Function at 0x4dd450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x73fa7d
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword fs:[0x2c]
mov ecx, dword [0x155fab8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x902f84]
cmp eax, dword [ecx + 0x78c]
jg 0x4dd767
cmp dword [0x844618], 0
push esi
jne 0x4dd4f9
mov edx, dword [0x8445ec]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4dd4a0
sub ecx, esi
push ecx
push edx
mov ecx, 0x844608
call fcn.00483e90
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemBIOS
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4dd4f9
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push str.BaseBoardManufacturer
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4dd518
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
push 0x844608
call fcn.00480e80
mov eax, dword [ebp + 8]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp edi, 0xf
ja 0x4dd554
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], edi
push 0
push eax
call fcn.007012e0
mov byte [ebp + edi - 0x34], 0
mov ebx, dword [ebp - 0x34]
jmp 0x4dd5a2
cmp edi, 0x7fffffff
ja 0x4dd79d
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4dd574
mov esi, bind
jmp 0x4dd57e
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x34]
call fcn.00483da0
push edi
mov ebx, eax
mov dword [ebp - 0x24], edi
push 0
push ebx
mov dword [ebp - 0x20], esi
call fcn.007012e0
mov byte [ebx + edi], 0
mov dword [ebp - 0x34], ebx
add esp, 0xc
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
cmovae eax, ebx
push eax
push 0
push 0
push str.BaseBoardManufacturer
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4dd630
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x844608
call fcn.00480e80
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x4dd61d
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dd613
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dd762
push edx
push ecx
call fcn.00512900
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop ebx
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
mov edi, dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
mov ebx, dword [0x84461c]
mov dword [ebp - 0x18], eax
cmp edi, ebx
ja 0x4dd674
cmp ebx, 0x10
mov dword [0x844618], edi
push edi
mov esi, 0x844608
cmovae esi, dword [0x844608]
push eax
push esi
call fcn.00700d60
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x4dd718
cmp edi, 0x7fffffff
ja 0x4dd7a2
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4dd694
mov esi, bind
jmp 0x4dd6b2
mov ecx, ebx
mov eax, bind
shr ecx, 1
sub eax, ecx
cmp ebx, eax
jbe 0x4dd6aa
mov esi, bind
jmp 0x4dd6b2
lea eax, [ebx + ecx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
mov ecx, 0x844608
push eax
call fcn.00483da0
push edi
push dword [ebp - 0x18]
mov dword [0x84461c], esi
mov esi, eax
push esi
mov dword [ebp - 0x1c], eax
mov dword [0x844618], edi
call fcn.00700d60
add esp, 0xc
mov byte [edi + esi], 0
cmp ebx, 0x10
jb 0x4dd712
mov ecx, dword [0x844608]
inc ebx
mov eax, ecx
cmp ebx, 0x1000
jb 0x4dd708
mov ecx, dword [ecx - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dd762
push ebx
push ecx
call fcn.00512900
add esp, 8
mov dword [0x844608], esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x844608
call fcn.00480e80
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x4dd61d
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4dd613
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4dd613
call fcn.0070b6e4
push 0x902f84
call fcn.006fee91
add esp, 4
cmp dword [0x902f84], 0xffffffff
jne 0x4dd48b
push 0x74ef70
call fcn.006fecf7
push 0x902f84
call fcn.006fee47
add esp, 8
jmp 0x4dd48b
call fcn.00483c00
call fcn.00483c00
int3