Function at 0x4d02e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x57446b
push eax
mov eax, 0x1014
mov dword fs:[0], esp
call fcn.00515810
push ebx
push ebp
push esi
push edi
mov esi, ecx
lea eax, [esi + 0x564]
xor ebp, ebp
push eax
mov dword [esp + 0x1030], 1
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edi, [esi + 0x554]
push 0x5d7b88
mov ecx, edi
call fcn.00530d18
mov edx, dword [esp + 0x1034]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push ebp
push edx
push reloc.oledlg.dll_OleUIInsertObjectA
call ebx
test eax, eax
jne 0x4d0444
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebp
push str.Launcher
push ecx
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
jne 0x4d0439
lea edx, [esp + 0x18]
lea eax, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push ecx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.TECmdLine
push edx
mov dword [esp + 0x30], 0x1000
call ebp
test eax, eax
jne 0x4d03be
lea eax, [esp + 0x24]
mov ecx, esi
push eax
call fcn.004d0850
lea ecx, [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push str.AuxiliaryCmdLine
push ecx
mov dword [esp + 0x30], 0x1000
call ebp
test eax, eax
jne 0x4d03f3
lea edx, [esp + 0x24]
mov ecx, edi
push edx
call fcn.00530d18
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.GUICmdLine
push eax
mov dword [esp + 0x30], 0x1000
call ebp
test eax, eax
jne 0x4d042c
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esi + 0x558]
call fcn.00530d18
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [edi]
cmp dword [ecx - 8], ebp
jne 0x4d0479
lea edx, [esp + 0x1c]
push edx
call fcn.0049eba0
add esp, 4
push eax
mov ecx, edi
mov byte [esp + 0x1030], 2
call fcn.00530cc8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x102c], 1
call fcn.00530b8f
push 0x5c
push 0x2f
mov ecx, edi
call fcn.005280b2
push 0x5c
mov ecx, edi
call fcn.005288d2
mov ecx, dword [esp + 0x1038]
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebp
push ecx
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x4d0672
mov edx, dword [esp + 0x10]
lea ecx, [esi + 4]
push edx
call fcn.004c8010
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x38]
push eax
call fcn.004c8f90
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x54]
call fcn.004c8380
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x80]
push edx
call fcn.004c8770
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0xac]
push eax
call fcn.004c8b00
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0xd4]
call fcn.004cad10
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0xe4]
push edx
call fcn.004caf50
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x150]
push eax
call fcn.004c9350
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x200]
call fcn.004cb540
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x174]
push edx
call fcn.004cee60
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x1ac]
push eax
call fcn.004cc4f0
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x1c8]
call fcn.004c9850
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x29c]
push edx
call fcn.004cd780
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x2e0]
push eax
call fcn.004cc8c0
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x348]
call fcn.004ccdd0
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x370]
push edx
call fcn.004cdc20
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x38c]
push eax
call fcn.004ce220
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x3fc]
call fcn.004cead0
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x428]
push edx
call fcn.004ca6d0
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x464]
push eax
call fcn.004cd230
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x488]
call fcn.004cbc10
mov edx, dword [esp + 0x10]
lea ecx, [esi + 0x4b0]
push edx
call fcn.004c9f20
mov eax, dword [esp + 0x10]
lea ecx, [esi + 0x508]
push eax
call fcn.004ca2f0
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esi + 0x528]
call fcn.004cab40
lea edi, [esi + 0x54c]
push 0x5d7b88
mov ecx, edi
call fcn.00530d18
mov edx, dword [esp + 0x10]
push edi
push str._UserAgent
push 0x5d7b88
push edx
call fcn.004c58d0
add esp, 0x10
test eax, eax
je 0x4d065b
mov eax, dword [edi]
cmp dword [eax - 8], ebp
jne 0x4d0667
push str.CuteFTP_7.0
mov ecx, edi
call fcn.00530d18
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esi + 0x55c]
lea ecx, [esi + 0x55c]
call dword [edx + 0x14]
lea ecx, [esp + 0x1034]
mov byte [esp + 0x102c], 0
call fcn.00530b8f
lea ecx, [esp + 0x1038]
mov dword [esp + 0x102c], 0xffffffff
call fcn.00530b8f
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1020
ret 8