Function at 0x4b3c5d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push edx
push ecx
call fcn.004b42e3
add esp, 8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0xffffffff
je 0x4b3ea5
push 0x3fff
call fcn.00481917
add esp, 4
mov dword [ebp - 0xc], eax
push 4
call fcn.00481917
add esp, 4
mov dword [ebp - 0x18], eax
push 4
call fcn.00481917
add esp, 4
mov esi, eax
push 0
push 0
push esi
call fcn.00481ada
add esp, 0xc
push 0x3fff
push 0
push dword [ebp - 0x18]
call fcn.00481ada
add esp, 0xc
push ebx
call fcn.004719dc
add esp, 4
mov ebx, eax
push dword [ebp - 0x18]
call fcn.00481979
add esp, 4
push eax
push dword [ebp - 0xc]
call fcn.00481979
add esp, 4
push eax
push esi
call fcn.00481979
add esp, 4
push eax
push 0
push ebx
push dword [ebp - 0x24]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
push ebx
call fcn.00472474
add esp, 4
mov eax, edi
cmp eax, 0
jne 0x4b3e95
mov dword [ebp - 0x14], 0x4f45b8
push 0
push esi
call fcn.00481ac1
add esp, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 7
je 0x4b3d6f
cmp eax, 2
je 0x4b3df1
cmp eax, 1
je 0x4b3df1
cmp eax, 3
je 0x4b3df1
cmp eax, 4
je 0x4b3e4a
jmp 0x4b3e65
mov esi, 0
push 0
push dword [ebp - 0x18]
call fcn.00481ac1
add esp, 8
mov ebx, eax
sub ebx, 1
jmp 0x4b3deb
push esi
push dword [ebp - 0xc]
call fcn.00481a4b
add esp, 8
cmp eax, 0
jne 0x4b3dc4
push 0
push dword [ebp - 0x18]
call fcn.00481ac1
add esp, 8
sub eax, 1
cmp esi, eax
jne 0x4b3daf
jmp 0x4b3dc2
push 0x4f45e4
push dword [ebp - 0x14]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x4b3de8
push esi
push dword [ebp - 0xc]
call fcn.00481a4b
add esp, 8
push eax
call fcn.00470d59
add esp, 4
push eax
push dword [ebp - 0x14]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
add esi, 1
cmp esi, ebx
jle 0x4b3d88
jmp 0x4b3e65
mov esi, 0
push 0
push dword [ebp - 0x18]
call fcn.00481ac1
add esp, 8
mov ebx, eax
sub ebx, 1
jmp 0x4b3e44
push esi
push dword [ebp - 0xc]
call fcn.00481a4b
add esp, 8
cmp eax, 0
jne 0x4b3e1d
jmp 0x4b3e48
push esi
push dword [ebp - 0xc]
call fcn.00481a4b
add esp, 8
push eax
call fcn.00470d59
add esp, 4
push eax
push dword [ebp - 0x14]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
add esi, 1
cmp esi, ebx
jle 0x4b3e0a
jmp 0x4b3e65
push 0
push dword [ebp - 0xc]
call fcn.00481ac1
add esp, 8
push eax
call fcn.00470da5
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x4b3e65
cmp dword [ebp + 0x18], 0
je 0x4b3e93
push dword [ebp - 0x14]
push 0x4f45d4
push dword [ebp - 0x20]
call fcn.00470da5
add esp, 4
push eax
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x4b3e9a
mov dword [0x4f45b4], eax
push dword [ebp - 0x24]
call fcn.004b435e
add esp, 4
cmp dword [ebp - 0x20], 2
jne 0x4b4033
mov dword [ebp - 0x10], 0x4f45b8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov edi, 0x4f45b8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
jmp 0x4b3ff1
push 0x4f45f4
push 1
mov eax, dword [ebp - 8]
add eax, 1
push eax
push dword [ebp - 4]
call fcn.004ae858
add esp, 0xc
push eax
call fcn.004710d4
add esp, 8
cmp eax, 0
jne 0x4b3fca
mov eax, dword [ebp - 8]
add eax, 1
mov esi, eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
jmp 0x4b3fc0
mov dword [ebp - 8], esi
push 0x4f45f4
push 1
mov eax, esi
add eax, 1
push eax
push dword [ebp - 4]
call fcn.004ae858
add esp, 0xc
push eax
call fcn.004710d4
add esp, 8
cmp eax, 0
jne 0x4b3f9e
push edi
call fcn.0046eac6
add esp, 4
mov ebx, eax
push 0x4f45b8
push ebx
call fcn.004710d4
add esp, 8
cmp eax, 0
je 0x4b3f6c
push ebx
push dword [ebp - 0x10]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x10], eax
jmp 0x4b3f97
push 0x4f45f4
push edi
push 0x4f45f4
call fcn.00471226
add esp, 8
push eax
call fcn.00471226
add esp, 8
push eax
push dword [ebp - 0x10]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x10], eax
mov edi, 0x4f45b8
jmp 0x4b3fc8
push 1
mov eax, esi
add eax, 1
push eax
push dword [ebp - 4]
call fcn.004ae858
add esp, 0xc
push eax
push edi
call fcn.00471226
add esp, 8
mov edi, eax
add esi, 1
cmp esi, ebx
jle 0x4b3f14
jmp 0x4b3fed
push 1
mov eax, dword [ebp - 8]
add eax, 1
push eax
push dword [ebp - 4]
call fcn.004ae858
add esp, 0xc
push eax
push dword [ebp - 0x10]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x10], eax
add dword [ebp - 8], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
jle 0x4b3ed6
push 0x4f45b8
push edi
call fcn.004710d4
add esp, 8
cmp eax, 0
je 0x4b402d
push edi
push 0x4f45f4
call fcn.00471226
add esp, 8
push eax
push dword [ebp - 0x10]
call fcn.00471226
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x4b4038
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret