Function at 0x4813d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc4
mov eax, dword [0x5322a8]
xor eax, esp
mov dword [esp + 0xc0], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push str.Function_Start
mov dword [esp + 0x10], ecx
call fcn.004a4c50
mov eax, dword [esp + 0x10]
add esp, 4
cmp dword [eax + 0x18], 0
jne 0x481425
mov eax, pe_nt_image_headers32
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.004e3946
mov esp, ebp
pop ebp
ret
mov edi, dword [eax + 0x20]
mov eax, dword [edi + 0x14]
add eax, edi
mov dword [edi + 0x20], eax
mov dword [esp + 0x14], 0
mov eax, dword [edi + 0x14]
cmp eax, 0x78
je 0x4814c6
mov ecx, dword [edi + 0x10]
sub ecx, eax
push ecx
lea edx, [esp + 0x18]
push 0x78
push edx
call dword [0x539360]
mov eax, dword [edi + 0x14]
mov ecx, dword [esp + 0x20]
add esp, 0xc
push eax
push edi
push ecx
call fcn.004eaf30
mov edx, dword [esp + 0x20]
mov dword [edx + 0x14], 0x78
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x18]
add ecx, dword [eax + 0x14]
add esp, 0xc
mov dword [eax + 0x10], ecx
mov edx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push edx
add eax, edi
push eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x14]
add ecx, eax
push ecx
call fcn.004eaf30
mov edi, dword [edi + 0x14]
mov edx, dword [esp + 0x20]
mov eax, dword [edi + edx - 8]
sub edi, 8
add esp, 0xc
cmp edi, 0x78
jae 0x4814c2
mov ecx, dword [esp + 0x14]
mov dword [edi + ecx], eax
add edi, 8
cmp edi, 0x78
jb 0x4814b3
mov edi, dword [esp + 0x14]
mov edx, dword [0x53d028]
cmp edx, dword [edi + 0x18]
jne 0x481529
mov ecx, dword [edi + 0x20]
mov esi, dword [0x53d024]
mov eax, edx
cmp edx, 4
jb 0x4814f5
mov ebx, dword [esi]
cmp ebx, dword [ecx]
jne 0x481529
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x4814e1
test eax, eax
je 0x481bf1
mov bl, byte [ecx]
cmp bl, byte [esi]
jne 0x481529
cmp eax, 1
jbe 0x481bf1
mov bl, byte [ecx + 1]
cmp bl, byte [esi + 1]
jne 0x481529
cmp eax, 2
jbe 0x481bf1
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
je 0x481bf1
test edx, edx
je 0x48153c
push edx
push 0x53d024
call dword [0x5393d0]
add esp, 8
mov eax, dword [edi + 0x18]
push eax
push 0x53d024
mov dword [0x53d028], eax
call dword [0x5393c8]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x20]
mov eax, dword [0x53d024]
push ecx
push edx
push eax
call fcn.004eaf30
add esp, 0x14
lea ecx, [esp + 0x24]
push ecx
push 0x28
push edi
mov dword [esp + 0x30], 0
call dword [0x539394]
mov eax, dword [esp + 0x30]
add esp, 0xc
test eax, eax
je 0x481bdc
push eax
lea edx, [esp + 0x24]
xor esi, esi
push edx
mov dword [esp + 0x28], esi
call dword [0x5393c8]
mov eax, dword [esp + 0x28]
push eax
push 0x28
push edi
call dword [0x539388]
add esp, 0x14
mov ebx, 0x536cf0
mov eax, ebx
lea edx, [eax + 2]
jmp 0x4815c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4815c0
sub eax, edx
sar eax, 1
je 0x481841
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call fcn.004e5e02
add esp, 0xc
test eax, eax
je 0x481600
add ebx, 0x128
inc esi
cmp ebx, 0x5391f0
jl 0x4815b3
jmp 0x4818a6
imul esi, esi, 0x128
mov eax, dword [esi + 0x536df0]
lea ebx, [esi + 0x536df0]
test eax, eax
je 0x48186a
lea ecx, [esp + 0x1c]
push ecx
xor esi, esi
push 0x30
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call dword [0x539384]
mov eax, dword [esp + 0x28]
add esp, 0xc
cmp eax, esi
jbe 0x4817fd
push eax
lea edx, [esp + 0x1c]
push edx
call dword [0x5393b0]
mov eax, dword [esp + 0x20]
mov ecx, dword [ebx]
push eax
push 0x30
push ecx
call dword [0x539388]
add esp, 0x14
lea edx, [esp + 0x10]
push 0x103
push edx
mov dword [esp + 0x18], esi
call dword [0x5393b0]
push esi
mov esi, dword [esp + 0x1c]
call fcn.004a5de0
mov eax, dword [esp + 0x1c]
add esp, 0xc
add eax, 0xfffffffe
jmp 0x481690
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x481690
mov ecx, dword [str.PolicyLog_]
mov dword [eax], ecx
mov edx, dword [0x51ff48]
mov dword [eax + 4], edx
mov ecx, dword [0x51ff4c]
mov dword [eax + 8], ecx
mov edx, dword [0x51ff50]
mov dword [eax + 0xc], edx
mov ecx, dword [0x51ff54]
mov dword [eax + 0x10], ecx
mov edx, dword [0x51ff58]
mov dword [eax + 0x14], edx
mov eax, dword [esp + 0x10]
push eax
call fcn.004e447d
add esp, 4
cmp eax, 0xffffffff
jne 0x4816f0
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004e444b
add esp, 4
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x10]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x481704
movzx ecx, word [esp + 0x46]
push ecx
movzx ecx, word [esp + 0x48]
push ecx
movzx ecx, word [esp + 0x4a]
push ecx
movzx ecx, word [esp + 0x4c]
push ecx
movzx ecx, word [esp + 0x4e]
push ecx
movzx ecx, word [esp + 0x4e]
push ecx
movzx ecx, word [esp + 0x50]
sub eax, esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push ecx
sar eax, 1
lea edx, [edx + eax*2]
push str._04u__02u__02u.log
push edx
call esi
mov eax, dword [esp + 0x34]
add esp, 0x24
push 0
push 0x8000080
push 4
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x48177a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x53d02c]
xor ecx, ecx
push 0x3e
push ecx
lea edx, [esp + 0x52]
push edx
mov word [esp + 0x54], cx
call fcn.004e7d90
mov eax, dword [0x53d02c]
movzx ecx, word [esp + 0x50]
movzx edx, word [esp + 0x4e]
add esp, 0xc
push eax
movzx eax, word [esp + 0x44]
push ecx
push edx
push eax
lea ecx, [esp + 0x58]
push str._02u:_02u:_02u__03u_
push ecx
call esi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
add esp, 0x18
push edx
push eax
lea ecx, [esp + 0x50]
push ecx
push str.Description
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [0x5393b8]
lea ecx, [esp + 0x18]
push 0x103
push ecx
call dword [0x5393b8]
add esp, 0x10
xor esi, esi
push ebx
call dword [0x539368]
mov eax, dword [edi + 0x14]
mov edx, dword [edi + 0x10]
add esp, 4
sub edx, eax
push edx
push eax
push ebx
call dword [0x539360]
mov eax, dword [edi + 0x10]
mov ecx, dword [ebx]
add esp, 0xc
push eax
push edi
push ecx
call fcn.004eaf30
mov ebx, dword [ebx]
mov edx, dword [ebx + 0x14]
add esp, 0xc
add edx, ebx
mov dword [ebx + 0x20], edx
mov eax, dword [esp + 0xc]
mov dword [eax + 0x8c], esi
jmp 0x4818a8
mov eax, dword [esp + 0x20]
mov edx, esi
imul edx, edx, 0x128
lea ebx, [edx + 0x536cf0]
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
add eax, 2
test cx, cx
jne 0x481855
lea ebx, [edx + 0x536df0]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub ecx, eax
push ecx
push eax
push ebx
call dword [0x539360]
mov edx, dword [edi + 0x10]
mov eax, dword [ebx]
add esp, 0xc
push edx
push edi
push eax
call fcn.004eaf30
mov ebx, dword [ebx]
mov ecx, dword [ebx + 0x14]
add esp, 0xc
add ecx, ebx
mov dword [ebx + 0x20], ecx
mov edx, dword [esp + 0xc]
mov dword [edx + 0x8c], 0
xor esi, esi
mov eax, dword [esp + 0xc]
cmp dword [eax + 0x8c], esi
jne 0x481bc6
mov edx, dword [0x536df0]
lea ecx, [esp + 0x28]
push ecx
push 0x38
push edx
mov dword [esp + 0x34], esi
call dword [0x539394]
mov eax, dword [esp + 0x34]
add esp, 0xc
mov ebx, 3
mov edi, 0x101
cmp eax, esi
jbe 0x481ae5
push eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], esi
call dword [0x5393bc]
mov ecx, dword [esp + 0x24]
mov edx, dword [0x536df0]
push ecx
push 0x38
push edx
call dword [0x539398]
mov eax, dword [esp + 0x30]
add esp, 0x14
mov ecx, str.127.0.0.1
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x481940
test dl, dl
je 0x48193c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x481940
add eax, 2
add ecx, 2
test dl, dl
jne 0x481920
xor eax, eax
jmp 0x481945
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x481ad2
mov ecx, dword [0x536df0]
lea eax, [esp + 0x18]
push eax
push 0x60
push ecx
mov dword [esp + 0x24], esi
call dword [0x539374]
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp eax, esi
jg 0x481979
mov eax, 0x18
mov dword [esp + 0x18], eax
cmp dword [0x53d030], eax
je 0x481ad2
lea edx, [esp + 0x10]
push edx
mov dword [0x53d030], eax
mov dword [esp + 0x14], esi
call dword [0x539320]
mov eax, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x2c]
push edx
push 0x20019
mov dword [eax + 0x30], ebx
mov ecx, dword [esp + 0x18]
push esi
push str.SystemCurrentcontrolsetServicesWin_Win
mov dword [ecx + 0x34], edi
push reloc.WS2_32.dll_bind
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x481a67
push 0x7e
lea ecx, [esp + 0x4e]
push esi
push ecx
mov word [esp + 0x54], ax
call fcn.004e7d90
add esp, 0xc
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x38]
push ecx
push esi
push str.RunMode
push edx
mov dword [esp + 0x4c], 0x40
mov dword [esp + 0x48], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x481a67
mov ecx, 0x51ffe4
lea eax, [esp + 0x48]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x481a49
cmp dx, si
je 0x481a45
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x481a49
add eax, 4
add ecx, 4
cmp dx, si
jne 0x481a23
xor eax, eax
jmp 0x481a4e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x481a67
mov eax, dword [esp + 0x10]
mov dword [0x533648], 1
mov dword [eax + 0x34], 0x192
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
mov dword [edx + 0x60], 0xea60
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
imul eax, eax, 0x36ee80
lea edx, [esp + 0x10]
sub eax, 0xea60
push edx
mov dword [ecx + 0x54], eax
call fcn.004a8cf0
lea eax, [esp + 0x14]
add esp, 4
push eax
call dword [0x539324]
add esp, 4
push str.Reply_Initialize
push str.AssetReport
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x18], esi
mov dword [0x53b620], 1
call fcn.004a5390
add esp, 8
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call dword [0x5393c4]
add esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push ecx
mov dword [eax + 0x34], 0x202
call fcn.004a8c50
mov edx, dword [esp + 0x10]
mov dword [edx + 0x34], edi
mov eax, dword [esp + 0x10]
mov dword [eax + 0x5c], ebx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
add esp, 4
push edx
mov dword [ecx + 0x60], 0xbb8
call dword [0x539344]
add esp, 4
mov edi, 0x539270
lea esp, [esp]
mov eax, dword [edi]
cmp eax, esi
je 0x481b7c
push 0xb
push str.wmcPipeUser
push eax
call fcn.004e3cc1
add esp, 0xc
test eax, eax
jne 0x481b7c
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x48]
mov edx, 0x2e
mov word [ecx], dx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 0x48]
mov edx, dword [edi]
add eax, 0x20
mov cl, byte [edx]
mov byte [eax], cl
inc edx
inc eax
test cl, cl
jne 0x481b65
lea ecx, [esp + 0xc]
push ecx
call fcn.004a8c50
add esp, 4
add edi, 4
cmp edi, 0x5392f0
jl 0x481b30
mov edx, dword [esp + 0xc]
mov dword [edx + 0x5c], esi
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push ecx
mov dword [eax + 0x60], esi
call dword [0x539348]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
add esp, 4
push eax
mov dword [edx + 0x34], 0x401
call fcn.004a8c50
mov ecx, dword [esp + 0x10]
add esp, 4
mov dword [ecx + 0x34], 0x102
mov edx, dword [esp + 0x24]
add edx, 2
push edx
lea eax, [esp + 0x24]
push eax
call dword [0x5393d0]
add esp, 8
cmp dword [esp + 0x14], 0
je 0x481bf1
lea ecx, [esp + 0x14]
push ecx
call dword [0x539368]
add esp, 4
mov ecx, dword [esp + 0xc]
push str.Function_End
call fcn.004a4c50
mov ecx, dword [esp + 0xd0]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004e3946
mov esp, ebp
pop ebp
ret