Function at 0x4ddf50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54ea0b
mov eax, dword fs:[0]
push eax
sub esp, 0x5d4
mov eax, dword [0x582654]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x170]
push 0x104
xorps xmm0, xmm0
mov dword [ebp - 0x59c], edi
push 0
push eax
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0x594], 0
mov dword [ebp - 0x590], 0
mov byte [ebp - 0x6c], 0
movups xmmword [ebp - 0x6b], xmm0
mov dword [ebp - 0x53], 0
movq qword [ebp - 0x5b], xmm0
mov word [ebp - 0x4f], 0
mov byte [ebp - 0x4d], 0
call fcn.00527170
add esp, 0xc
mov dword [ebp - 0x598], 0
xorps xmm0, xmm0
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x180]
mov word [ebp - 0x3b], 0
movups xmmword [ebp - 0x4b], xmm0
push eax
mov byte [ebp - 0x39], 0
movups xmmword [ebp - 0x180], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x174]
push eax
movzx eax, word [ebp - 0x176]
push eax
movzx eax, word [ebp - 0x178]
push eax
movzx eax, word [ebp - 0x17a]
push eax
movzx eax, word [ebp - 0x17e]
push eax
movzx eax, word [ebp - 0x180]
push eax
push 0x57e768
call fcn.004d9ef0
add esp, 4
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0041f000
add esp, 0x20
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x58c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x57e78c
call fcn.004d9ef0
add esp, 4
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x594], 2
jne 0x4de2b5
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0x20
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
push 0x57e7c8
call fcn.004d9ef0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 4
push eax
push dword [ebp - 0x58c]
call esi
test eax, eax
jne 0x4de2b5
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 4
push eax
lea eax, [ebp - 0x598]
push eax
push 0
push 0
push 0x57e7dc
call fcn.004d9ef0
add esp, 4
push eax
push dword [ebp - 0x58c]
call esi
test eax, eax
jne 0x4de2b5
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.004d9bc0
add esp, 8
test eax, eax
jne 0x4de2b5
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x598]
jne 0x4de2b5
lea eax, [ebp - 0x590]
mov dword [ebp - 0x590], 0x104
push eax
lea eax, [ebp - 0x170]
xor edi, edi
push eax
push edi
push edi
push 0x57e7ec
call fcn.004d9ef0
add esp, 4
push eax
push dword [ebp - 0x58c]
call esi
test eax, eax
jne 0x4de2b7
mov byte [ebp - 0x18], al
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x170]
push 4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004d9c40
lea eax, [ebp - 0x18]
push eax
call fcn.00533527
mov esi, eax
mov byte [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1f], eax
mov word [ebp - 0x1b], ax
mov byte [ebp - 0x19], al
lea eax, [ebp - 0x16b]
push 2
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004d9c40
lea eax, [ebp - 0x20]
push eax
call fcn.00533527
mov dword [ebp - 0x5a0], eax
xor eax, eax
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x168]
push 2
push eax
lea eax, [ebp - 0x28]
mov byte [ebp - 0x28], 0
push eax
call fcn.004d9c40
lea eax, [ebp - 0x28]
push eax
call fcn.00533527
mov dword [ebp - 0x5a4], eax
xor eax, eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
lea eax, [ebp - 0x165]
push 2
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 0x30], 0
push eax
call fcn.004d9c40
lea eax, [ebp - 0x30]
push eax
call fcn.00533527
add esp, 0x40
mov dword [ebp - 0x5a8], eax
xor eax, eax
mov byte [ebp - 0x38], 0
mov dword [ebp - 0x37], eax
mov word [ebp - 0x33], ax
mov byte [ebp - 0x31], al
lea eax, [ebp - 0x162]
push 2
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004d9c40
lea eax, [ebp - 0x38]
push eax
call fcn.00533527
movzx ecx, word [ebp - 0x180]
add esp, 0x10
mov edx, eax
cmp esi, ecx
jne 0x4de2b7
movzx ecx, word [ebp - 0x17e]
cmp dword [ebp - 0x5a0], ecx
jne 0x4de2b7
movzx ecx, word [ebp - 0x17a]
cmp dword [ebp - 0x5a4], ecx
jne 0x4de2b7
movzx eax, word [ebp - 0x178]
sub eax, dword [ebp - 0x5a8]
mov ecx, eax
shl ecx, 4
sub ecx, eax
movzx eax, word [ebp - 0x176]
shl ecx, 2
sub ecx, edx
add ecx, eax
cmp ecx, 0x14
jae 0x4de2b7
mov edi, 1
jmp 0x4de2b7
xor edi, edi
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
push 0x57e7dc
call fcn.004d9ef0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 4
push eax
push dword [ebp - 0x58c]
call esi
push dword [ebp - 0x59c]
call fcn.004d9c20
add esp, 4
push eax
push dword [ebp - 0x59c]
push 1
push 0
push 0x57e7c8
call fcn.004d9ef0
add esp, 4
push eax
push dword [ebp - 0x58c]
call esi
push 0x14
lea eax, [ebp - 0x4c]
push eax
push 1
push 0
push 0x57e7ec
call fcn.004d9ef0
add esp, 4
push eax
push dword [ebp - 0x58c]
call esi
push dword [ebp - 0x58c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x5e0]
call fcn.004e6750
push 0x408
lea eax, [ebp - 0x588]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.004d9af0
add esp, 0xc
lea eax, [ebp - 0x588]
lea ecx, [ebp - 0x5e0]
push eax
call fcn.004e71e0
cmp dword [ebp - 0x588], 0x64
lea ecx, [ebp - 0x5e0]
mov eax, 1
cmove edi, eax
call fcn.00429420
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052388c
mov esp, ebp
pop ebp
ret 8