Function at 0x4487e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0x7e2
cmp dword [ebp - 0x110], 0x7f8
jge 0x448870
mov eax, dword [ebp - 0x110]
push eax
push str._dRevu
push 0xfa
lea eax, [ebp - 0x210]
push eax
call fcn.00452660
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0042fa7e
add esp, 8
test eax, eax
je 0x448865
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], 0x270f
inc dword [ebp - 0x110]
jmp 0x448804
cmp dword [ebp - 0x114], 0
jne 0x448882
jmp 0x448af3
lea edi, [ebp - 0x108]
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x114]
push eax
push str.SOFTWAREBluebeam_Software_dLicenses
push 0xfa
lea eax, [ebp - 0x210]
push eax
call fcn.00452660
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
cmp dword [0x462284], 1
mov eax, 0
adc eax, 0xffffffff
and eax, 0x100
or eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x448af3
mov dword [ebp - 4], 0x80
lea edi, [ebp - 0x88]
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push str.Registered
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4489c5
movsx eax, byte [ebp - 0x108]
test eax, eax
jne 0x44895e
mov eax, 0x47e4e4
lea ecx, [ebp - 0x108]
mov edx, dword [eax]
mov dword [ecx], edx
mov dx, word [eax + 4]
mov word [ecx + 4], dx
mov al, byte [eax + 6]
mov byte [ecx + 6], al
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x47e4ec]
mov dword [edi - 1], eax
lea edi, [ebp - 0x88]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x47e4f0]
mov word [edi - 1], ax
mov dword [ebp - 4], 0x80
lea edi, [ebp - 0x88]
xor eax, eax
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push 0x47e4f4
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x448aa3
movsx eax, byte [ebp - 0x108]
test eax, eax
jne 0x448a2e
mov eax, str.REVU
lea ecx, [ebp - 0x108]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov al, byte [eax + 8]
mov byte [ecx + 8], al
mov edx, str.Edition
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov al, byte [edx + 8]
mov byte [edi + 8], al
lea edi, [ebp - 0x88]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x47e514]
mov word [edi - 1], ax
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movsx eax, byte [ebp - 0x108]
test eax, eax
je 0x448af3
lea edi, [ebp - 0x108]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, edi
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov esi, edx
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
leave
ret