Function at 0x4e4fc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xb4], edx
mov dword [ebp - 0xc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4e5375
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004041a8
push 0x4e5384
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jbe 0x4e534f
xor eax, eax
push ebp
push 0x4e5348
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4e5394
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
mov edi, ebx
test ebx, ebx
je 0x4e5331
lea eax, [ebp - 0xac]
xor ecx, ecx
mov edx, 0x9c
call fcn.00402d68
mov dword [ebp - 0xac], 0x9c
lea eax, [ebp - 0xac]
push eax
call edi
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4e50a0
lea eax, [ebp - 0xac]
xor ecx, ecx
mov edx, 0x94
call fcn.00402d68
mov dword [ebp - 0xac], 0x94
lea eax, [ebp - 0xac]
push eax
call edi
test eax, eax
jne 0x4e50a0
call fcn.0040dbac
mov eax, dword [ebp - 0x9c]
dec eax
je 0x4e52bf
dec eax
jne 0x4e5331
mov eax, dword [ebp - 0xa8]
add eax, 0xfffffffd
sub eax, 2
jb 0x4e50cd
je 0x4e51d8
jmp 0x4e5331
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x4e53a4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x10], 0x14
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004047f4
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x4e53d4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.004047f4
lea edx, [ebp - 0xb4]
mov eax, dword [ebp - 0xc]
call fcn.00408644
mov eax, dword [ebp - 0xb4]
lea edx, [ebp - 0xb0]
call fcn.004083f4
mov eax, dword [ebp - 0xb0]
mov edx, 0x4e53e8
call fcn.004045b4
jne 0x4e5178
cmp dword [ebp - 0xa8], 3
jne 0x4e516c
mov eax, esi
mov edx, 0x4e53f8
call fcn.004041fc
jmp 0x4e5178
mov eax, esi
mov edx, 0x4e540c
call fcn.004041fc
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0xc]
call fcn.00408644
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.004083f4
mov eax, dword [ebp - 0xb8]
mov edx, 0x4e5420
call fcn.004045b4
jne 0x4e5331
cmp dword [ebp - 0xa8], 3
jne 0x4e51c7
mov eax, esi
mov edx, 0x4e5434
call fcn.004041fc
jmp 0x4e5331
mov eax, esi
mov edx, 0x4e5448
call fcn.004041fc
jmp 0x4e5331
mov eax, dword [ebp - 0xa4]
sub eax, 1
jb 0x4e51f5
je 0x4e526f
dec eax
je 0x4e52b1
jmp 0x4e5331
test bl, bl
je 0x4e5331
mov bl, byte [ebp - 0x12]
cmp bl, 1
jne 0x4e521f
mov ax, word [ebp - 0x14]
and ax, 0x200
cmp ax, 0x200
je 0x4e521f
mov eax, esi
mov edx, 0x4e545c
call fcn.004041fc
cmp bl, 3
jne 0x4e5331
mov eax, esi
mov edx, 0x4e5470
call fcn.004041fc
mov bx, word [ebp - 0x14]
mov eax, ebx
and ax, 0x80
cmp ax, 0x80
jne 0x4e5250
mov eax, esi
mov edx, 0x4e5484
call fcn.004041fc
and bx, 2
cmp bx, 2
jne 0x4e5331
mov eax, esi
mov edx, 0x4e5498
call fcn.004041fc
jmp 0x4e5331
test bl, bl
je 0x4e5331
cmp byte [ebp - 0x12], 1
jne 0x4e5331
mov ax, word [ebp - 0x14]
and ax, 0x200
cmp ax, 0x200
jne 0x4e52a0
mov eax, esi
mov edx, 0x4e54ac
call fcn.004041fc
jmp 0x4e5331
mov eax, esi
mov edx, 0x4e54c0
call fcn.004041fc
jmp 0x4e5331
mov eax, esi
mov edx, 0x4e54d4
call fcn.004041fc
jmp 0x4e5331
cmp dword [ebp - 0xa8], 4
jne 0x4e5331
mov eax, dword [ebp - 0xa4]
sub eax, 1
jb 0x4e52df
sub eax, 9
je 0x4e5302
sub eax, 0x50
je 0x4e5325
jmp 0x4e5331
mov eax, esi
mov edx, 0x4e54e4
call fcn.004041fc
cmp byte [ebp - 0x97], 0x43
jne 0x4e5331
mov eax, esi
mov edx, 0x4e54f4
call fcn.004041fc
jmp 0x4e5331
mov eax, esi
mov edx, 0x4e5508
call fcn.004041fc
cmp byte [ebp - 0x97], 0x41
jne 0x4e5331
mov eax, esi
mov edx, 0x4e5518
call fcn.004041fc
jmp 0x4e5331
mov eax, esi
mov edx, 0x4e5528
call fcn.004041fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e534f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e537c
lea eax, [ebp - 0xbc]
mov edx, 4
call fcn.004041cc
lea eax, [ebp - 0xc]
call fcn.004041a8
ret