Function at 0x4c27d0
Capabilities:
Query or enumerate registry value

Disassembly:
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x4c2698
jns 0x4c2652
add byte [edx], al
inc eax
adc al, byte [eax]
add al, byte [eax]
pop es
push eax
popal
je 0x4c26c5
dec ebx
jns 0x4c2663
add byte [edx], al
inc eax
adc al, byte [eax]
or al, 0
pop es
push esi
popal
insb byte es:[edi], dx
dec esi
popal
insd dword es:[edi], dx
add al, byte gs:[eax]
add byte [eax], al
adc byte [eax], al
or byte [eax], al
adc dword [ecx + 0x73], ecx
push edx
push edx
imul esi, dword fs:[edx + 0x65], 0x726f7463
dec edi
outsb dx, byte [esi]
add al, byte [eax]
add al, byte [eax]
jp 0x4c2692
push eax
sub eax, 0x471c004c
je 0x4c26ed
push ebx
push 0x4a746669
imul esi, dword [ebx + 0x53], 0x6e697274
inc edx
jns 0x4c26f0
imul ebp, dword [esi + 0x61], 0x37972
inc eax
adc al, byte [eax]
adc byte [eax], al
add eax, 0
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
add bh, ah
mov edx, 0x10040
pop es
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x4c2722
jns 0x4c26dc
add byte [edx], al
inc eax
adc al, byte [eax]
add al, byte [eax]
pop es
push eax
popal
je 0x4c274f
dec ebx
jns 0x4c26ed
add byte [edx], al
inc eax
adc al, byte [eax]
or al, 0
add byte [eax + eax], cl
pop es
push esi
popal
insb byte es:[edi], dx
dec esi
popal
insd dword es:[edi], dx
add al, byte gs:[eax]
inc eax
inc eax
adc al, byte [eax]
or byte [eax], al
add dword [ecx], eax
add al, byte [eax]
add al, byte [eax]
jle 0x4c270c
dec eax
dec esp
add byte [ebx + edx*2], bl
je 0x4c2767
push ebx
push 0x4a746669
imul esi, dword [ebx + 0x53], 0x6e697274
inc edx
jns 0x4c276a
imul ebp, dword [esi + 0x67], 0x69427942
outsb dx, byte [esi]
popal
jb 0x4c27a6
imul ebp, dword [esi + 0x61], 0x37972
add eax, dword [eax]
add byte [eax], dl
inc eax
add byte [eax], dl
add byte [0], al
add byte [eax], al
add byte [ebx + edx*2], al
insb byte es:[edi], dx
add al, byte [eax]
add bh, ah
mov edx, 0x10040
pop es
push edx
outsd dx, dword [esi]
outsd dx, dword [esi]
je 0x4c279c
jns 0x4c2756
add byte [edx], al
inc eax
adc al, byte [eax]
add al, byte [eax]
pop es
push eax
popal
je 0x4c27c9
dec ebx
jns 0x4c2767
add byte [edx], al
inc eax
adc al, byte [eax]
or al, 0
add byte [eax + eax], cl
pop es
push esi
popal
insb byte es:[edi], dx
dec esi
popal
insd dword es:[edi], dx
add al, byte gs:[eax]
add byte [edx + edx + 0x40], ah
add byte [eax], cl
add byte [0x756c6156], al
add al, byte gs:[eax]
add al, byte [eax]
inc ebx
add byte [eax + esi + 0x4c], al
add byte [ecx], cl
dec eax
dec ebx
inc ebp
pop ecx
push esp
outsd dx, dword [esi]
push ebx
je 0x4c280a
add eax, dword [eax]
inc eax
adc al, byte [eax]
or byte [eax], al
add eax, dword [eax]
add byte [eax], al
add byte [eax], al
inc eax
add byte [eax], cl
add byte [ebx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + edx*2], al
add byte [eax], al
add al, 0x53
insb byte es:[edi], dx
add al, byte [eax]
add bh, ah
mov edx, 0x10040
add eax, 0x654b6e69
jns 0x4c27bf
add byte [eax + 0x40], al
inc eax
adc al, byte [eax]
add al, byte [eax]
add dword [ecx], eax
add al, byte [eax]
add al, byte [eax]
nop
shl byte [edi], 1
dec esp
add byte [edi], al
or byte [edx + edx*2 + 0x65], dl
inc esi
jne 0x4c2847
arpl word [eax + 0x24], dx
dec esp
add byte [eax], al
sbb al, 0x40
add byte [eax], al
add byte [edi], al
push edx
inc esi
jne 0x4c2859
arpl word [eax], ax
add byte [eax], al
add byte [edx], al
add byte [ebx - 0x1374aa40], cl
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.00407248
call fcn.004bcbb0
cmp byte [eax + 0x24], 0
je 0x4c2857
shr al, cl
cmp byte [edx - 0xc], cl
invalid
cmp byte [ebp + 0xc], 0
je 0x4c283c
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
mov eax, edi
call fcn.004072d4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
jmp 0x4c2870
lea eax, [ebp - 4]
push eax
push 0x20119
push 0
mov eax, edi
call fcn.004072d4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
jmp 0x4c2870
lea eax, [ebp - 4]
cld
push eax
push 0x20019
push 0
mov eax, edi
call fcn.004072d4
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4c28e1
xor edx, edx
push ebp
push 0x4c28da
push dword fs:[edx]
mov dword fs:[edx], esp
mov dword [ebp - 0xc], 0x1ff
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20b]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp + 0x10]
call fcn.004072d4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4c28c3
mov ecx, dword [ebp - 0xc]
shr ecx, 1
dec ecx
lea edx, [ebp - 0x20b]
mov eax, ebx
call fcn.00407384
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c28e1
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc