Function at 0x4a4d6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a5264
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x4a527c
call fcn.00403c8c
push 0x4a5294
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4a5220
xor edx, edx
push ebp
push 0x4a5219
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4a52a4
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov edi, esi
test esi, esi
je 0x4a5202
lea eax, [ebp - 0xb4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00402c68
mov dword [ebp - 0xb4], 0x9c
lea eax, [ebp - 0xb4]
push eax
call edi
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x4a4e5e
lea eax, [ebp - 0xb4]
xor ecx, ecx
mov edx, 0x94
call fcn.00402c68
mov dword [ebp - 0xb4], 0x94
lea eax, [ebp - 0xb4]
push eax
call edi
test eax, eax
jne 0x4a4e5e
call fcn.0040d31c
mov eax, dword [ebp - 0xa4]
sub eax, 1
jb 0x4a51f5
je 0x4a5166
dec eax
jne 0x4a5202
cmp dword [ebp - 0xb0], 4
ja 0x4a4e92
lea eax, [ebp - 0xc]
mov edx, 0x4a52bc
call fcn.00403c8c
jmp 0x4a4ef3
cmp dword [ebp - 0xb0], 5
jne 0x4a4eb3
cmp dword [ebp - 0xac], 0
jne 0x4a4eb3
lea eax, [ebp - 0xc]
mov edx, 0x4a52dc
call fcn.00403c8c
jmp 0x4a4ef3
cmp dword [ebp - 0xb0], 5
jne 0x4a4ed4
cmp dword [ebp - 0xac], 1
jne 0x4a4ed4
lea eax, [ebp - 0xc]
mov edx, 0x4a52fc
call fcn.00403c8c
jmp 0x4a4ef3
cmp dword [ebp - 0xb0], 5
jne 0x4a4ef3
cmp dword [ebp - 0xac], 2
jne 0x4a4ef3
lea eax, [ebp - 0xc]
mov edx, 0x4a531c
call fcn.00403c8c
test bl, bl
je 0x4a4f8e
mov al, byte [ebp - 0x1a]
cmp al, 1
jne 0x4a4f34
mov ax, word [ebp - 0x1c]
and ax, 0x200
cmp ax, 0x200
jne 0x4a4f22
lea eax, [ebp - 0xc]
mov edx, 0x4a533c
call fcn.00403e7c
jmp 0x4a5063
lea eax, [ebp - 0xc]
mov edx, 0x4a5350
call fcn.00403e7c
jmp 0x4a5063
cmp al, 3
jne 0x4a5063
mov ax, word [ebp - 0x1c]
mov edx, eax
and dx, 0x80
cmp dx, 0x80
jne 0x4a4f60
lea eax, [ebp - 0xc]
mov edx, 0x4a5368
call fcn.00403e7c
jmp 0x4a5063
and ax, 2
cmp ax, 2
jne 0x4a4f7c
lea eax, [ebp - 0xc]
mov edx, 0x4a5384
call fcn.00403e7c
jmp 0x4a5063
lea eax, [ebp - 0xc]
mov edx, 0x4a53a0
call fcn.00403e7c
jmp 0x4a5063
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4a53a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x18], 0x14
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.004041a8
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0x4a53d8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.004041a8
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
call fcn.0040909c
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408ec4
mov eax, dword [ebp - 0xb8]
mov edx, 0x4a53ec
call fcn.00403f84
jne 0x4a5025
lea eax, [ebp - 0xc]
mov edx, 0x4a53fc
call fcn.00403e7c
jmp 0x4a5063
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x14]
call fcn.0040909c
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00408ec4
mov eax, dword [ebp - 0xc0]
mov edx, 0x4a5414
call fcn.00403f84
jne 0x4a5063
lea eax, [ebp - 0xc]
mov edx, 0x4a53a0
call fcn.00403e7c
mov ebx, dword [ebp - 0xb0]
cmp ebx, 4
ja 0x4a50fc
lea eax, [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0xb
mov dword [ebp - 0xe8], ebx
mov byte [ebp - 0xe4], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xe0], eax
mov byte [ebp - 0xdc], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xd8], eax
mov byte [ebp - 0xd4], 6
mov eax, dword [ebp - 0xa8]
and eax, 0xffff
mov dword [ebp - 0xd0], eax
mov byte [ebp - 0xcc], 0
lea edx, [ebp - 0xf0]
mov ecx, 4
mov eax, 0x4a5428
call fcn.00409ee0
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc]
call fcn.00403c8c
jmp 0x4a5202
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0xb
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x104], eax
mov byte [ebp - 0x100], 6
mov eax, dword [ebp - 0xa8]
and eax, 0xffff
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0
lea edx, [ebp - 0x10c]
mov ecx, 2
mov eax, 0x4a5450
call fcn.00409ee0
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0xc]
call fcn.00403c8c
jmp 0x4a5202
cmp dword [ebp - 0xb0], 4
jne 0x4a519d
cmp dword [ebp - 0xac], 0
jne 0x4a519d
lea eax, [ebp - 0xc]
mov edx, 0x4a5468
call fcn.00403c8c
cmp byte [ebp - 0x9f], 0x43
jne 0x4a5202
lea eax, [ebp - 0xc]
mov edx, 0x4a5488
call fcn.00403e7c
jmp 0x4a5202
cmp dword [ebp - 0xb0], 4
jne 0x4a51d4
cmp dword [ebp - 0xac], 0xa
jne 0x4a51d4
lea eax, [ebp - 0xc]
mov edx, 0x4a5498
call fcn.00403c8c
cmp byte [ebp - 0x9f], 0x41
jne 0x4a5202
lea eax, [ebp - 0xc]
mov edx, 0x4a54b8
call fcn.00403e7c
jmp 0x4a5202
cmp dword [ebp - 0xb0], 4
jne 0x4a5202
cmp dword [ebp - 0xac], 0x5a
jne 0x4a5202
lea eax, [ebp - 0xc]
mov edx, 0x4a54c4
call fcn.00403c8c
jmp 0x4a5202
lea eax, [ebp - 0xc]
mov edx, 0x4a54e4
call fcn.00403c8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5220
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00403c48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a526b
lea eax, [ebp - 0xf4]
call fcn.00403bf4
lea eax, [ebp - 0xc8]
mov edx, 5
call fcn.00403c18
lea eax, [ebp - 0x14]
call fcn.00403bf4
lea eax, [ebp - 0xc]
call fcn.00403bf4
ret