Function at 0x4ac0b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ac5f0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x4ac608
call fcn.00404aa8
push 0x4ac620
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4ac5ac
xor edx, edx
push ebp
push 0x4ac5a5
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4ac630
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
mov edi, esi
test esi, esi
je 0x4ac58e
lea eax, [ebp - 0xb4]
xor ecx, ecx
mov edx, 0x9c
call fcn.00403368
mov dword [ebp - 0xb4], 0x9c
lea eax, [ebp - 0xb4]
push eax
call edi
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4ac1a2
lea eax, [ebp - 0xb4]
xor ecx, ecx
mov edx, 0x94
call fcn.00403368
mov dword [ebp - 0xb4], 0x94
lea eax, [ebp - 0xb4]
push eax
call edi
test eax, eax
jne 0x4ac1a2
call fcn.0040e3d0
mov eax, dword [ebp - 0xa4]
sub eax, 1
jb 0x4ac581
je 0x4ac4f2
dec eax
jne 0x4ac58e
cmp dword [ebp - 0xb0], 4
ja 0x4ac1d9
lea eax, [ebp - 0xc]
mov edx, 0x4ac648
call fcn.00404aa8
jmp 0x4ac27f
cmp dword [ebp - 0xb0], 5
jne 0x4ac1fd
cmp dword [ebp - 0xac], 0
jne 0x4ac1fd
lea eax, [ebp - 0xc]
mov edx, 0x4ac668
call fcn.00404aa8
jmp 0x4ac27f
cmp dword [ebp - 0xb0], 5
jne 0x4ac21e
cmp dword [ebp - 0xac], 1
jne 0x4ac21e
lea eax, [ebp - 0xc]
mov edx, 0x4ac688
call fcn.00404aa8
jmp 0x4ac27f
cmp dword [ebp - 0xb0], 5
jne 0x4ac23f
cmp dword [ebp - 0xac], 2
jne 0x4ac23f
lea eax, [ebp - 0xc]
mov edx, 0x4ac6a8
call fcn.00404aa8
jmp 0x4ac27f
cmp dword [ebp - 0xb0], 6
jne 0x4ac260
cmp dword [ebp - 0xac], 0
jne 0x4ac260
lea eax, [ebp - 0xc]
mov edx, 0x4ac6c8
call fcn.00404aa8
jmp 0x4ac27f
cmp dword [ebp - 0xb0], 6
jne 0x4ac27f
cmp dword [ebp - 0xac], 1
jne 0x4ac27f
lea eax, [ebp - 0xc]
mov edx, 0x4ac6e8
call fcn.00404aa8
test bl, bl
je 0x4ac31a
mov al, byte [ebp - 0x1a]
cmp al, 1
jne 0x4ac2c0
mov ax, word [ebp - 0x1c]
and ax, 0x200
cmp ax, 0x200
jne 0x4ac2ae
lea eax, [ebp - 0xc]
mov edx, 0x4ac700
call fcn.00404cd8
jmp 0x4ac3ef
lea eax, [ebp - 0xc]
mov edx, 0x4ac714
call fcn.00404cd8
jmp 0x4ac3ef
cmp al, 3
jne 0x4ac3ef
mov ax, word [ebp - 0x1c]
mov edx, eax
and dx, 0x80
cmp dx, 0x80
jne 0x4ac2ec
lea eax, [ebp - 0xc]
mov edx, 0x4ac72c
call fcn.00404cd8
jmp 0x4ac3ef
and ax, 2
cmp ax, 2
jne 0x4ac308
lea eax, [ebp - 0xc]
mov edx, 0x4ac748
call fcn.00404cd8
jmp 0x4ac3ef
lea eax, [ebp - 0xc]
mov edx, 0x4ac764
call fcn.00404cd8
jmp 0x4ac3ef
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4ac76c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x18], 0x14
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.0040505c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
push 0
push 0x4ac79c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x18]
call fcn.0040505c
lea edx, [ebp - 0xbc]
mov eax, dword [ebp - 0x14]
call fcn.00408e88
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.00408c38
mov eax, dword [ebp - 0xb8]
mov edx, 0x4ac7b0
call fcn.00404e1c
jne 0x4ac3b1
lea eax, [ebp - 0xc]
mov edx, 0x4ac7c0
call fcn.00404cd8
jmp 0x4ac3ef
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x14]
call fcn.00408e88
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00408c38
mov eax, dword [ebp - 0xc0]
mov edx, 0x4ac7d8
call fcn.00404e1c
jne 0x4ac3ef
lea eax, [ebp - 0xc]
mov edx, 0x4ac764
call fcn.00404cd8
mov ebx, dword [ebp - 0xb0]
cmp ebx, 4
ja 0x4ac488
lea eax, [ebp - 0xc8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0xb
mov dword [ebp - 0xe8], ebx
mov byte [ebp - 0xe4], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xe0], eax
mov byte [ebp - 0xdc], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xd8], eax
mov byte [ebp - 0xd4], 6
mov eax, dword [ebp - 0xa8]
and eax, 0xffff
mov dword [ebp - 0xd0], eax
mov byte [ebp - 0xcc], 0
lea edx, [ebp - 0xf0]
mov ecx, 4
mov eax, 0x4ac7ec
call fcn.0040a1e8
mov edx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc]
call fcn.00404aa8
jmp 0x4ac58e
lea eax, [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], 0xb
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x104], eax
mov byte [ebp - 0x100], 6
mov eax, dword [ebp - 0xa8]
and eax, 0xffff
mov dword [ebp - 0xfc], eax
mov byte [ebp - 0xf8], 0
lea edx, [ebp - 0x10c]
mov ecx, 2
mov eax, 0x4ac814
call fcn.0040a1e8
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0xc]
call fcn.00404aa8
jmp 0x4ac58e
cmp dword [ebp - 0xb0], 4
jne 0x4ac529
cmp dword [ebp - 0xac], 0
jne 0x4ac529
lea eax, [ebp - 0xc]
mov edx, 0x4ac82c
call fcn.00404aa8
cmp byte [ebp - 0x9f], 0x43
jne 0x4ac58e
lea eax, [ebp - 0xc]
mov edx, 0x4ac84c
call fcn.00404cd8
jmp 0x4ac58e
cmp dword [ebp - 0xb0], 4
jne 0x4ac560
cmp dword [ebp - 0xac], 0xa
jne 0x4ac560
lea eax, [ebp - 0xc]
mov edx, 0x4ac85c
call fcn.00404aa8
cmp byte [ebp - 0x9f], 0x41
jne 0x4ac58e
lea eax, [ebp - 0xc]
mov edx, 0x4ac87c
call fcn.00404cd8
jmp 0x4ac58e
cmp dword [ebp - 0xb0], 4
jne 0x4ac58e
cmp dword [ebp - 0xac], 0x5a
jne 0x4ac58e
lea eax, [ebp - 0xc]
mov edx, 0x4ac888
call fcn.00404aa8
jmp 0x4ac58e
lea eax, [ebp - 0xc]
mov edx, 0x4ac8a8
call fcn.00404aa8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac5ac
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
call fcn.00404a64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ac5f7
lea eax, [ebp - 0xf4]
call fcn.00404a10
lea eax, [ebp - 0xc8]
mov edx, 5
call fcn.00404a34
lea eax, [ebp - 0x14]
call fcn.00404a10
lea eax, [ebp - 0xc]
call fcn.00404a10
ret