Function at 0x4e0490
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x653c63
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
lea ecx, [esi + 8]
mov dword [esi], vtable.CIDMSpider.0
call fcn.005e7ef0
xor ebx, ebx
mov dword [esp + 0x28], ebx
lea ecx, [esi + 0x150]
call fcn.00435bd0
mov byte [esp + 0x28], 1
lea ecx, [esi + 0x178]
call fcn.0051c4c0
mov byte [esp + 0x28], 2
lea ecx, [esi + 0x190]
call fcn.004274a0
mov byte [esp + 0x28], 3
lea ecx, [esi + 0x1b8]
call fcn.00538280
mov byte [esp + 0x28], 4
lea ecx, [esi + 0x308]
call fcn.00421ad0
mov byte [esp + 0x28], 5
lea ecx, [esi + 0x3a8]
call fcn.00510360
mov byte [esp + 0x28], 6
lea ecx, [esi + 0x3e4]
call fcn.004cd870
mov byte [esp + 0x28], 7
lea ecx, [esi + 0x3f4]
call fcn.004cd630
mov byte [esp + 0x28], 8
xor eax, eax
mov dword [esi + 0x42c], ebx
mov dword [esi + 0x434], ebx
mov word [esi + 0x430], ax
mov byte [esp + 0x28], 9
lea ecx, [esi + 0x438]
call fcn.00402500
mov byte [esp + 0x28], 0xa
lea ecx, [esi + 0x43c]
call fcn.00402500
mov byte [esp + 0x28], 0xb
lea ecx, [esi + 0x440]
call fcn.00402500
mov byte [esp + 0x28], 0xc
lea ecx, [esi + 0x444]
call fcn.00402500
mov byte [esp + 0x28], 0xd
lea ecx, [esi + 0x44c]
call fcn.00402500
mov byte [esp + 0x28], 0xe
lea ecx, [esi + 0x450]
call fcn.00402500
mov byte [esp + 0x28], 0xf
lea ecx, [esi + 0x458]
call fcn.00402500
mov byte [esp + 0x28], 0x10
lea ecx, [esi + 0x45c]
call fcn.00402500
mov byte [esp + 0x28], 0x11
mov dword [esi + 0x464], ebx
mov dword [esi + 0x468], ebx
mov dword [esi + 0x46c], ebx
mov byte [esp + 0x28], 0x12
xor ecx, ecx
mov dword [esi + 0x470], ebx
mov dword [esi + 0x478], ebx
mov word [esi + 0x474], cx
mov byte [esp + 0x28], 0x13
lea ecx, [esi + 0x47c]
call fcn.00402500
mov byte [esp + 0x28], 0x14
lea ecx, [esi + 0x484]
call fcn.00402500
mov byte [esp + 0x28], 0x15
push 0xa
lea ecx, [esi + 0x4a0]
call fcn.004ce180
mov byte [esp + 0x28], 0x16
lea ecx, [esi + 0x4c4]
call fcn.00402500
mov byte [esp + 0x28], 0x17
lea ecx, [esi + 0x4c8]
call fcn.00402500
mov byte [esp + 0x28], 0x18
xor edx, edx
mov dword [esi + 0x4d0], ebx
mov dword [esi + 0x4d8], ebx
mov word [esi + 0x4d4], dx
mov byte [esp + 0x28], 0x19
lea ecx, [esi + 0x500]
call fcn.00402500
mov byte [esp + 0x28], 0x1a
lea ecx, [esi + 0x524]
call fcn.004ce210
mov byte [esp + 0x28], 0x1b
lea ecx, [esi + 0x538]
call fcn.004ce2b0
mov byte [esp + 0x28], 0x1c
mov byte [esi + 0x4bd], bl
mov byte [esi + 0x4be], bl
mov byte [esi + 0x4bf], bl
mov byte [esi + 0x4bc], bl
mov dword [esi + 0x4cc], ebx
mov dword [esi + 0x49c], ebx
mov byte [esi + 0x489], bl
mov dword [esi + 0x504], 1
mov dword [esi + 0x508], ebx
mov byte [esi + 0x448], bl
mov byte [esi + 0x454], bl
mov byte [esi + 0x460], bl
mov byte [esi + 0x4dd], 1
mov byte [esi + 0x550], bl
mov dword [esi + 0x4e0], ebx
mov dword [esi + 0x4e4], ebx
mov dword [esi + 0x4e8], ebx
mov dword [esi + 0x4ec], ebx
mov dword [esi + 0x4f0], ebx
mov dword [esi + 0x4f4], ebx
mov dword [esi + 0x4f8], ebx
mov dword [esi + 0x4fc], ebx
mov byte [esi + 0x48b], bl
mov byte [esi + 0x404], bl
mov byte [esi + 0x405], bl
mov dword [esi + 0x51c], ebx
mov dword [esi + 0x520], ebx
mov dword [esi + 0x54c], ebx
mov dword [esi + 0x518], 1
mov byte [esi + 0x48a], bl
mov byte [esi + 0x4dc], bl
mov byte [esi + 0x514], bl
mov dword [esi + 0x50c], ebx
mov dword [esi + 0x510], ebx
mov dword [esi + 0x48c], ebx
mov dword [esi + 0x490], ebx
lea eax, [esi + 0x408]
push eax
mov byte [esi + 0x496], bl
mov byte [esi + 0x494], bl
mov byte [esi + 0x495], bl
mov byte [esi + 0x497], bl
mov byte [esi + 0x498], bl
mov dword [esi + 0x420], ebx
mov dword [esi + 0x428], ebx
mov dword [esi + 0x554], ebx
mov dword [esi + 0x55c], ebx
mov dword [esi + 0x558], ebx
mov dword [esi + 0x560], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, esi
call fcn.004d84d0
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
call edi
test eax, eax
jne 0x4e083b
mov edx, dword [esp + 0x10]
push 4
push 0x68dbc0
push 1
push ebx
push str.Disable_Script_Debugger
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerInternational
push 0x80000001
mov dword [esi + 0x598], 1
call edi
test eax, eax
jne 0x4e08bb
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push ebx
push str.W2KLpk
push ecx
mov dword [esp + 0x30], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4e0892
mov edx, dword [esp + 0x14]
mov dword [esi + 0x598], edx
mov ecx, dword [esp + 0x10]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push ebx
push str.W2KLpk
push ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.004e0300
mov dword [esp + 0x28], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret