Function at 0x4af63c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7cc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x834], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4afa2c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xfffffffe
test esi, esi
je 0x4afa01
mov edi, esi
mov dword [ebp - 4], 0xfffffffc
test ebx, ebx
jl 0x4afa01
push esi
call fcn.004aed9c
cmp ebx, eax
jge 0x4afa01
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [edi + 0x34], 0
je 0x4af6f6
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [edi + 0x3e]
test eax, eax
je 0x4af6ca
cmp ebx, dword [ebp - 8]
jne 0x4af6c0
mov esi, eax
jmp 0x4af6ca
inc dword [ebp - 8]
mov eax, dword [eax + 0x44]
test eax, eax
jne 0x4af6b7
lea ecx, [ebp - 0x830]
mov dl, 1
mov eax, esi
call fcn.004ae45c
mov eax, dword [ebp - 0x830]
call fcn.00403fb4
mov edx, eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
call fcn.0040a018
jmp 0x4afa01
lea eax, [ebp - 9]
push eax
push ebx
push esi
call fcn.004afaf0
test eax, eax
jne 0x4af9f1
xor edx, edx
push ebp
push 0x4af9e7
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x4afa40
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4af9dd
xor edx, edx
push ebp
push 0x4af9d6
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x401
mov dword [ebp - 0x1c], 0x401
lea eax, [ebp - 0x429]
xor ecx, ecx
mov edx, 0x401
call fcn.00402bf4
lea eax, [ebp - 0x82a]
xor ecx, ecx
mov edx, 0x401
call fcn.00402bf4
jmp 0x4af98b
lea eax, [ebp - 0x830]
lea edx, [ebp - 0x429]
mov ecx, 0x401
call fcn.00403da0
mov edx, dword [ebp - 0x830]
mov eax, 0x4afa60
call fcn.004040d8
mov ebx, eax
test ebx, ebx
jle 0x4af956
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x82a]
call fcn.00404a20
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x834]
lea edx, [ebp - 0x429]
mov ecx, 0x401
call fcn.00403da0
mov eax, dword [ebp - 0x834]
lea edx, [ebx + 0xc]
mov ecx, 1
call fcn.00403ff4
mov eax, dword [ebp - 0x830]
mov al, byte [eax]
cmp al, byte [ebp - 9]
jne 0x4af956
mov edx, dword [ebp - 0x28]
mov eax, 0x4afa78
call fcn.004040d8
mov ebx, eax
test ebx, ebx
jle 0x4af956
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00403df0
mov ecx, eax
sub ecx, 0x2b
lea edx, [ebx + 4]
mov eax, dword [ebp - 0x28]
call fcn.00403ff4
cmp dword [ebp - 0x24], 0
je 0x4af899
mov edx, dword [ebp - 0x24]
mov eax, 0x4afa88
call fcn.004040d8
mov ebx, eax
test ebx, ebx
jle 0x4af85b
lea eax, [ebp - 0x24]
call fcn.00403fc0
mov byte [eax + ebx - 1], 0x2f
mov eax, dword [ebp - 0x24]
call fcn.00403df0
mov esi, eax
test esi, esi
jle 0x4af889
mov ebx, 1
mov eax, dword [ebp - 0x24]
cmp byte [eax + ebx - 1], 0x23
jne 0x4af885
lea eax, [ebp - 0x24]
call fcn.00403fc0
mov byte [eax + ebx - 1], 0x5c
inc ebx
dec esi
jne 0x4af86e
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4afa94
call fcn.00403e3c
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x24]
call fcn.00403fb4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4af956
xor edx, edx
push ebp
push 0x4af94f
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0x18], 0x401
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x429]
push eax
push 0
push 0
push 0x4afab4
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4af938
lea edx, [ebp - 0x429]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
call fcn.0040a018
mov edx, 0x4afac4
mov eax, dword [ebp + 0x10]
call fcn.0040a1c4
test eax, eax
je 0x4af921
sub eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
mov byte [edx + eax], 0
call fcn.0040366c
call fcn.0040366c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4afa01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af956
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 8]
mov dword [ebp - 0x18], 0x401
mov dword [ebp - 0x1c], 0x401
lea eax, [ebp - 0x429]
xor ecx, ecx
mov edx, 0x401
call fcn.00402bf4
lea eax, [ebp - 0x82a]
xor ecx, ecx
mov edx, 0x401
call fcn.00402bf4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x82a]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x429]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumValueA
cmp eax, 0x103
jne 0x4af783
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af9dd
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4af9f1
mov edx, 0x4afad8
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
call fcn.0040a018
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afa33
lea eax, [ebp - 0x834]
mov edx, 2
call fcn.00403b98
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403b98
ret