Function at 0x4edfd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x524
mov eax, dword [0x6aae14]
xor eax, esp
mov dword [esp + 0x520], eax
push ebx
mov ebx, dword [esp + 0x534]
push ebp
mov ebp, dword [esp + 0x534]
push esi
mov esi, dword [esp + 0x540]
push edi
mov edi, dword [esp + 0x538]
push 0x103
lea eax, [esp + 0x21]
push 0
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x28], 0
call fcn.005dfd60
add esp, 0xc
test edi, edi
je 0x4ee391
push 0x60c810
push edi
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4ee051
push 0x60cf28
push edi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4ee266
push 0x648d90
push ebp
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4ee266
cmp dword [0x74ac8c], 0
jne 0x4ee318
push 0x103
lea ecx, [esp + 0x229]
push 0
push ecx
mov byte [esp + 0x230], 0
call fcn.005dfd60
push 0x207
lea edx, [esp + 0x339]
push 0
push edx
mov byte [esp + 0x340], 0
call fcn.005dfd60
push 0x103
lea eax, [esp + 0x13d]
push 0
push eax
mov byte [esp + 0x144], 0
call fcn.005dfd60
add esp, 0x24
push 0x208
lea ecx, [esp + 0x32c]
push ecx
push 0
mov dword [0x74ac8c], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea edx, [esp + 0x228]
push edx
lea eax, [esp + 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x4ee11f
lea ecx, [esp + 0x224]
push ecx
lea edx, [esp + 0x32c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x330]
push ecx
call fcn.004ec3a0
lea edx, [esp + 0x12c]
push 0
push edx
call fcn.004e8c10
lea eax, [esp + 0x134]
push eax
push 0x648d84
push 0x74ac90
call fcn.005dfb23
push 1
push 0
push 0
push 0
push 0
push 0x74ac90
call fcn.004e8950
add esp, 0x38
test eax, eax
jne 0x4ee1f3
test esi, esi
je 0x4ee1d8
test ebp, ebp
je 0x4ee1d8
push 0x648d70
push ebp
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x4ee1d8
push 0x648d70
push ebp
call fcn.005f095a
add esp, 8
push 0x74ac90
test eax, eax
jne 0x4ee32a
mov ecx, dword [esp + 0x54c]
push ecx
push esi
push ebx
push ebp
push edi
call fcn.004e8560
add esp, 0x18
cmp byte [esi], 0
jne 0x4ee3ad
mov dword [0x74ac8c], 0
jmp 0x4ee3ad
mov eax, dword [esp + 0x548]
push 0x74ac90
push eax
push esi
push ebx
push ebp
push edi
call fcn.004e8560
jmp 0x4ee3aa
cmp byte [0x74a9f8], 0
je 0x4ee25f
push 0x74a9f8
push 0x74ac90
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x74ac90
call fcn.004e24e0
add esp, 4
push 0x6157e0
push 0x74ac90
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 0
push 0
push 0
push 0
push 0x74ac90
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x4ee25f
mov ecx, dword [esp + 0x548]
push 0x74ac90
push ecx
push esi
push ebx
push ebp
push edi
call fcn.004e8560
jmp 0x4ee3aa
mov byte [0x74ac90], 0
call fcn.004d8e50
test eax, eax
je 0x4ee391
push 0x648d54
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
lea edx, [esp + 0x28]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x4ee38d
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x66da34
lea ecx, [esp + 0x20]
push ecx
call ebx
push edi
lea edx, [esp + 0x20]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
push 1
push 0
lea ecx, [esp + 0x28]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x4ee33d
mov edx, dword [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.004e1290
push esi
call fcn.004dd6c0
add esp, 8
jmp 0x4ee3ad
cmp byte [0x74ac90], 0
je 0x4ee266
push 0x74ac90
mov edx, dword [esp + 0x54c]
push edx
push esi
push ebx
push ebp
push edi
call fcn.004e8560
jmp 0x4ee3aa
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x548]
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
push 0
push ebp
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4ee377
mov eax, dword [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call fcn.004e1290
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.004dd6c0
add esp, 4
jmp 0x4ee3ad
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x54c]
mov eax, dword [esp + 0x548]
push edx
push eax
push esi
push ebx
push ebp
push edi
call fcn.004ec080
add esp, 0x18
mov ecx, dword [esp + 0x530]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005dfbbe
add esp, 0x524
ret