24c], 0
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x250]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], esi
mov dword [ebx], edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], str.RshPort
mov dword [ebp - 0x334], edx
mov dword [ebp - 0x338], ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
cmp eax, 0
jne 0x54811a
mov dword [ebp - 0x3c], 0xffffffff
mov eax, esp
lea ecx, [ebp - 0x24c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x26c]
mov dword [eax], ecx
mov dword [ebp - 0x33c], ecx
call fcn.00401cd8
mov dword [ebp - 0x3c], 1
mov eax, esp
mov ecx, dword [ebp - 0x33c]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x288]
mov dword [eax], edx
call fcn.00401fa8
jmp 0x548073
mov dword [ebp - 0x3c], 2
mov eax, esp
lea ecx, [ebp - 0x288]
mov dword [eax], ecx
call fcn.00402204
mov dword [ebp - 0x340], eax
jmp 0x548091
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x340]
mov dword [0x597bb0], ecx
mov dword [esp], eax
call fcn.00401d68
lea eax, [ebp - 0x26c]
mov dword [esp], eax
call fcn.00401d68
jmp 0x54811a
lea eax, str.DefaultLanguage
xor ecx, ecx
lea edx, [ebp - 0x250]
lea esi, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x100
mov word [ebp - 0x24c], 0
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ebx, esp
mov dword [ebp - 0x354], eax
lea eax, [ebp - 0x250]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x10], esi
mov dword [ebx], edi
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], str.DefaultLanguage
mov dword [ebp - 0x358], edx
mov dword [ebp - 0x35c], ecx
call sub.ADVAPI32.DLL_RegQueryValueExW
sub esp, 0x18
cmp eax, 0
jne 0x54827d
mov dword [ebp - 0x3c], 0xffffffff
mov eax, esp
lea ecx, [ebp - 0x24c]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x2ac]
mov dword [eax], ecx
mov dword [ebp - 0x360], ecx
call fcn.00401cd8
mov dword [ebp - 0x3c], 3
mov eax, esp
mov ecx, dword [ebp - 0x360]
mov dword [eax + 4], ecx
lea edx, [ebp - 0x2c8]
mov dword [eax], edx
call fcn.00401fa8
jmp 0x5481d9
mov dword [ebp - 0x3c], 4
mov eax, esp
lea ecx, [ebp - 0x2c8]
mov dword [eax], ecx
call fcn.00402204
mov dword [ebp - 0x364], eax
jmp 0x5481f7
lea eax, [ebp - 0x2c8]
mov ecx, dword [ebp - 0x364]
mov dword [0x597bb4], ecx
mov dword [esp], eax
call fcn.00401d68
lea eax, [ebp - 0x2ac]
mov dword [esp], eax
call fcn.00401d68
jmp 0x54827d
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], 0xffffffff
mov ecx, esp
mov dword [ecx], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov byte [0x5973ae], 1
mov dword [ebp - 0x378], eax
mov al, byte [0x5973ae]
and al, 1
mov byte [ebp - 0x45], al
lea eax, [ebp - 0x44]
mov cl, byte [ebp - 0x45]
mov dword [esp], eax
mov byte [ebp - 0x379], cl
call fcn.00579e92
mov cl, byte [ebp - 0x379]
and cl, 1
movzx eax, cl
add esp, 0x38c
pop esi
pop edi
pop ebx
pop ebp
ret