Function at 0x4cbd7c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, 0x53e150
mov ebx, 0x53e14c
xor edx, edx
push ebp
push 0x4cc048
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x53e174], 0
je 0x4cbf6e
mov eax, dword [ebx]
mov dword [ebp - 4], eax
jmp 0x4cbdc8
add dword [ebx], 0x1000
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov eax, 0x53e148
mov edx, dword [ebx]
call fcn.00402854
lea eax, [ebp - 4]
push eax
mov eax, dword [0x53e148]
push eax
push 0
push 0
push 0x4cc05c
push 0x80000004
call sub.advapi32.dll_RegQueryValueExA_1
cmp eax, 0xea
je 0x4cbdb1
mov eax, dword [0x53e148]
mov eax, dword [eax + 0x18]
add eax, dword [0x53e148]
mov dword [esi], eax
mov eax, dword [0x53e148]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
jle 0x4cbe1e
mov eax, dword [esi]
cmp dword [eax + 0xc], 0xee
je 0x4cbe1e
mov eax, dword [esi]
mov eax, dword [eax]
add eax, dword [esi]
mov dword [esi], eax
dec ecx
jne 0x4cbe08
mov eax, dword [esi]
cmp dword [eax + 0xc], 0xee
je 0x4cbe3f
mov ecx, 0x4cc068
mov dl, 1
mov eax, dword [0x407e28]
call fcn.0040cdbc
call fcn.00403e8c
cmp dword [0x53e158], 0
jge 0x4cbe76
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
mov dword [0x53e158], eax
mov eax, dword [0x53e158]
shl eax, 3
call fcn.00402814
mov dword [0x53e15c], eax
mov eax, dword [0x53e158]
shl eax, 3
call fcn.00402814
mov dword [0x53e160], eax
mov eax, dword [esi]
mov eax, dword [eax + 8]
add eax, dword [esi]
mov dword [0x53e154], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x20]
test ecx, ecx
jle 0x4cbeab
mov eax, dword [0x53e154]
cmp dword [eax + 4], 6
je 0x4cbeab
mov eax, dword [0x53e154]
mov eax, dword [eax]
add eax, dword [0x53e154]
mov dword [0x53e154], eax
dec ecx
jne 0x4cbe8b
mov eax, dword [0x53e154]
cmp dword [eax + 4], 6
je 0x4cbecc
mov ecx, 0x4cc0a4
mov dl, 1
mov eax, dword [0x407e28]
call fcn.0040cdbc
call fcn.00403e8c
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, dword [esi]
mov ecx, dword [0x53e158]
dec ecx
test ecx, ecx
jl 0x4cbf2d
inc ecx
xor ebx, ebx
mov esi, dword [eax]
add esi, eax
mov eax, dword [0x53e160]
mov edx, dword [0x53e15c]
mov edi, dword [edx + ebx*8]
mov dword [eax + ebx*8], edi
mov edi, dword [edx + ebx*8 + 4]
mov dword [eax + ebx*8 + 4], edi
mov eax, dword [0x53e154]
mov eax, dword [eax + 0x24]
add eax, esi
mov edx, dword [eax]
mov dword [ebp - 0x20], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov eax, dword [0x53e15c]
mov edx, dword [ebp - 0x20]
mov dword [eax + ebx*8], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + ebx*8 + 4], edx
mov eax, dword [esi]
add eax, esi
inc ebx
dec ecx
jne 0x4cbee1
mov eax, dword [0x53e164]
mov dword [0x53e16c], eax
mov eax, dword [0x53e168]
mov dword [0x53e170], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x53e148]
add eax, 0x24
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov eax, dword [ebp - 0xc]
mov dword [0x53e164], eax
mov eax, dword [ebp - 8]
mov dword [0x53e168], eax
jmp 0x4cc03e
cmp byte [0x53e175], 0
jne 0x4cc018
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
push 0x4cc0e0
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x4cbfaf
mov ecx, 0x4cc0fc
mov dl, 1
mov eax, dword [0x407e28]
call fcn.0040cdbc
call fcn.00403e8c
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push 0x53e178
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4cc124
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0x53e17c
push 0x20019
push 0
push 0x4cc134
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x4cc011
mov ecx, 0x4cc150
mov dl, 1
mov eax, dword [0x407e28]
call fcn.0040cdbc
call fcn.00403e8c
mov byte [0x53e175], 1
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
push 0x53e178
lea eax, [ebp - 0x18]
push eax
push 0
push 0x4cc124
mov eax, dword [0x53e17c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cc052
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret