Function at 0x4d119c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xac0
mov eax, 0x554072
call fcn.00514880
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x26c]
mov ebx, dword [ebp + 0x18]
mov esi, str.Pp2LlAS8YzEe5JMxggMYfNuFd56XyZjqpUvurYpJ8sBZJVP8kSASHEtaguD9lPs7XMEfUSwIAOB3sSDdSK4XlThgqYXM88cscCEjCDB6DOMinEkKLVpcxD0cDciLOPTaqHI51qU4CFiHYTQgiswVI8oHseXmLYnUbJ01AcTr3WqfNip8RMNxxtNrdVSKtxyqZHfujzdCvnA2o8RRGy4FDn09CktWtObXtG0yuo8pmGedV6BmIQDnTfoOjikqHOdEjsQ3PtkBBbGRT5phleu0Og5IYunLxoLpZOc5z6VTKrG3MmMr9vZym2JqaqK4rylF1FaDMvPIW7VtylwF1QrqieBlNvsspoGY7qyGnrHTe5W2ar8
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp + 0xc]
push 0x5c
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp + 0x10]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac0], eax
lea edi, [ebp - 0xfc]
mov eax, dword [ebp + 0x14]
mov esi, str.TjpEH37z3MzC22EcMXqySnhYTCQTxDbcNzwTO7ycBFt0Mytt2JvJpqZhbh1Ro9E2L3WD9j2fNbhb5JubnHH43xktWbA7LeR1DRI2DgeuRF7Iz9LFzjH9N9MwoeH5DyOTQyqk9SOe5UasPr8fjjYLGiRdDhk2qD9bwoHRdIlvpjmw6abriAf8mivOn1KBQMO2yyyjEYGSSSgwRiMqIQPnruzlrUT6Jpv5D9oSlcTWqyX
push 0x3b
mov dword [ebp - 0xac8], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xacc], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xab0], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xa9c]
lea eax, [ebp - 0x26c]
push eax
call fcn.004057d0
lea eax, [ebp - 0xa9c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xab8]
call fcn.00407f90
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0xa9c]
push edi
call fcn.00479e2e
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.004057d0
lea eax, [ebp - 0xa9c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xab8]
call fcn.00407f90
push 0
push edi
lea ecx, [ebp - 0xa9c]
mov byte [ebp - 4], 0
call fcn.00479e2e
push ebx
lea ecx, [ebp - 0xa84]
call fcn.004024f0
lea eax, [ebp - 0xaac]
mov byte [ebp - 4], 3
push eax
xor ebx, ebx
mov esi, 0xf013f
push esi
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xaa4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4d12e3
mov ecx, dword [ebp - 0xaa0]
lea eax, [ebp - 0xa84]
push eax
call fcn.00404610
jmp 0x4d13da
push ebx
lea eax, [ebp - 0xaa8]
push eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push ebx
push ebx
push ebx
push dword [ebp - 0xabc]
push dword [ebp - 0xaac]
call esi
test eax, eax
je 0x4d1316
push dword [ebp - 0xaac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d12cc
push ebx
lea eax, [ebp - 0xaa4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0xac0]
push dword [ebp - 0xaa8]
call esi
test eax, eax
je 0x4d1354
push dword [ebp - 0xaa8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xaa4]
call esi
jmp 0x4d12cc
push 0x800
lea eax, [ebp - 0xa6c]
push ebx
push eax
call fcn.004f14e0
add esp, 0xc
mov dword [ebp - 0xac4], 0x400
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0xa6c]
push eax
push ebx
push ebx
push dword [ebp - 0xac8]
push dword [ebp - 0xaa4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xaa4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xaa8]
call esi
push dword [ebp - 0xaac]
call esi
lea eax, [ebp - 0xa6c]
push eax
call fcn.005017a9
pop ecx
mov ecx, dword [ebp - 0xaa0]
test eax, eax
je 0x4d12d2
lea eax, [ebp - 0xa6c]
push eax
call fcn.004024f0
push ebx
push edi
lea ecx, [ebp - 0xa84]
call fcn.00402590
lea ecx, [ebp - 0xab8]
call fcn.00479e80
mov eax, dword [ebp - 0xaa0]
call fcn.0051483b
ret