Function at 0x4c766c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x43
push 0
push 0
dec ecx
jne 0x4c7674
lea eax, [ebp - 0x1e0]
mov edx, dword [0x407938]
call fcn.00404bac
xor eax, eax
push ebp
push 0x4c7e65
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c7c9a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x51d2a0], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x51d2a8]
call fcn.0040413c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jne 0x4c76b9
mov dword [0x51d2a4], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4c7e70
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4c77cc
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x4c77d3
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4c77d3
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404788
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004045fc
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.004045fc
mov edx, 0x4c7e80
mov ecx, 4
call fcn.004088b8
test eax, eax
je 0x4c77a9
mov eax, dword [ebp - 0xc]
call fcn.004045fc
mov edx, 0x4c7e88
mov ecx, 4
call fcn.004088b8
test eax, eax
jne 0x4c77be
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404788
push ebp
mov eax, dword [ebp - 0xc]
call fcn.004c71a4
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4c773f
jmp 0x4c77d3
push ebp
call fcn.004c75d4
pop ecx
cmp dword [0x51d2a0], 0
jle 0x4c77e3
push ebp
call fcn.004c7374
pop ecx
cmp dword [0x51d274], 0
jne 0x4c784b
mov dword [ebp - 8], 0x64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4c7e90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c784b
lea eax, [ebp - 0x1e8]
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.004043ac
mov eax, dword [ebp - 0x1e8]
lea edx, [ebp - 0x1e4]
call fcn.004088d8
mov edx, dword [ebp - 0x1e4]
mov eax, 0x51d274
call fcn.00404190
cmp dword [0x51d274], 0
je 0x4c78d9
lea edx, [ebp - 0x1ec]
mov eax, dword [0x51d274]
call fcn.004094fc
mov edx, dword [ebp - 0x1ec]
mov eax, 0x51d298
call fcn.00404190
lea eax, [ebp - 0x1f4]
push eax
mov eax, dword [0x51d298]
call fcn.004043fc
mov edx, eax
sub edx, 3
mov ecx, 4
mov eax, dword [0x51d298]
call fcn.0040465c
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.00408788
mov eax, dword [ebp - 0x1f0]
mov edx, 0x4c7ea0
call fcn.00404548
jne 0x4c78d9
mov eax, dword [0x51d298]
call fcn.004043fc
mov edx, eax
sub edx, 4
mov eax, 0x51d298
call fcn.00404788
cmp dword [0x51d274], 0
jne 0x4c7c38
cmp dword [0x51d29c], 0
jne 0x4c7997
cmp dword [0x51d2a0], 0
jle 0x4c791e
cmp dword [0x51d2a4], 0xffffffff
je 0x4c791e
mov eax, 0x51d298
mov edx, dword [0x51d2a4]
mov edx, dword [edx*4 + 0x51d2a8]
call fcn.00404190
jmp 0x4c7928
mov eax, 0x51d298
call fcn.0040413c
cmp dword [0x51d298], 0
jne 0x4c7979
mov dword [ebp - 8], 0x64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4c7ea8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c7979
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x86], 0
mov eax, 0x51d298
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.004043ac
cmp dword [0x51d298], 0
jne 0x4c7a13
mov eax, 0x51d274
mov edx, 0x4c7ebc
call fcn.00404190
jmp 0x4c7a13
mov eax, dword [0x51d2a0]
dec eax
test eax, eax
jl 0x4c79ee
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [0x51d29c]
call fcn.004045fc
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x51d2f8]
call fcn.004045fc
pop edx
call fcn.00408878
test eax, eax
jne 0x4c79e6
mov eax, 0x51d298
mov edx, dword [ebp - 0x14]
mov edx, dword [edx*4 + 0x51d2a8]
call fcn.00404190
jmp 0x4c79ee
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x4c79ac
cmp dword [0x51d298], 0
jne 0x4c7a13
mov eax, 0x51d274
mov ecx, dword [0x51d29c]
mov edx, 0x4c7ecc
call fcn.00404448
push ebp
call fcn.004c75d4
pop ecx
cmp dword [0x51d298], 0
je 0x4c7c38
lea eax, [ebp - 0x10]
call fcn.0040413c
mov eax, dword [0x51d298]
call fcn.004043fc
mov edx, dword [0x51d298]
cmp byte [edx + eax - 1], 0x5c
jne 0x4c7a56
mov eax, dword [0x51d298]
call fcn.004043fc
mov edx, eax
dec edx
mov eax, 0x51d298
call fcn.00404788
push dword [0x51d298]
push 0x4c7ed8
push 0x4c7ebc
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.004044bc
mov eax, dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.0040930c
test eax, eax
jne 0x4c7abf
push dword [0x51d298]
push 0x4c7ed8
push 0x4c7ebc
mov eax, 0x51d274
mov edx, 3
call fcn.004044bc
lea eax, [ebp - 0x1e0]
call fcn.00409380
jmp 0x4c7bef
push dword [0x51d298]
push 0x4c7ee8
push 0x4c7ebc
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.004044bc
mov eax, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.0040930c
test eax, eax
jne 0x4c7b28
push dword [0x51d298]
push 0x4c7ee8
push 0x4c7ebc
mov eax, 0x51d274
mov edx, 3
call fcn.004044bc
lea eax, [ebp - 0x1e0]
call fcn.00409380
jmp 0x4c7bef
push dword [0x51d298]
push 0x4c7ed8
push 0x4c7ef4
lea eax, [ebp - 0x200]
mov edx, 3
call fcn.004044bc
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.0040930c
test eax, eax
jne 0x4c7bef
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x204]
xor edx, edx
mov eax, dword [ebp - 0x1d4]
call fcn.00409434
mov eax, dword [ebp - 0x204]
mov ecx, 6
mov edx, 4
call fcn.0040465c
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
add al, 0xd0
sub al, 0xa
jae 0x4c7bd5
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404548
jbe 0x4c7bd5
push dword [0x51d298]
push 0x4c7ed8
push dword [ebp - 0x1d4]
mov eax, 0x51d274
mov edx, 3
call fcn.004044bc
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004041d4
lea eax, [ebp - 0x1e0]
call fcn.0040935c
test eax, eax
je 0x4c7b66
lea eax, [ebp - 0x1e0]
call fcn.00409380
cmp dword [0x51d274], 0
jne 0x4c7c38
cmp dword [0x51d29c], 0
jne 0x4c7c12
mov eax, 0x51d274
mov edx, 0x4c7ebc
call fcn.00404190
jmp 0x4c7c38
push dword [0x51d298]
push 0x4c7ed8
push 0x4c7f08
mov eax, 0x51d274
mov edx, 3
call fcn.004044bc
push ebp
call fcn.004c75d4
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x4c7f0c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4c7c72
mov edx, 0x4c7f14
lea eax, [ebp - 0x85]
mov ecx, 3
call fcn.0040982c
test eax, eax
je 0x4c7c76
xor eax, eax
jmp 0x4c7c78
mov al, 1
mov byte [0x51d294], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c7ca1
cmp dword [ebp - 4], 0
je 0x4c7c99
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret