Function at 0x4c35f5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa88
mov eax, 0x5442b8
call fcn.00506b61
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x234]
push 0x49
pop ecx
mov esi, str.x2xSMpijJZSRf1QsajC0iulL4FDO8Pz8p82jHXYHFwmUIEJaioiEs9bEYoter1smy3sA6pGYsiFU6OpoOVHXFxlwGSMRSc7V7VrOF22ywuZKJi0TxyXKLnVCKloWO7iAloyb3WSzytJCBlAYFQSuSYPnkzdCYoEnfTXVeqOSgP13Y07dtV9Dx3aLpwuZZ4dSJePOYbF6TTDkYuojvZOKsNEEFHZUvEAiU1JCZTnfcqnHAF9Zzq72rePO9qNe6Aby4cyHBp0kO2fNekGeV5VZ7UtKFzi3AkuZV16
mov ebx, dword [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
push 0x3f
pop ecx
mov esi, str.1HPB9YPDcgzIR9K9coErWxjPdHq7hyU2y9ShXPKgFQd4vSWA2EPF9UfpatxYJztyhR7Bqupdd2vpLBN0tz4V1OfyHuHKfb48o3erCeZQs7oTlGhT6AtmCGVdEnrKrN4u1th0GZkMYiKUtbdWJiLRc996HWr5YOh4JHFvoCxSzrwHsQllAx4AtZPwWTXgi9NkJrKpOc8yCWma1tXKBBKulpHD0Y75JZCL0ecPNFuqz9oX2OwQCUcEmkHdzJnB
mov dword [ebp - 0xa68], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa90], eax
xor eax, eax
mov dword [ebp - 0xa94], eax
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa7c], eax
mov dword [ebp - 0xa78], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xa64]
lea eax, [ebp - 0x234]
push eax
call fcn.00405820
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0xa80]
call fcn.00407e30
xor edi, edi
mov byte [ebp - 4], 0
push 0
inc edi
lea ecx, [ebp - 0xa64]
push edi
call fcn.0046d37e
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0xa64]
call fcn.00405820
lea eax, [ebp - 0xa64]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xa80]
call fcn.00407e30
push 0
push edi
lea ecx, [ebp - 0xa64]
mov byte [ebp - 4], 0
call fcn.0046d37e
push ebx
lea ecx, [ebp - 0xa4c]
call fcn.004024f0
lea eax, [ebp - 0xa74]
mov byte [ebp - 4], 3
push eax
xor ebx, ebx
mov esi, 0xf013f
push esi
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
mov dword [ebp - 0xa74], ebx
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xa6c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4c373d
mov ecx, dword [ebp - 0xa68]
lea eax, [ebp - 0xa4c]
push eax
call fcn.00404660
jmp 0x4c3834
push ebx
lea eax, [ebp - 0xa70]
push eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push ebx
push ebx
push ebx
push dword [ebp - 0xa84]
push dword [ebp - 0xa74]
call esi
test eax, eax
je 0x4c3770
push dword [ebp - 0xa74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4c3726
push ebx
lea eax, [ebp - 0xa6c]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp - 0xa88]
push dword [ebp - 0xa70]
call esi
test eax, eax
je 0x4c37ae
push dword [ebp - 0xa70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xa6c]
call esi
jmp 0x4c3726
push 0x800
lea eax, [ebp - 0xa34]
push ebx
push eax
call fcn.004e37a0
add esp, 0xc
mov dword [ebp - 0xa8c], 0x400
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xa34]
push eax
push ebx
push ebx
push dword [ebp - 0xa90]
push dword [ebp - 0xa6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa6c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xa70]
call esi
push dword [ebp - 0xa74]
call esi
lea eax, [ebp - 0xa34]
push eax
call fcn.004f3a59
pop ecx
mov ecx, dword [ebp - 0xa68]
test eax, eax
je 0x4c372c
lea eax, [ebp - 0xa34]
push eax
call fcn.004024f0
push ebx
push edi
lea ecx, [ebp - 0xa4c]
call fcn.00402590
lea ecx, [ebp - 0xa80]
call fcn.0046d3d0
mov eax, dword [ebp - 0xa68]
call fcn.00506b0b
ret