Function at 0x4d9820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x48
mov eax, dword [0x526b24]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x54]
push ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov eax, dword [0x62271c]
push ebp
mov dword [ebx + 8], 0
mov dword [ebx], 0x4f5b70
mov dword [ebx + 4], 0
lea ebp, [eax*4]
mov ecx, dword fs:[0x2c]
push esi
mov esi, dword [esp + 0x64]
push edi
mov eax, dword [ecx + ebp]
mov edi, dword [esp + 0x60]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], esi
cmp byte [eax + 0x2198], 0
mov dword [esp + 0x2c], ebp
jne 0x4d9891
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx + ebp]
mov eax, dword [eax + 0x29c]
mov eax, dword [eax + 0x84]
or eax, 0x20019
push eax
push 0
push dword [esp + 0x24]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x4d9ae1
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push eax
lea eax, [esp + 0x28]
push eax
push edi
push esi
push dword [esp + 0x28]
call ebp
mov edi, eax
test edi, edi
jne 0x4d9ad3
mov eax, dword [esp + 0x20]
dec eax
cmp eax, 6
ja case.0x4d98ef.5
jmp dword [eax*4 + 0x4d9b90]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push esi
push dword [esp + 0x28]
call ebp
mov edi, eax
test edi, edi
jne 0x4d9ad3
mov eax, dword [esp + 0x24]
mov dword [ebx + 8], 1
mov dword [ebx], eax
mov dword [ebx + 4], edi
jmp 0x4d9ad3
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push 0
push 0
push esi
push dword [esp + 0x28]
call ebp
mov edi, eax
test edi, edi
jne 0x4d9ad3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4d9ad3
shr eax, 1
add eax, 2
push eax
push edi
push ebx
call fcn.004a29d0
add esp, 0xc
test eax, eax
je 0x4d9ad3
mov esi, dword [ebx]
lea eax, [esp + 0x10]
push eax
push esi
push edi
push edi
push dword [esp + 0x2c]
push dword [esp + 0x28]
call ebp
mov edi, eax
test edi, edi
jne 0x4d99c5
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4d99c5
shr eax, 1
xor ecx, ecx
mov dword [esi + eax*2], ecx
cmp dword [esp + 0x20], 7
jne 0x4d99ca
mov eax, esi
lea ecx, [edi + 0xa]
nop
cmp word [eax], 0
jne 0x4d99c0
cmp word [eax + 2], 0
mov word [eax], cx
je 0x4d99ca
add eax, 2
jmp 0x4d99b0
xor eax, eax
mov word [esi], ax
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4d99d0
sub esi, ecx
sar esi, 1
mov dword [ebx + 4], esi
jmp 0x4d9ad3
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push 0
push 0
push esi
push dword [esp + 0x28]
call ebp
mov edi, eax
test edi, edi
jne 0x4d9ad3
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4d9ad3
add eax, eax
push eax
push edi
push ebx
call fcn.004a29d0
add esp, 0xc
test eax, eax
je 0x4d9ad3
mov ecx, dword [ebx]
xor eax, eax
mov dword [esp + 0x18], ecx
mov word [ecx], ax
mov eax, dword [esp + 0x10]
lea ecx, [ecx + eax*2]
add ecx, eax
lea eax, [esp + 0x10]
push eax
push ecx
push edi
push edi
push esi
push dword [esp + 0x28]
mov dword [esp + 0x34], ecx
call ebp
mov edi, eax
test edi, edi
je 0x4d9a62
mov dword [ebx + 4], 0
jmp 0x4d9ad3
movups xmm0, xmmword [str.0123456789ABCDEF]
mov ax, word [0x506cd8]
xor edx, edx
mov ebp, dword [esp + 0x18]
xor esi, esi
movups xmmword [esp + 0x30], xmm0
mov word [esp + 0x50], ax
movups xmm0, xmmword [0x506cc8]
movups xmmword [esp + 0x40], xmm0
cmp dword [esp + 0x10], edx
jbe 0x4d9ac5
mov ebx, dword [esp + 0x1c]
movzx ecx, byte [edx + ebx]
inc edx
mov eax, ecx
shr ecx, 4
and eax, 0xf
movzx eax, word [esp + eax*2 + 0x30]
mov word [ebp + esi*2 + 2], ax
movzx eax, word [esp + ecx*2 + 0x30]
mov word [ebp + esi*2], ax
add esi, 2
cmp edx, dword [esp + 0x10]
jb 0x4d9a97
mov ebx, dword [esp + 0x28]
xor eax, eax
mov word [ebp + esi*2], ax
jmp 0x4d9ad3
mov edi, 0x65e
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x2c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp]
cmp byte [eax + 0x2198], 0
jne 0x4d9b00
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp]
mov eax, dword [eax + 0x29c]
mov dword [eax + 0x3c], edi
cmp edi, 2
jne 0x4d9b47
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x4d9b4b
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov dword [ebx], edx
mov dword [ebx + 4], eax
mov eax, dword [ecx + 8]
mov dword [ebx + 8], eax
cmp eax, 5
jne 0x4d9b7d
mov eax, dword [edx]
push edx
call dword [eax + 4]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.004ebadf
add esp, 0x48
ret
test edi, edi
je 0x4d9b7d
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp]
cmp byte [eax + 0x2198], 0
jne 0x4d9b6a
call fcn.004ebad3
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + ebp]
mov ecx, ebx
mov eax, dword [eax + 0x29c]
push dword [eax + 0x3c]
call fcn.0046fe00
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebadf
add esp, 0x48
ret