Function at 0x4d0360
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xb88
mov eax, 0x5535d0
call fcn.00513ea1
push 0x65
pop ecx
mov esi, str.Y2KlAHFdm3iO87KqIY9zmpa8C5JXeFNk7JziCum12vJQ89oPzZL1NT6VNCH3OkM9fXEllBlSVbB1nfm1W1tCPs2y1AvOf2D6NnjvRbfyvA3XesDMByUs30ftYapAVQ1NGPuVG3ToleMqUNEAADK4O5C9kZSkivjFwFXeFYjbqxBABLX1mVxeBYuZmzZZPhmAiDp4oImChz1VMcj8UGj5pncBqvfkqLyC1Kd2J8NQ5LgJinXRiqcVCq6bYoTDVpcZua6X8cibYo5TR1IS13zSpnv6IpN13ckFGrnFDJWkZNTZEcxYGDNLBr0nSS67nO6LrScDb534f0IJm9E38sBzBiJmw3HrfExlK7GamYnXuaVcU7arNb312zDQRnX0CJcpAKuBQWU7HrRYg9uzasNyo
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x32c]
mov ebx, dword [ebp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push 0x60
pop ecx
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp + 0xc]
movsw word es:[edi], word [esi]
mov esi, str.TEqk2LdGfzXvS7ixS23Lnlvxsl0XY44ZeKj8TMvFJaiG7QUIpWPV5JGCygTvNK97JkxgNx0IrrwcqFWrxPKyuQp3bRQwo7hN4BX66xlR3fHBu3S0MseLBrCFWhWCEVvmpDe4Zu7OUgUTwwaOXfmHVPzbQHuqceCAmiRYrWKLXLKQmpxbekRtHhxLuDJ5GDY4AIOvlE1Fou88X7dasCQbRndm3nhFLUmRnMX94AXJcnyMWnQGCrW8ze7XUnjLZBvQueEKN3L4XbPRPuloMyBVRcuWgAA2orqZ7cmnoUqU7rdbnQ8a3IdQiV9rT9AiEqu27fZBPSig2YiJJongESZAo87o22WkfMRyWnzcB1MCipfKojkQDqj5zVGjWlx1hXKKA
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x194]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xb90], eax
xor eax, eax
mov dword [ebp - 0xb94], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb74], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb5c]
lea eax, [ebp - 0x32c]
push eax
call fcn.004057d0
lea eax, [ebp - 0xb5c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xb7c]
call fcn.00408170
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0xb5c]
push edi
call fcn.004096c0
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0xb5c]
call fcn.004057d0
lea eax, [ebp - 0xb5c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xb7c]
call fcn.00408170
push 0
push edi
lea ecx, [ebp - 0xb5c]
mov byte [ebp - 4], 0
call fcn.004096c0
push ebx
lea ecx, [ebp - 0xb44]
call fcn.004024f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xb60]
push eax
xor ebx, ebx
mov byte [ebp - 4], 3
push 0x20119
push ebx
push dword [ebp - 0xb80]
mov dword [ebp - 0xb60], ebx
push reloc.WS2_32.dll_closesocket
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xb68], ebx
call esi
test eax, eax
je 0x4d04bc
mov ecx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb44]
push eax
call fcn.00404610
jmp 0x4d05e2
lea eax, [ebp - 0xb70]
push eax
push 0x20119
push ebx
push str.SoftWare
push dword [ebp - 0xb60]
call esi
test eax, eax
je 0x4d04e8
push dword [ebp - 0xb60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4d04a5
lea eax, [ebp - 0xb6c]
push eax
push 0x20119
push ebx
push dword [ebp - 0xb84]
push dword [ebp - 0xb70]
call esi
test eax, eax
je 0x4d051f
push dword [ebp - 0xb70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xb60]
call esi
jmp 0x4d04a5
lea eax, [ebp - 0xb68]
push eax
push 0x20119
push ebx
push dword [ebp - 0xb88]
push dword [ebp - 0xb6c]
call esi
test eax, eax
je 0x4d0554
push dword [ebp - 0xb68]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xb6c]
jmp 0x4d0513
push 0x800
lea eax, [ebp - 0xb2c]
push ebx
push eax
call fcn.004f0ae0
add esp, 0xc
mov dword [ebp - 0xb8c], 0x400
lea eax, [ebp - 0xb8c]
push eax
lea eax, [ebp - 0xb2c]
push eax
push ebx
push ebx
push dword [ebp - 0xb90]
push dword [ebp - 0xb68]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xb68]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xb6c]
call esi
push dword [ebp - 0xb70]
call esi
push dword [ebp - 0xb60]
call esi
lea eax, [ebp - 0xb2c]
push eax
call fcn.00500d29
pop ecx
mov ecx, dword [ebp - 0xb64]
test eax, eax
je 0x4d04ab
lea eax, [ebp - 0xb2c]
push eax
call fcn.004024f0
push ebx
push edi
lea ecx, [ebp - 0xb44]
call fcn.00402590
lea ecx, [ebp - 0xb7c]
call fcn.0047920e
mov eax, dword [ebp - 0xb64]
call fcn.00513e4b
ret